# sensitive-disclosure

> Claude/Codex skill by [@thejefflarson](https://omgskills.com/library/thejefflarson/index.md) · 20 stars · Updated 2026-07-31

Detects PII, credentials, and secrets passed to LLM APIs or embedded in system prompts. Use when writing code that passes sensitive data (PII, credentials, health data) to an LLM API, constructs system prompts containing secrets, returns LLM responses that could contain training data, or implements memory/context persistence.

Tags: llms, security, skills

## Install

```sh
git clone https://github.com/thejefflarson/soundcheck /tmp/soundcheck && ln -s /tmp/soundcheck/.claude/skills/sensitive-disclosure ~/.claude/skills/sensitive-disclosure
```

## From README

Sensitive Information Disclosure (OWASP LLM06:2025) What this checks Prevents confidential data from leaking through LLM inputs or outputs. LLMs may memorize, echo, or inference-time expose PII, credentials, and business secrets embedded in prompts — to current users, future users, or via model extraction. Vulnerable patterns Whole user or account records interpolated into a system or user prompt API keys, database passwords, or other credentials baked into prompt strings Returning raw LLM responses to callers without an output-redaction gate — the response can echo data injected via retrieval or memory Conversation history or vector-store writes that mix multiple users' content without partitioning by user identity Logging or telemetry that emits prompts and completions unredacted Fix immediately Flag the vulnerable code, explain the risk, and suggest a fix establishing these properties.

## Links

- HTML page: https://omgskills.com/library/thejefflarson/soundcheck/dot-claude/skills/sensitive-disclosure/
- GitHub: https://github.com/thejefflarson/soundcheck
- Author: [@thejefflarson](https://omgskills.com/library/thejefflarson/index.md)

## More from this repo

- [authentication-failures](https://omgskills.com/library/thejefflarson/soundcheck/dot-claude/skills/authentication-failures/index.md) — Detects weak password storage, flawed JWT validation, sessions surviving logout, and missing MFA in authentication code.
   - [@thejefflarson](https://omgskills.com/library/thejefflarson/index.md) · 20 stars
- [broken-access-control](https://omgskills.com/library/thejefflarson/soundcheck/dot-claude/skills/broken-access-control/index.md) — Detects missing ownership checks, broken role enforcement, and IDOR vulnerabilities that let users access other users'...
   - [@thejefflarson](https://omgskills.com/library/thejefflarson/index.md) · 20 stars
- [concurrency-correctness](https://omgskills.com/library/thejefflarson/soundcheck/dot-claude/skills/concurrency-correctness/index.md) — Detects multi-threaded code where a lock is held across a blocking operation, lock acquisition order risks deadlock,...
   - [@thejefflarson](https://omgskills.com/library/thejefflarson/index.md) · 20 stars