@axsept/anonymizer

Local PII and secret stripping for SkillChain integration wrappers. Implements the anonymization contract defined by the SkillChain integration protocol.

This package runs entirely on the wrapper-side machine. Raw content never leaves the user's environment in a SkillChain-compatible wrapper — only the post-anonymization output is transmitted to the SkillChain BFF.

Install

npm install @axsept/anonymizer

Use

import { anonymize } from "@axsept/anonymizer";

const { output, ruleset_version } = anonymize(
  "Email me at [email protected] about the AWS_ACCESS_KEY_ID=AKIAIOSFODNN7EXAMPLE issue.",
);

console.log(output);
// "Email me at [REDACTED:PII] about the AWS_ACCESS_KEY_ID=[REDACTED:SECRET] issue."

// Pass the ruleset_version through to your HumanAIEvent payload:
//   event.anonymization = { applied: true, ruleset_version }

Audit mode

For enterprise / regulated environments, pass audit: true to get a detailed report of what was stripped:

const { output, stripped } = anonymize(input, { audit: true });

for (const span of stripped) {
  console.log(`Stripped ${span.category}/${span.pattern}: "${span.match}" at ${span.start}-${span.end}`);
}

The audit output uses original-text positions (not post-redaction positions), so it can be cross-referenced with the wrapper's local conversation buffer.

Per-user denylist

If the user provides a list of literal strings to always redact (project codenames, customer names, etc.), pass them as denylist:

const { output } = anonymize(input, {
  denylist: ["Project Phoenix", "Initiative Atlas"],
});

Denylist matches are case-insensitive and treat the input as a literal string (regex metacharacters are escaped).

What is stripped

Secrets

| Pattern | Example | |---|---| | AWS access key IDs (AKIA…, ASIA…) | AKIAIOSFODNN7EXAMPLE | | GitHub tokens (ghp_…, gho_…, github_pat_…) | ghp_AAA… | | OpenAI-style keys (sk-…) | sk-AAA… | | Stripe-style scoped keys (sk_live_…, sk_test_…, etc.) | sk_live_AAA… | | Slack tokens (xoxb-…, xoxp-…) | xoxb-1234-5678-AAA | | JWT-shaped tokens | eyJ…ABC…SIG | | Bearer tokens in Authorization: headers | Bearer aBcDeF… | | api_key=, apikey:, secret_key=… assignments | api_key: "abcdef…" | | SSH private key blocks | -----BEGIN … PRIVATE KEY----- … -----END … PRIVATE KEY----- | | PEM certificate blocks | -----BEGIN CERTIFICATE----- … -----END CERTIFICATE----- |

PII

| Pattern | Example | |---|---| | Email addresses | [email protected] | | US-format SSNs | 123-45-6789 | | Credit card numbers (16-digit, grouped) | 4111-1111-1111-1111 | | US phone numbers | (555) 234-5678 | | E.164 international phone numbers | +14155551234 |

What is NOT stripped

The anonymizer is conservative toward redaction but preserves skill vocabulary aggressively. Specifically, none of these are touched:

• Technical terms — framework names, language names, library names, concept vocabulary (React, FastAPI, pgvector, transformer, course_correcting, …)
• Generic names — without an @ sign or other PII context, "Alice" or "Bob" stays
• URLs without query strings — https://example.com/path is preserved; consider denylisting if a URL contains sensitive identifiers
• IP addresses — neither v4 nor v6 are stripped by default (they're often legitimate technical content; add to denylist if needed)
• Numbers that aren't obviously identifiers — version strings, counts, percentages, dates

The design tradeoff is deliberate: false positives on skill vocabulary cost some extraction quality; false negatives on secrets cost user trust irreversibly.

Idempotency

anonymize(anonymize(x).output).output === anonymize(x).output — redactions are safe to apply repeatedly. The redacted placeholder strings ([REDACTED:SECRET], [REDACTED:PII], [REDACTED:DENYLIST]) do not themselves match any of the patterns.

Versioning

This package follows semver. The package version is also the ruleset version that wrappers attest to in their HumanAIEvent:

• Major version changes mean a pattern was removed or its category was changed. Wrappers should verify their threat model still holds before upgrading.
• Minor version changes mean new patterns were added (defaults to stricter, never looser).
• Patch version changes are bugfixes in existing patterns.

The current ruleset_version is exported as RULESET_VERSION for convenience.

License

Apache-2.0