Skill v1.0.0

version: "1.0.0" metadata: api_version: azuresre.ai/v2 kind: Skill name: redaction-guard description: Use whenever you are about to emit operator-visible content — a chat/thread message, a PagerDuty or ServiceNow note, a commit message or pull-request body, or any report artifact (HTML, PowerPoint, Teams card). Deterministically masks secrets, credentials, tokens, private keys, URI-embedded passwords, and PII so they never appear in the thread or in any deliverable. This is a cross-cutting guardrail invoked by the output-producing skills, not a runbook step. tools:

• SearchMemory
• ExecutePythonCode

Zava Learning — Redaction Guard

A cross-cutting safety layer: nothing sensitive ever reaches an operator-visible surface. The triggering alert is symptom-only and the investigation touches Key Vault secrets, connection strings, access tokens and learner PII — none of which may be exposed in chat, notes, PRs, or reports.

Load the standard, then scrub

Retrieve the canonical policy and scrubber with SearchMemory("zava-redaction"). It defines what counts as sensitive, the credential files you must never print, and a deterministic redact() function. Apply redact() (via ExecutePythonCode) to every string you are about to emit — chat summary, note body, PR/commit text, and the assembled HTML/markdown/deck — before it leaves the agent. The scrubber is idempotent, so running it more than once is safe.

What to redact (summary — see zava-redaction for the full list)

• Secrets & credentials: passwords, PGPASSWORD, connection strings, Key Vault secret values,

client secrets, API / access / account keys, SAS tokens.

• Tokens: GitHub PATs (gho_/ghp_/github_pat_…), JWTs / AAD access tokens (eyJ…), bearer /

Authorization values.

• Private keys: any -----BEGIN … PRIVATE KEY----- block, SSH/cert keys.
• Credentials inside URIs: the password in scheme://user:password@host.
• PII: email addresses and learner personal data from the database.

Keep resource names, resource groups, regions, app names, alert names, and PR/CR numbers — they are not sensitive and are needed for the narrative.

Hard rules

• Never read or print credential files. Reference them by name only — never cat / Get-Content

/ echo / type the contents of .git/git-credentials, .env, *.pem, id_rsa*, *.pfx, kubeconfig, ~/.azure/*, or *.tfstate into the thread or a report.

• When a command can echo a secret (e.g. az keyvault secret show), do not paste its output —

confirm the fact ("secret present / rotated") without revealing the value.

• When in doubt, redact. Replace with [REDACTED:<CLASS>]; for URI credentials keep the scheme and

username and mask only the password.

How the other skills use this

zava-reporting, pagerduty-incident-update, servicenow-change-management, and pr-delivery each call redact() on their output before emitting. Because loading a separate skill swaps the active toolset, those skills inline the redact() function (retrieved via SearchMemory("zava-redaction")) within their own ExecutePythonCode step rather than handing off here — this skill is the authoritative definition they follow.

Verification

Every operator-visible string has passed through redact() (or equivalent manual masking) and shows [REDACTED:<CLASS>] in place of any secret, token, private key, URI credential, or PII. No credential file was ever printed to the thread or a deliverable.