From SENTINEL — Security & Privacy Gate
Automated PII (Personally Identifiable Information) and security audit across codebases. Scans data files, git history, code, and configuration for sensitive information (names, emails, phone numbers, API keys, passwords, credentials). Runs parallel audits across data, git, code, and SPA layers. Produces comprehensive PII-REPORT.md with findings, risk assessments, and recommendations. Trigger with /pii-audit [scope] where scope is: full (all systems), data (data files only), git (history only), code (source code only), spa (SPA/frontend only), or project-root for a specific directory. Default: full scan of current repository.
How this skill is triggered — by the user, by Claude, or both
Slash command
/sentinel:pii-auditThe summary Claude sees in its skill listing — used to decide when to auto-load this skill
Comprehensive personally identifiable information (PII) and security credential audit for software projects. Executes **parallel multi-agent scans** across data files, git history, source code, and SPA codebases to identify and report any sensitive information that may have been committed or exposed.
Comprehensive personally identifiable information (PII) and security credential audit for software projects. Executes parallel multi-agent scans across data files, git history, source code, and SPA codebases to identify and report any sensitive information that may have been committed or exposed.
# Full audit of current repository
/pii-audit
# Audit specific scope
/pii-audit data # data files only
/pii-audit git # git history only
/pii-audit code # source code only
/pii-audit spa # frontend/SPA only
/pii-audit /path/to/project # custom project root
PII includes ANY sensitive information about identifiable people or systems:
Excludes:
Spawns 4 independent parallel agents to maximize coverage and speed:
| Agent | Scope | Technique | Output |
|---|---|---|---|
| Data Files Agent | CSV, JSON, YAML in data/, assets/, config/ | File-by-file inspection | List of findings by file/field |
| Git History Agent | All commits, branches, tags | git log -p, grep patterns, history traversal | Findings by commit/file, no risk if clean |
| Source Code Agent | Python, JavaScript, TypeScript, Go, Java, etc. | String/comment inspection, token detection | Code location, line numbers, context |
| SPA/Frontend Agent | Frontend files (JS, TS, HTML, CSS, JSON) | Frontend-specific scanning | UI/config exposure risks |
Creates PII-REPORT.md with:
When: Initial security review, before open-sourcing, after significant data changes, periodic compliance checks
Execution:
/pii-audit
Scans:
Output: Comprehensive PII-REPORT.md with all findings aggregated
When: Incremental checks, specific layer concerns, post-deployment verification
Examples:
/pii-audit data # Just data files (CSV, JSON)
/pii-audit git # Just git history (check for commits with leaks)
/pii-audit code # Just source code (find hardcoded secrets)
/pii-audit spa # Just frontend (check for embedded PII)
/pii-audit /path/to/app # Custom directory
Each scope:
/pii-audit [scope]All agents receive:
references/PII-DEFINITION.md)Each agent:
Results are merged into single PII-REPORT.md:
If findings are acceptable, automatically stage and commit report:
git add PII-REPORT.md
git commit -m "docs: add PII audit report — [summary]"
git push origin [branch]
Each finding is classified by risk level:
| Level | Meaning | Action | Example |
|---|---|---|---|
| CRITICAL | Real PII or active credentials in code | Immediate remediation | API key, password, SSN |
| HIGH | Real personal data that should be private | Fix before shipping | Real person's email/phone |
| MEDIUM | Borderline data (context matters) | Review and decide | Test data vs production data |
| LOW | Unlikely to be real PII | Monitor | Synthetic names in fixtures |
| MINIMAL | No PII found | Document | Empty result |
| Document | Purpose |
|---|---|
references/PII-DEFINITION.md | Detailed PII taxonomy with examples |
references/AUDIT-SCOPE.md | Directories and file types scanned per mode |
references/AGENT-INSTRUCTIONS.md | Per-agent scan instructions and techniques |
references/REMEDIATION.md | How to fix common PII exposure issues |
references/COMPLIANCE-NOTES.md | GDPR, CCPA, and other privacy regulations |
Q: Does the audit catch all PII?
A: The audit is comprehensive but not foolproof. It catches patterns and common mistakes (hardcoded keys, email addresses, phone patterns). It won't catch cleverly obfuscated data. Treat it as "trust but verify" — review findings carefully.
Q: Can I exclude certain files/directories?
A: Yes. Pass a .piiignore file in project root with patterns (one per line, glob syntax). Files matching are skipped.
Q: What if I have false positives?
A: Comment them in the report. Update .piiignore to skip that file/pattern in future audits. Contact skill maintainer if the pattern is systematic.
Q: Can I audit a third-party project?
A: Yes. Provide the full path: /pii-audit /path/to/project. Audit runs on that tree; report is written to that directory.
Q: How often should I audit?
A: Minimum: before any public release. Recommended: on every PR, via CI, or monthly. The cost is low; the risk of missing a leak is high.
Reported (if found):
Not reported (by design):
# PII Audit Report — MyProject
**Date:** 2026-05-25
**Scope:** Full audit
**Overall Risk:** MINIMAL ✓
## Executive Summary
| Category | Status | Risk Level |
|----------|--------|-----------|
| Data Files | ✓ Clean | MINIMAL |
| Git History | ✓ Clean | MINIMAL |
| Source Code | ✓ Clean | MINIMAL |
| SPA/Frontend | ✓ Clean | MINIMAL |
## DATA FILES
✓ No PII found
## git history trawler
✓ No credentials detected in history
## SOURCE CODE
✓ No hardcoded secrets
## SPA PII
✓ No frontend exposure
## Recommendations
...
## Appendix: Files Referenced
| Filename | Full Path |
|----------|-----------|
...
This skill carries the self-improvement covenant:
REMEDIATION.mdSubmit feedback by opening an issue on the marketplace repository, or surface it to the user.
references/PII-DEFINITION.md — Comprehensive taxonomy of what counts as PIIreferences/AGENT-INSTRUCTIONS.md — Detailed parallel agent scan methodologyreferences/COMPLIANCE-NOTES.md — GDPR, CCPA, privacy law implicationsreferences/REMEDIATION.md — Fix strategies for common exposuresnpx claudepluginhub agentic-underground/idea-to-productionGuides test-driven development for Django applications using pytest-django, factory_boy, and Django REST Framework. Covers red-green-refactor workflow, conftest fixtures, and coverage reporting.