pii-safe-documents

# PII Safe Documents This skill creates a reversible, locally redacted working copy with a strict main-agent workflow boundary: - The **main agent is untrusted for raw data**. It receives paths and safe receipts only. - The bundled open-source local wrapper may read the original solely to run PII Guard and local Ollama. - No hook is required. Normal wrapper output suppresses raw content. This is strong protection against accidental model exposure, not an OS security boundary against a malicious process running as the same macOS user. A Skill cannot revoke its own filesystem tools. Hostile-agent isolation requires a separately permissioned local broker or OS account. Never describe this Skill alone as mathematically or technically impossible to bypass. ## Non-negotiable isolation rules When this skill is active, the main agent MUST NOT: 1. Read, preview, search, summarize, diff, upload, attach, or otherwise inspect the original file. 2. Use `cat`, `sed`, `head`, `tail`, `grep`, `rg`, `strings`, Python, a document reader, a browser, or any other tool on the original file. 3. Read or reveal `mapping.private.json`, private worker files, raw logs, or the restored output. 4. Pass the original path to a subagent, cloud model, MCP server, website, or third-party API. 5. Run PII Guard directly. Its libraries may echo source text in warnings; only the bundled wrapper may invoke it. 6. Debug a failure by opening the original, mapping, worker output, or restored document. 7. Run `g...