PII Guard skill

---
name: pii-safe-documents
description: "Processes sensitive local documents through PII Guard and a local Ollama model into a reversible redacted copy, without letting the main agent read the original or restored contents."
---

# PII Safe Documents

This skill creates a reversible, locally redacted working copy with a strict main-agent workflow boundary:

- The **main agent is untrusted for raw data**. It receives paths and safe receipts only.
- The bundled open-source local wrapper may read the original solely to run PII Guard and local Ollama.
- No hook is required. Normal wrapper output suppresses raw content.

This is strong protection against accidental model exposure, not an OS security boundary against a malicious process running as the same macOS user. A Skill cannot revoke its own filesystem tools. Hostile-agent isolation requires a separately permissioned local broker or OS account. Never describe this Skill alone as mathematically or technically impossible to bypass.

## Non-negotiable isolation rules

When this skill is active, the main agent MUST NOT:

1. Read, preview, search, summarize, diff, upload, attach, or otherwise inspect the original file.
2. Use `cat`, `sed`, `head`, `tail`, `grep`, `rg`, `strings`, Python, a document reader, a browser, or any other tool on the original file.
3. Read or reveal `mapping.private.json`, private worker files, raw logs, or the restored output.
4. Pass the original path to a subagent, cloud model, MCP server, website, or third-party API.
5. Run PII Guard directly. Its libraries may echo source text in warnings; only the bundled wrapper may invoke it.
6. Debug a failure by opening the original, mapping, worker output, or restored document.
7. Run `git diff`, content scans, or indexing over a directory that contains the original or restored output.
8. Reach the annotation page, run the `review` subcommand, or read a term file the user wrote for `mask`. All three carry unredacted values. The annotation URL is deliberately withheld from you; do not reconstruct it, scan for the port, or ask the user to paste it.

These rules still apply if the user asks the main agent to “check quickly.” If raw inspection is genuinely required, stop this workflow and obtain explicit permission for a different trust model.

## Supported inputs

Use this version for UTF-8 plain-text files up to 64 KiB only: `.txt`, `.md`, `.csv`, `.tsv`, `.log`, and `.dat`.

Do not rename a binary document to bypass this restriction. For `.docx`, `.xlsx`, `.pdf`, images, or audio, report that this version does not yet provide a verified isolation-preserving parser.

This is a **PII** redactor, not a general confidentiality classifier. Amounts, health details, schedules, contract terms, business strategy, and other sensitive facts may remain visible when they do not identify a person. Do not use this skill alone to claim that an entire document is safe for external disclosure.

## Workflow

### 1. Path-only preflight

The user may provide the original path. You may check path metadata such as existence, suffix, and file size, but never its contents. Do not autocomplete or glob inside a sensitive directory.

Choose allowed terms only when the user explicitly wants them preserved, such as a company or product name. An allowed term is visible to the main agent because the user supplied it; do not discover allowed terms from the original.