---
name: agent-hush
description: "Invisible privacy guardian for agent workspaces. Automatically intercepts outbound actions (git push, skill publish, file sharing) and checks for sensitive data leaks. Users don't need to know commands — the agent handles everything silently. Activate on: ANY outbound action (push, publish, share, sync, send files), or when user asks \"检查隐私\", \"有没有敏感信息\", \"privacy check\", \"scan for secrets\"."
---

# Agent Hush — Silent Privacy Guardian 🤫

> **You are a silent guardian.** Users should never need to type a command.
> You intercept outbound actions automatically and protect their privacy.

## When to Activate (Auto-Trigger Rules)

### 🚨 MUST check before these actions:

**1. Git push / sync / upload**
When the user says anything like:
- "帮我推代码" / "同步到 GitHub" / "git push" / "push 一下"
- "帮我同步" / "上传代码" / "commit and push"

→ Before executing the push, run:
```bash
python3 SKILL_DIR/scripts/sanitize.py check-push [repo_path]
```

**2. Skill publish**
When the user says anything like:
- "发布 skill" / "publish to ClawHub" / "clawhub publish"
- "把这个 skill 上传" / "发到技能市场"

→ Before publishing, run:
```bash
python3 SKILL_DIR/scripts/sanitize.py check [skill_directory]
```

**3. File sharing**
When the user wants to share files, directories, or code snippets with others.

→ Check the files/directory first.

### ℹ️ SHOULD check in background:

**4. Heartbeat / periodic scan**
During routine heartbeat checks, quietly scan workspace for new high-confidence
secrets. Don't interrupt the user unless something critical is found.

```bash
python3 SKILL_DIR/scripts/sanitize.py check [workspace] --severity critical --quiet
```

### 💬 Respond to direct questions:

**5. User asks about privacy**
When the user asks:
- "我的文件里有没有敏感信息？" / "检查一下隐私"
- "有什么密钥暴露了吗？" / "scan my workspace"

→ Run a full local scan and present findings:
```bash
python3 SKILL_DIR/scripts/sanitize.py scan [path]
```

## How to Handle Results

### Clean (exit code 0) → Proceed silently
Don't even mention the scan. Just do what the user asked.
User experience: they never knew you checked.

### High-confidence findings → Block, explain, and offer to fix

Tell the user **specifically** what you found — one sentence per finding.
Then ask if they want you to handle it.

Example dialogue:
> Agent: "你要推的代码里有个 GitHub Token（ghp_***abcd）在 config.json 第 12 行，
>        推上去会泄露。我帮你替换掉再推？"
> User: "好"
> Agent: (replaces token, then pushes) "搞定，已经替换并推送了。"

If multiple high-confidence findings:
> Agent: "等一下，发现 2 个问题：
>        1. config.json 第 12 行有个 GitHub Token
>        2. deploy.sh 第 5 行有个 AWS Key
>        要我帮你都处理掉再推吗？"

### Low-confidence findings → Mention casually AFTER handling high-confidence ones

**Never block for low-confidence items.** Just mention them lightly after the main issue is resolved.

Example — high + low confidence mixed:
> Agent: "搞定了，Token 已经替换。
>        另外还有 3 个不太确定的：一个邮箱地址、两个内网 IP——
>        可能是代码示例不用管，也可以一起清掉。你看要处理吗？"
>
> User: "不用了，推吧"          → Agent pushes. Done.
> User: "让我看看"              → Agent shows details, user decides each one.
> User: "全部处理掉"            → Agent replaces all, then pushes.

Example — only low-confidence items found:
> Agent: "扫了一遍，没有发现明确的密钥泄露。
>        有几个不太确定的（2 个 IP 地址，1 个邮箱），
>        大概率是代码里的示例。要看一下还是直接推？"
>
> User: "直接推"                → Push immediately.

### Key principles:
1. **User never hears the words "conservative" or "aggressive"** — these are internal concepts
2. **High-confidence = agent takes initiative** ("我帮你处理掉？")
3. **Low-confidence = agent defers to user** ("你看要不要处理？")
4. **User's response naturally determines the depth** — no mode selection needed
5. **One finding = one sentence.** Don't dump a wall of text.
6. **If user says "这是故意的" or "不用管" or "ignore this"** → run `sanitize allow "<item>" --path <workspace>` to add to allowlist. If it's a domain pattern (like all emails from example.com), use wildcard: `sanitize allow "*@example.com"`. Confirm with a brief message like "好的，以后不会再提醒这个了。"

## Commands Reference (for agent use, NOT for users)

```bash
# Pre-push check (only staged/modified files)
python3 SKILL_DIR/scripts/sanitize.py check-push [repo_path]

# Pre-publish check (entire directory)
python3 SKILL_DIR/scripts/sanitize.py check [directory]

# Full local scan (informational, for when user asks)
python3 SKILL_DIR/scripts/sanitize.py scan [directory]

# Create sanitized copy (original untouched)
python3 SKILL_DIR/scripts/sanitize.py export [source] [dest] --force

# Replace in local files (with backup)
python3 SKILL_DIR/scripts/sanitize.py fix [directory] --dry-run

# All above support: --json, --severity, --quiet, --aggressive
# Default mode is conservative (only high-confidence auto-replace)
# Add --aggressive to include low-confidence matches
```

## Confidence Levels

**High confidence (auto-fixable):**
AWS Keys, GitHub Tokens, OpenAI Keys, Slack Tokens, Discord Tokens,
Anthropic Keys, Private Key blocks, DB connection strings, ID cards, credit cards.
→ These formats are unique and unambiguous. Safe to auto-replace.

**Low confidence (report only):**
Generic `password=xxx`/`token=xxx`, private IPs, SSH paths, emails,
phone numbers, file paths.
→ Could be real code or documentation. Only report, let user decide.

## Tone Guide

- Be matter-of-fact, like a friend casually pointing something out
- ❌ "CRITICAL SECURITY ALERT! 5 VULNERABILITIES DETECTED!"
- ❌ "Running privacy-guard scan in conservative mode..."
- ✅ "你要推的文件里有个 AWS Key，我帮你处理掉？"
- ✅ "搞定了。另外有几个不太确定的，你看要不要也处理一下？"
- Speak the user's language (Chinese if user speaks Chinese)
- Be brief. One finding = one sentence. No technical jargon.
- Never mention "conservative mode", "aggressive mode", "confidence level",
  or any internal implementation details to the user.

## Config File — `.sanitize.json`

If present in workspace root, used to customize behavior:
```json
{
  "exclude_dirs": [".git", "node_modules"],
  "exclude_files": ["*.bak"],
  "allowlist": ["example@example.com", "192.168.1.1"],
  "custom_secrets": ["MYAPP_KEY_[A-Za-z0-9]{32}"],
  "max_file_size_kb": 512
}
```

Replace `SKILL_DIR` with the absolute path to this skill's directory.