Pii detection
31 cross-platform AI agent skills for regulated industries & underserved markets. EU compliance (AI Act, NIS2, DORA, GDPR), French professional (accounting, tax, notary, real estate), security audit, agent evaluation, Africa mobile money, offline-first.
npx -y skills add BuilderCed/agent-skills --skill pii-detectionAssembled from the repository path, not quoted from the project. Check it against their README if it does not work.
One thing to look at
- 2 stars2 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.
What its author says it does
Copied from the file, not written here
Detect personally identifiable information (PII) in code, data, and agent outputs before processing or storage. Multi-language, GDPR-aware.
The file declares its own license as MIT. That is the author’s claim about this one file, and it is not the same thing as the license GitHub reports for the repository, which is listed with the other numbers below.
SKILL.md
3.9 KB, as published. Nobody here has run it
PII Detection
DISCLAIMER: This skill provides detection patterns only. It does not guarantee complete PII identification. Always verify with a DPO for GDPR compliance decisions.
When to Use
- Before sending data to an LLM API
- Before logging or storing agent outputs
- During data pipeline design
- When reviewing code that handles user data
- Before sharing datasets or exports
PII Categories
High Sensitivity (must always detect)
| Category | Patterns | Examples |
|---|---|---|
\b[\w.-]+@[\w.-]+\.\w+\b | [email protected] | |
| Phone | \+?\d[\d\s\-().]{7,}\d | +33 6 12 34 56 78 |
| SSN (FR) | \b[12]\s?\d{2}\s?\d{2}\s?\d{2}\s?\d{3}\s?\d{3}\s?\d{2}\b | 1 85 05 75 123 456 78 |
| SSN (US) | \b\d{3}-\d{2}-\d{4}\b | 123-45-6789 |
| Credit Card | \b\d{4}[\s-]?\d{4}[\s-]?\d{4}[\s-]?\d{4}\b | 4111-1111-1111-1111 |
| IBAN | \b[A-Z]{2}\d{2}[\s]?[\dA-Z]{4}[\s]?[\dA-Z]{4}[\s]?[\dA-Z]{4} | FR76 1234 5678 9012 |
| Passport | Context-dependent | 12AB34567 |
Medium Sensitivity (detect in context)
| Category | Patterns | Notes |
|---|---|---|
| Full name | Named entity recognition | Combine first + last name |
| Address | Street + city + postal code | Multi-format per country |
| Date of birth | Date near age/birth context | Not all dates are PII |
| IP Address | \b\d{1,3}(\.\d{1,3}){3}\b | IPv4; check if user-linked |
| Vehicle plate | Country-specific format | FR: AA-123-BB |
Low Sensitivity (flag only)
| Category | Notes |
|---|---|
| Age | PII only when combinable |
| Gender | PII only when combinable |
| Location (city) | PII only when precise |
| Job title | PII only with employer |
Detection Process
- Scan the input text for high-sensitivity patterns
- Flag medium-sensitivity items with context check
- Report findings with location and category
- Recommend action: redact, anonymize, or approve
Remediation Actions
| Action | When | Method |
|---|---|---|
| Redact | Before logging | Replace with [REDACTED] |
| Pseudonymize | Before analysis | Replace with consistent fake (e.g., hash-based) |
| Anonymize | Before sharing | Remove irreversibly (k-anonymity, differential privacy) |
| Encrypt | Before storage | AES-256 at rest, TLS in transit |
| Approve | Legitimate purpose | Document legal basis (GDPR Art. 6) |
GDPR Special Categories (Article 9)
These require explicit consent or legal basis:
- Racial or ethnic origin
- Political opinions
- Religious beliefs
- Trade union membership
- Genetic data
- Biometric data (for identification)
- Health data
- Sex life or sexual orientation
Detection: Use keyword lists + context analysis. Never store without documented legal basis.
Output Format
PII SCAN REPORT
Source: {file/variable/output}
Items found: {count}
[HIGH] Email: [email protected] (line 42)
[HIGH] Phone: +33 6 12 34 56 78 (line 67)
[MED] Full name: "Jean Dupont" (line 12, with address context)
[LOW] City: "Paris" (line 15, no combination risk)
Recommendation: Redact HIGH items before processing.
GDPR basis required: YES (personal data detected)
What This Skill Does NOT Do
- Does not encrypt or store data (patterns only)
- Does not determine GDPR legal basis (legal decision)
- Does not handle consent management (UI/UX concern)
- Does not replace a DPO assessment