View Skill for Claude
Build a self-contained interactive HTML that lets you SEE de-identification and restoration — original ↔ redacted ↔ rehydrated, with color-coded PII spans and All/None/Selected toggles. Use when the user says "show me what was redacted", "visualize the de-id", "compare original and redacted", "highlight the PII", "view redaction diff", "see what rehydrate restored", or wants to inspect exactly which spans each type/layer removes. LOCAL only — the HTML embeds REAL values (like a vault artifact): written locally, gitignored, banner-marked private, never shipped or committed.
Install
one command, takes just this skill from the repositorynpx skills add https://github.com/glebis/claude-skills --skill viewWhat comes with it
15 062 bytes besides the instructionThe instruction itself
6 sections, as written by the authorconfide:view — visual de-id diff (what redaction & rehydrate do)
Produce ONE standalone .html that renders a transcript with every PII span
highlighted and color-coded by type, and lets you toggle between the original and
the redacted views interactively. It reuses the span data from the shared core
(shared/confide_core.py) — a thin renderer, no new detection logic.
Privacy invariants (do not violate)
- The HTML embeds REAL values (originals + placeholders) so you can compare them.
It is therefore a vault artifact: same posture as the relationship-graph HTML.
- Local only. Written next to the input, a sibling
.gitignoreexcludes
*.view.html (and *.map.json), and a red PRIVATE banner sits at the top.
Never share it, never commit it, never ship it.
- Counts only to stdout. The terminal output carries span counts by type — never
PII values or redacted-text dumps.
- Self-contained & offline. Inline CSS + JS, no CDN / external resources, so it
renders offline and can never 404. Default detection layer is regex (no network,
no models).
Run it
python3 skills/view/scripts/view.py ORIGINAL.txt
If a <name>.map.json sits next to the input (from confide:anon), it is picked up
automatically so the view shows exactly that known PII; otherwise PII is detected with
the local layers and a fresh reversible map is built in memory.
Options:
--map MAP.json— supply the reversible map explicitly.--layers regex,natasha,llm— choose detection layers (defaultregex, offline-safe).--out DIR— write the.view.htmlinto DIR instead of next to the input.
It writes <name>.view.html and ensures a sibling .gitignore.
What the HTML shows
- The transcript with each PII span wrapped in
<mark class="pii TYPE" data-orig=… data-ph=…>, colored by type (PERSON, DATE,
EMAIL, …). Hover a span to see original ↔ placeholder.
- An interactive state toggle:
- All — fully redacted: every span shows its placeholder.
- None — original: nothing masked.
- Selected — mask only the PII types you check (per-type checkboxes in the legend).
- A legend + counts by type.
After running
- Open the
<name>.view.htmllocally in a browser to inspect the de-id. - Report the counts summary (types) — never paste PII.
- Remind the user the file is private/local and must not be shared or committed.
Setup
The default regex layer always works offline. For Natasha (RU NER) or the local LLM
layer, run confide:setup first; otherwise pass --layers regex.
Other skills for the same job
different authors, same section of the catalogue
Expert in secure backend coding practices specializing in input validation, authentication, and API security. Use PROACTIVELY for backend security implementations or security code reviews.
Expert in secure mobile coding practices specializing in input validation, WebView security, and mobile-specific security patterns. Use PROACTIVELY for mobile security implementations or mobile security code reviews.
Expert in secure frontend coding practices specializing in XSS prevention, output sanitization, and client-side security patterns. Use PROACTIVELY for frontend security implementations or client-side security code reviews.
Security hardening reviewer for GitHub Actions workflow files (.github/workflows/*.yml). Reasons about the Actions threat model that pattern matchers and general code linters miss — untrusted-input script injection, privileged triggers running fork code, mutable action references, and over-scoped tokens. Use this skill when asked to review, audit, harden, or secure a GitHub Actions workflow, when writing a new workflow, or for any request like "is this workflow safe?", "review my CI for security issues", "why is pull_request_target dangerous here?", "pin my actions", or "lock down GITHUB_TOKEN permissions". Covers script injection via ${{ }} interpolation, pull_request_target / workflow_run privilege escalation, SHA-pinning of third-party actions, least-privilege permissions, GITHUB_ENV/GITHUB_OUTPUT injection, secret exposure, OIDC over long-lived credentials, and self-hosted runner exposure on public repositories.
Review a PR, or a PR linked to an issue, for security risks. Check nine categories and report PASS, WARNING, or FAIL. Use when reviewing code for vulnerabilities, secrets, injection, authorization bypasses, or unsafe configuration. Trigger keywords - security review, code review, appsec, vulnerability assessment, security audit, review PR security.
>- Run Semgrep static analysis scan on a codebase using parallel subagents. Supports two scan modes — "run all" (full ruleset coverage) and "important only" (high-confidence security vulnerabilities). Automatically detects and uses Semgrep Pro for cross-file taint analysis when available. Use when asked to scan code for vulnerabilities, run a security audit with Semgrep, find bugs, or perform static analysis. Spawns parallel workers for multi-language codebases.
Expands one confirmed or suspected vulnerability into a Trailmark graph neighborhood of variant candidates by finding sibling functions, shared callers and callees, common sensitive sinks, common entrypoint paths, interface implementations, override relationships, type/reference neighbors, and structurally similar nodes. Use after one issue is found to seed variant-analysis, semgrep-rule-creator, static-analysis, or manual review with graph-derived candidate locations.
Apply modern web development best practices for security, compatibility, and code quality. Use when asked to "apply best practices", "security audit", "modernize code", "code quality review", or "check for vulnerabilities". Do NOT use for accessibility (use web-accessibility), SEO (use seo), performance (use core-web-vitals), or comprehensive multi-area audits (use web-quality-audit).
How to use it
Take glebis/view from the repository into ~/.claude/skills for personal
use, or into .claude/skills inside a project.
The agent identifies a skill by the name field in its header. Two skills with the
same name cannot sit side by side — one of them will be ignored.