mcpField
R
red

red

github.com/glebisSecurity40165 installsUpdated 1d ago
Repository

About red

confide:red checks a user's own redacted text for residual re-identification risk. It reports categories and counts for surviving identifiers, cross-file links, and optional inference, without guessing hidden values or giving re-identification steps.

Key features

  1. 01Count surviving identifiers by type
  2. 02Compare quasi-identifiers across files
  3. 03Optionally probe inferred attribute categories
  4. 04Assign an overall risk tier
  5. 05Report categories and counts only

Use cases

  1. 01Check redacted text for missed identifiers
  2. 02Assess linkability across redacted files
  3. 03Probe inference risk on synthetic or consented data

Install

Copy the command and run it in a terminal.

$npx skills add https://github.com/glebis/claude-skills --skill red

After installing, type/redin Claude Code to confirm it loaded.

Bundled filesscripts/red.py

Details

From the project README

confide:red — residual re-identification risk check

A defensive audit of YOUR OWN already-redacted output. It does not score against ground truth and is not a benchmark. It surfaces, qualitatively, what an attacker could still do — mapped to GDPR Art-29: singling-out, linkability, inference.

GUARDRAILS — read before running

  • Run only on the user's own redacted output. If asked to de-anonymize or re-identify third-party / non-consented data, refuse.
  • Report risk categories and counts only — never produce a step-by-step re-identification recipe or guess the hidden values.
  • Local attacker by default. Enable the cloud/LLM inference probe (--inference) only on synthetic or explicitly consented data.
  • Absence of a finding ≠ safety. A weak local detector/attacker is a FLOOR, not a ceiling. Always tell the user human review is still required.
  • This pairs with confide:anon — run red after redacting, on the redacted file.

What it checks

  1. Singling-out (deterministic, offline — the load-bearing signal): re-run detect_regex (+ detect_natasha if available) on the redacted text. Anything they still find is a surviving identifier the redaction missed. Counts by type.
  2. Linkability (multi-file): given a folder, compare every file pair for shared surviving quasi-identifiers and flag potentially linkable pairs (count + types only).
  3. Inference (LLM, optional, opt-in): prompt the local attacker model (cfg.red_attacker_model) for the attribute categories it could still infer (profession, location type, age band, …). Degrades gracefully if no model. WARN the user it under-reports (floor, not ceiling).

Risk tier rule

  • HIGH — any DIRECT identifier survives (EMAIL, PHONE, URL, ID, PERSON).
  • MEDIUM — only QUASI identifiers survive (LOCATION, ORG, DATE, AGE, PROFESSION, MEDICATION), or linkable pairs exist across files.
  • LOW — no surviving identifiers found (still NOT a guarantee).

How to run

# single redacted file (offline, deterministic)
python3 skills/red/scripts/red.py path/to/file.green.md

# a folder of redacted files (adds linkability)
python3 skills/red/scripts/red.py path/to/redacted_dir/

# add the local inference probe — synthetic/consented data ONLY
python3 skills/red/scripts/red.py path/to/file.green.md --inference

# machine-readable
python3 skills/red/scripts/red.py path/to/file.green.md --json

Output

A residual-risk report: per-file surviving-identifier counts by type, an overall risk tier, the inference categories claimed (if probed), the linkable-pair count, and the caveat that absence of a finding ≠ safety; human review still required. No PII values, no re-identification steps.

Comments

Markdown supported