Detect and Mask Sensitive Data in Images Locally

This skill detects and masks sensitive information in images locally, before they leave the machine, using the privacy-mask CLI. It requires privacy-mask to be pre-installed (pip install privacy-mask), plus Tesseract OCR (brew install tesseract on macOS or apt install tesseract-ocr on Linux), with optional NER support via pip install privacy-mask[ner]. Core usage is privacy-mask mask <path>, with flags for --in-place (overwrite the original), --dry-run (detect only, no masking), --detection-engine regex (skip NER), and --config <path> for custom detection rules; output is JSON listing each detection's label, masked text, and bounding box plus a summary count. The documented workflow is: given a screenshot, run a dry-run detection first, and if anything is found, mask the image (saved as <name>_masked.png) before using it for any further analysis. Detection coverage spans government IDs (Chinese ID card, passport, HK/TW ID, US SSN, UK NINO, Canadian SIN, Indian Aadhaar/PAN, Korean RRN, Singapore NRIC, Malaysian IC), phone numbers (Chinese mobile/landline, US, international), financial data (bank card, Amex, IBAN, SWIFT/BIC), developer secrets (AWS, GitHub, Slack, Google, Stripe tokens, JWTs, connection strings, API keys, SSH/PEM keys), crypto wallet addresses (Bitcoin, Ethereum), and other identifiers (email, birthday, IP/IPv6, MAC, UUID, license plate, MRZ, URL auth tokens), plus optional NER-based detection of person names, street addresses, organizations, dates of birth, and medical conditions.

Use it when a user sends a screenshot or image (.png/.jpg/.jpeg/.bmp/.tiff) that may contain private data, when privacy/masking/redacting/anonymizing is mentioned, or before analyzing an image where sensitive info should be redacted first - if the user shares a debugging screenshot, run a dry-run check before proceeding with analysis. Do NOT send an unmasked image to any external API or cloud service, do not skip masking once detections are found, do not modify the original image unless --in-place is explicitly requested, and do not assume an image is clean without actually running detection - a clean-looking screenshot can still contain PII in metadata or small text. Warn the user before processing very large images (over 10MB) given the added processing time.

Inputs: an image file path and optional flags (--in-place, --dry-run, --detection-engine, --config). Outputs: a JSON result listing each detection's label, masked text, and bounding box with a summary count, and - unless run in dry-run mode - a masked copy of the image (or an in-place overwrite if explicitly requested).

privacy-mask mask /path/to/screenshot.png

Built on the privacy-mask CLI with Tesseract OCR for text extraction from images, an optional NER model for name/address/organization detection, and a bundled or custom config.json for detection rules. All processing runs locally and offline - no data leaves the machine.

Anyone sharing or analyzing screenshots that might contain PII, credentials, or financial data - especially for debugging workflows where a screenshot needs sanitizing before further use.