| name | pii-redaction |
| version | 1.0.0 |
| description | Detect and redact personally identifiable information (PII) from text using a four-tier pipeline (regex + NLP + NER + LLM-as-judge) |
| author | Frame.dev |
| namespace | wunderland |
| category | security |
| tags | ["pii","privacy","redaction","gdpr","hipaa","compliance","security","ner"] |
| requires_tools | ["pii_scan","pii_redact"] |
| metadata | {"agentos":{"emoji":"🛡","primaryEnv":"PII_LLM_API_KEY"}} |
PII Redaction
You have access to PII detection and redaction capabilities. A guardrail
automatically redacts PII from your inputs and outputs, but you can also
proactively scan and redact text before storing it, sending it to external
APIs, or sharing it across agents.
When to Use
- Before storing user-provided text in memory or database
- Before sending text to third-party APIs or external tools
- Before sharing content across agents in multi-agent systems
- When a user asks you to anonymize or de-identify text
- When handling medical, financial, or legal documents
Available Tools
pii_scan
Scan text and return detected PII entities with type, confidence, and location.
Use this to audit text without modifying it.
pii_redact
Redact PII from text and return the sanitized version. Supports styles:
- placeholder: [PERSON], [EMAIL], [SSN]
- mask: J*** S****, @.com
- hash: [PERSON:a1b2c3d4e5] (deterministic, correlatable)
- category-tag: REDACTED
Best Practices
- Scan before store: always run pii_scan before writing user data to memory
- Use placeholder style for human-readable output
- Use hash style when you need to correlate redacted entities across documents
- If a user explicitly asks you to include their name/email, respect that —
the guardrail handles involuntary leakage, not intentional sharing
Post-Approval Guardrail Override
When HITL is enabled with guardrailOverride: true (the default), PII redaction runs as a post-approval guardrail. Tool arguments that pass HITL approval (human or LLM judge) are still scanned for PII before execution. This catches cases where a human approves a tool call without noticing that the arguments contain SSNs, credit card numbers, or other sensitive data. See the hitl-safety skill for full HITL configuration.
Constraints
- NER model (~110MB) loads lazily on first detection of name-like tokens
- LLM judge calls cost tokens — only invoked for ambiguous cases
- Regex patterns cover 50+ countries for government IDs
