expanso-remove-pii
Pass
Audited by Gen Agent Trust Hub on Jun 17, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: No security issues were detected in the skill instructions or associated configuration files.
- [COMMAND_EXECUTION]: The skill includes shell scripts (
run.sh,test.sh) to manage the data pipeline. These scripts execute theexpansoCLI and standard system utilities likegrep,yq, andpython3for configuration validation and execution. All commands are limited to the intended functionality of the tool. - [EXTERNAL_DOWNLOADS]: The documentation references installation via
clawhuband links to official resources atdocs.expanso.ioandexamples.expanso.io. These are vendor-owned domains used for legitimate documentation and example purposes. - [CREDENTIALS_UNSAFE]: The pipeline configuration correctly utilizes environment variables (
IP_SALT,EMAIL_SALT,USER_SALT) for sensitive cryptographic salts rather than hardcoding them. The documentation includes explicit warnings and instructions for secure secret management.
Audit Metadata