Error message sanitization

Skill fabioc-aloha/Alex_Skill_Mall/plugins/security-privacy/error-message-sanitization

284 curated plugins for AI assistants across 16 categories: security, Azure, documentation, code quality, cloud infrastructure, and more. Works with GitHub Copilot. Drop into .github/skills/local/ and go.

Install

npx -y skills add fabioc-aloha/Alex_Skill_Mall --skill error-message-sanitization

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

One thing to look at

3 stars3 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

What its author says it does

Copied from the file, not written here

Raw error messages leak internal information to users:

SKILL.md

2.1 KB, as published. Nobody here has run it

Error Message Sanitization

The Problem

Raw error messages leak internal information to users:

File paths reveal directory structure
Stack traces expose code organization
Internal state shows implementation details
SDK errors contain connection strings or endpoints

// Bad: leaks internals
catch (err) {
  res.status(500).json({ error: err.message, stack: err.stack });
}

The Solution

Sanitize at system boundaries before returning errors to users.

function sanitizeForUser(error) {
  let msg = error.message || 'An error occurred';
  
  // Strip absolute paths
  msg = msg.replace(/[A-Z]:\\[^\s]+/gi, '[path]');
  msg = msg.replace(/\/(?:home|usr|var|etc)[^\s]+/gi, '[path]');
  
  // Strip stack traces
  msg = msg.replace(/\s+at\s+.+\(.+:\d+:\d+\)/g, '');
  
  // Strip connection strings
  msg = msg.replace(/(?:mongodb|postgresql|mysql|redis):\/\/[^\s]+/gi, '[connection]');
  
  // Strip Azure resource IDs
  msg = msg.replace(/\/subscriptions\/[a-f0-9-]+/gi, '/subscriptions/[id]');
  
  return msg;
}

// Usage
catch (err) {
  console.error('Internal error:', err); // Full error for logs
  res.status(500).json({ 
    error: sanitizeForUser(err),
    requestId: req.id // For support correlation
  });
}

Verification

const testCases = [
  'Failed at C:\\Users\\dev\\project\\src\\api.js:42',
  'Connection failed: mongodb://user:pass@host:27017/db',
  '/subscriptions/abc-123/resourceGroups/prod/...',
  'Error in /home/deploy/app/server.js'
];

testCases.forEach(msg => {
  const sanitized = sanitizeForUser({ message: msg });
  console.log(sanitized);
  // Should not contain actual paths, credentials, or resource IDs
});

When to Apply

REST API error responses
GraphQL error messages
WebSocket error events
Any user-facing error display