testland/k-anonymity-verifier
Verifies that a masked dataset satisfies k-anonymity, l-diversity, and t-closeness by computing equivalence classes over chosen quasi-identifiers and reporting re-identification risk. Covers quasi-identifier selection heuristics, threshold guidance, pycanon API (k_anonymity / l_diversity / t_closeness / report), ARX Java API and GUI workflow, SmartNoise for differential-privacy comparison, and CI-gate integration. Distinct from pii-masking-pipeline-builder's masking-techniques catalog (which lists masking operators but defers k-anonymity measurement to dedicated tooling) and from presidio-pii-detection (which detects PII spans but offers no equivalence-class analysis). Use when you need to confirm whether a masked dataset meets a stated k, l, or t threshold before promoting it to a non-production environment.
73
92%
Does it follow best practices?
Run evals on this skill
Adds up to 20 points to the overall score
View guide
Low
Low-risk findings worth noting
Low
Low-risk findings.
1 low severity finding. Worth noting, but not necessarily harmful.
W011: Third-party content exposure detected (indirect prompt injection risk).
What this means
The skill exposes the agent to untrusted, user-generated content from public third-party sources, creating a risk of indirect prompt injection. This includes browsing arbitrary URLs, reading social media posts or forum comments, and analyzing content from unknown websites.
Why it was flagged
[SKILL.md + references/ci-gate.md] the required runtime workflow reads `masked_dataset.csv` via `pd.read_csv(sys.argv[1])` in `scripts/k_anonymity_gate.py`, so outsider-authored text can be ingested if an attacker can submit a poisoned CSV through a PR/CI gate input.
Where we found it
masked_dataset.csv (attacker-controlled CSV via pull_request trigger)
content-type · 4 sites
The CI gate script reads a CSV file via pd.read_csv(sys.argv[1]) and the GitHub Actions workflow triggers on pull_request, meaning an external contributor can submit a PR containing a poisoned masked_dataset.csv whose cell values (column names, data) flow into pycanon processing and printed output, creating an indirect prompt-injection vector if an AI agent consumes the CI output.
references/ci-gate.md
14
data = pd.read_csv(sys.argv[1])
47
on: pull_request
57
- run: python scripts/k_anonymity_gate.py masked_dataset.csv
SKILL.md
101
data = pd.read_csv("masked_dataset.csv")
- Audited
- Security analysis