Improve discoverability: sync versions, expand keywords, boost SkillsMP score to A+

- Sync pyproject.toml and __init__.py to v0.3.3
- Expand PyPI keywords from 5 to 19 terms
- Add PyPI classifiers (Image Recognition, Console)
- Enhance root SKILL.md: add vector-search synonyms (anonymize, GDPR, DLP),
  numbered steps, conditional logic, constraints, anti-patterns section
- Sync skills/privacy-mask/SKILL.md: add permissions, openclaw metadata,
  richer description, constraints section
- Add references/ directory for supporting documentation
- Declare hooks in SKILL.md metadata (auto-added by linter)
- SkillsMP quality score: C (62/100) → A+ (90/100)

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: haowu77

.clawhubignore

@@ -1,4 +1,5 @@
 # Only publish SKILL.md + essential docs, exclude everything else
+.claude/
 hooks/
 scripts/
 tests/

SKILL.md

@@ -1,12 +1,13 @@
 ---
 name: privacy-mask
 description: >-
-  Mask and redact sensitive information (PII) in screenshots and images —
-  phone numbers, emails, IDs, API keys, crypto wallets, credit cards,
-  passwords, and more. Uses OCR (Tesseract + RapidOCR) with 47 regex rules
-  and optional NER (GLiNER) to detect private data and applies blur/fill
-  redaction overlays. All processing runs locally and offline — no data
-  leaves your machine.
+  Mask, redact, anonymize and censor sensitive information (PII) in
+  screenshots and images — phone numbers, emails, IDs, API keys, crypto
+  wallets, credit cards, passwords, and more. Uses OCR (Tesseract +
+  RapidOCR) with 47 regex rules and optional NER (GLiNER) to detect private
+  data and applies blur/fill redaction overlays. Supports GDPR and
+  compliance workflows, secret detection, and data loss prevention (DLP).
+  All processing runs 100% locally and offline — no data leaves your machine.
 version: 0.3.3
 license: MIT
 compatibility: Requires tesseract OCR, Python 3.10+, and pre-installed privacy-mask CLI.
@@ -33,6 +34,15 @@ metadata:
         as input, with _masked suffix, or user-specified path).
       scope: local
       optional: false
+  hooks:
+    - event: UserPromptSubmit
+      description: >-
+        Intercepts images in Claude's local image cache and applies
+        privacy masking (blur/fill redaction) in-place before they are
+        sent to the API. Runs entirely locally with no network calls.
+        Requires the privacy-mask CLI to be installed.
+      command: scripts/mask-images.sh
+      timeout: 30000
 ---
 
 # Privacy Mask
@@ -42,22 +52,30 @@ Detect and mask sensitive information in images locally before they leave your m
 ## Prerequisites
 
 This skill requires the `privacy-mask` CLI to be pre-installed on the system.
-If it is not available, inform the user that they need to install it first.
+If it is not available, inform the user that they need to install it first:
+
+1. Install via pip: `pip install privacy-mask`
+2. Ensure Tesseract OCR is installed: `brew install tesseract` (macOS) or `apt install tesseract-ocr` (Linux)
+3. Verify installation: `privacy-mask --version`
+4. (Optional) Install NER support: `pip install privacy-mask[ner]`
 
 ## When to use
 
-- User sends a screenshot that may contain private data
-- User mentions privacy, masking, or redacting
+- User sends a screenshot or image file (`.png`, `.jpg`, `.jpeg`, `.bmp`, `.tiff`) that may contain private data
+- User mentions privacy, masking, redacting, or anonymizing
 - You need to analyze an image but want to redact sensitive info first
+- IF the user shares a screenshot for debugging, THEN run `privacy-mask mask <path> --dry-run` first to check for PII
+- IF detections are found, THEN mask the image before proceeding with analysis
 
 ## Usage
 
 Mask an image:
 ```bash
-privacy-mask mask <image_path>
-privacy-mask mask <image_path> --in-place
-privacy-mask mask <image_path> --dry-run   # detect only
-privacy-mask mask <image_path> --detection-engine regex  # use regex instead of NER
+privacy-mask mask /path/to/screenshot.png
+privacy-mask mask /path/to/screenshot.png --in-place
+privacy-mask mask /path/to/screenshot.png --dry-run   # detect only, no masking
+privacy-mask mask /path/to/screenshot.png --detection-engine regex  # regex only, skip NER
+privacy-mask mask /path/to/screenshot.png --config /path/to/custom-config.json
 ```
 
 Output is JSON:
@@ -69,6 +87,14 @@ Output is JSON:
 }
 ```
 
+### Example workflow
+
+1. User provides a screenshot: `~/Desktop/error-screenshot.png`
+2. Run detection: `privacy-mask mask ~/Desktop/error-screenshot.png --dry-run`
+3. IF detections found, mask the image: `privacy-mask mask ~/Desktop/error-screenshot.png`
+4. The masked output is saved as `~/Desktop/error-screenshot_masked.png`
+5. Use the masked image for further analysis
+
 ## What it detects
 
 - **IDs**: Chinese ID card, passport, HK/TW ID, US SSN, UK NINO, Canadian SIN, Indian Aadhaar/PAN, Korean RRN, Singapore NRIC, Malaysian IC
@@ -79,6 +105,20 @@ Output is JSON:
 - **Other**: Email, birthday, IP/IPv6, MAC, UUID, license plate, MRZ, URL auth tokens
 - **NER** (optional): Person names, street addresses, organizations, dates of birth, medical conditions
 
+## Constraints
+
+- Do NOT send unmasked images to any external API or cloud service
+- Do NOT skip masking when detections are found — always mask before sharing
+- Do NOT modify the original image unless `--in-place` is explicitly requested
+- Avoid running on very large images (>10MB) without warning the user about processing time
+
+## Anti-patterns
+
+- **Don't assume images are safe** — always run detection even if the image "looks clean"
+- **Don't use `--in-place` by default** — preserve the original unless the user asks otherwise
+- **Don't ignore dry-run results** — if `--dry-run` finds PII, the image must be masked before use
+- **Don't hardcode config paths** — use the bundled default or let the user specify `--config`
+
 ## Important
 
 - All processing is **local and offline** — no data leaves the machine

mask_engine/__init__.py

@@ -1,6 +1,6 @@
 """Local Image Privacy Mask Engine."""
 
-__version__ = "0.3.2"
+__version__ = "0.3.3"
 
 from .ocr import OcrResult, run_ocr
 from .detector import Detection, detect_sensitive

pyproject.toml

@@ -4,22 +4,29 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "privacy-mask"
-version = "0.3.2"
+version = "0.3.3"
 description = "Local image privacy masking — detect and redact sensitive info (IDs, phones, keys, etc.) before images leave your machine."
 readme = "README.md"
 license = {text = "MIT"}
 requires-python = ">=3.10"
 authors = [
     {name = "wuhao"},
 ]
-keywords = ["privacy", "masking", "ocr", "sensitive-data", "claude-code"]
+keywords = [
+    "privacy", "masking", "ocr", "sensitive-data", "claude-code",
+    "pii", "redaction", "image-privacy", "screenshot", "data-protection",
+    "tesseract", "ner", "gliner", "anonymize", "secret-detection",
+    "api-key-detection", "gdpr", "compliance", "agent-skill",
+]
 classifiers = [
     "Development Status :: 4 - Beta",
     "Intended Audience :: Developers",
     "License :: OSI Approved :: MIT License",
     "Programming Language :: Python :: 3",
     "Topic :: Security",
     "Topic :: Multimedia :: Graphics",
+    "Topic :: Scientific/Engineering :: Image Recognition",
+    "Environment :: Console",
 ]
 dependencies = [
     "Pillow>=10.0.0",

references/README.md

@@ -0,0 +1,7 @@
+# References
+
+- [Agent Skills Specification](https://agentskills.io) — SKILL.md format standard
+- [Tesseract OCR](https://github.com/tesseract-ocr/tesseract) — Primary OCR engine
+- [RapidOCR](https://github.com/RapidAI/RapidOCR) — Alternative OCR engine (ONNX-based)
+- [GLiNER](https://github.com/urchade/GLiNER) — Named Entity Recognition model for PII detection
+- [OWASP Data Protection](https://owasp.org/www-project-data-security/) — PII classification reference

skills/privacy-mask/SKILL.md

@@ -1,11 +1,46 @@
 ---
 name: privacy-mask
-description: Mask sensitive information (phone numbers, emails, IDs, API keys, crypto wallets, etc.) in screenshots before analysis. Use when receiving screenshots that may contain private data, or when the user mentions privacy/masking/脱敏/打码.
+description: >-
+  Mask, redact and anonymize sensitive information (PII) in screenshots and
+  images — phone numbers, emails, IDs, API keys, crypto wallets, credit cards,
+  passwords, and more. 100% local, 100% offline. Uses OCR with 47 regex rules
+  and optional NER. Use when receiving screenshots that may contain private data,
+  or when the user mentions privacy/masking/脱敏/打码.
 version: 0.3.3
 license: MIT
 compatibility: Requires tesseract OCR, Python 3.10+, and pre-installed privacy-mask CLI.
 metadata:
   author: wuhao
+  openclaw:
+    requires:
+      bins:
+        - tesseract
+        - python3
+        - privacy-mask
+    emoji: "\U0001F6E1"
+    homepage: https://github.com/fullstackcrew-alpha/privacy-mask
+  permissions:
+    - id: local-file-read
+      description: >-
+        Reads image files provided by the user to perform OCR-based
+        sensitive information detection. No files are copied or transmitted.
+      scope: local
+      optional: false
+    - id: local-file-write
+      description: >-
+        Writes masked output images to the local filesystem (same directory
+        as input, with _masked suffix, or user-specified path).
+      scope: local
+      optional: false
+  hooks:
+    - event: UserPromptSubmit
+      description: >-
+        Intercepts images in Claude's local image cache and applies
+        privacy masking (blur/fill redaction) in-place before they are
+        sent to the API. Runs entirely locally with no network calls.
+        Requires the privacy-mask CLI to be installed.
+      command: scripts/mask-images.sh
+      timeout: 30000
 ---
 
 # Privacy Mask
@@ -15,31 +50,30 @@ Detect and mask sensitive information in images locally before they leave your m
 ## Prerequisites
 
 This skill requires the `privacy-mask` CLI to be pre-installed on the system.
-If it is not available, inform the user that they need to install it first.
+If it is not available, inform the user that they need to install it first:
+
+1. Install via pip: `pip install privacy-mask`
+2. Ensure Tesseract OCR is installed: `brew install tesseract` (macOS) or `apt install tesseract-ocr` (Linux)
+3. Set up the Claude Code hook: `privacy-mask install`
+4. Verify: `privacy-mask --version`
+
+After install, all images are automatically masked before upload. No further action needed.
 
 ## When to use
 
-- User sends a screenshot that may contain private data
+- User sends a screenshot or image file (`.png`, `.jpg`, `.jpeg`, `.bmp`, `.tiff`) that may contain private data
 - User mentions privacy, masking, 脱敏, or 打码
 - You need to analyze an image but want to redact sensitive info first
-
-## Quick start
-
-```bash
-pip install privacy-mask
-privacy-mask install   # one-time: sets up global Claude Code hook
-```
-
-After install, all images are automatically masked before upload. No further action needed.
+- IF the user shares a screenshot for debugging, THEN run `privacy-mask mask <path> --dry-run` first to check for PII
 
 ## Manual usage
 
 Mask an image:
 ```bash
-privacy-mask mask <image_path>
-privacy-mask mask <image_path> --in-place
-privacy-mask mask <image_path> --dry-run   # detect only
-privacy-mask mask <image_path> --detection-engine regex  # use regex instead of NER
+privacy-mask mask /path/to/screenshot.png
+privacy-mask mask /path/to/screenshot.png --in-place
+privacy-mask mask /path/to/screenshot.png --dry-run   # detect only
+privacy-mask mask /path/to/screenshot.png --detection-engine regex  # regex only, skip NER
 ```
 
 Output is JSON:
@@ -61,6 +95,12 @@ Output is JSON:
 - **Other**: Email, birthday, IP/IPv6, MAC, UUID, license plate, MRZ, URL auth tokens
 - **NER** (optional): Person names, street addresses, organizations, dates of birth, medical conditions
 
+## Constraints
+
+- Do NOT send unmasked images to any external API or cloud service
+- Do NOT skip masking when detections are found
+- Do NOT modify the original image unless `--in-place` is explicitly requested
+
 ## Important
 
 - All processing is **local and offline** — no data leaves the machine