wiki-privacy-auditlisted

Audits an Obsidian vault's notes for Direct PII and Secrets accidentally captured while journaling or researching — reuses privacy-linter's deterministic scan_diff.py rather than reimplementing detection. Reports findings and proposes redaction/removal with confirmation; never edits vault content automatically. Use when the user wants to check their notes/journal for leaked personal information or credentials, asks "did I ever paste something sensitive into my vault," or wants a periodic privacy health check on their knowledge base. Triggers on "audit my vault for PII," "check my notes for secrets," "did I leak anything into my vault," "privacy audit my wiki," and the command /privacy-audit. Requires the obsidian-vault MCP server connected (to resolve the vault's local filesystem path) and privacy-linter's scan_diff.py (a sibling skill, invoked directly as a subprocess, not reimplemented). Does not cover attached-image metadata or vault git history — see "What's NOT covered here."
Hefrock/agent-skills · ★ 0 · AI & Automation · score 68

Install: claude install-skill Hefrock/agent-skills

# Wiki Privacy Audit A personal knowledge vault is exactly the kind of place a stray SSN, phone number, or API key ends up — pasted into a journal entry, a meeting note, a research capture — without the deliberate "am I about to commit this" moment a git hook gives you. This skill runs the same detection `privacy-linter` already uses for commits against every note in the vault instead. ## Why this reuses privacy-linter instead of its own detection Two schemes for the same problem drift apart the moment one gets updated and the other doesn't — the exact failure this repo's own `qa_gate_history.py` and `deid-reid- harness`'s `score_inference.py` docstrings warn about for their own cross-skill calls. `scripts/check_vault_privacy.py` shells out to `privacy-linter/scripts/scan_diff.py --file <note> --json` per note and aggregates the results — `privacy-linter` stays the single source of truth for what counts as PII or a secret, and a future improvement there (a new secret pattern, a fixed false positive) applies here automatically, with no separate patch needed. ## Prerequisites The `obsidian-vault` MCP server connected (same setup as `wiki-operator`/`wiki- librarian`) — needed to resolve the vault's local filesystem path, since `check_vault_privacy.py` operates on the vault as a plain directory of `.md` files, not through the MCP tool interface. If the vault's local path is already known (e.g. from `bin/setup-vault.sh`'s output), the MCP server isn't strictly required for a