Redact Connection String

database.connection_string_redact

ProductionBounded custom (Class B)Deterministicstrictinstantv1.0.0

No network

Overview

You send a URI, JDBC, ODBC or ADO.NET connection string. Passwords in user-info and password-shaped keys are replaced in place with ***. AUTO reports ambiguity when two dialect redactions disagree. Parsed secret values are never returned. A successful call costs 1 execution credit.

Support logs need a connection string without the password that was in it.

Reliability

CONNSTRING_REDACT_LIMIT_EXCEEDED is reserved for dialect-specific overflow after a well-sized string. An oversize connectionString is refused as input validation, not a typed limit.

Context footprint

Secrets are replaced in place and never returned. A successful call costs 1 execution credit.

When to use it

When a caller already holds a connection string that may contain credentials.

When a live database connection or parsed secret recovery is required.

Scope

Note

Redacts credentials in place from URI, JDBC, ODBC and ADO.NET connection strings.

Non-goals

Does not open a connection
Does not return parsed secret values
Does not encrypt the remaining string

Properties

IdempotentRetry safeStreaming supportedFile input supportedRequires external service

Capabilities

parsingvalidation

Cost & billing

Flat rate per invocation

MetercallsBillable onsuccessCost per call1 credit

File handling

Accepts file_refProduces file_refMax input64 KB

How we handle your data

Sensitive input, safe output

What this means

This skill may receive sensitive content, but it does not target sensitive data and returns only a structured non-sensitive result.

Squillify guarantees

Runs inside Squillify
This skill runs inside Squillify.
Payloads are not sent to an external service by this skill.
Squillify does not permanently store submitted payloads.
Telemetry records metadata only, not submitted content.
Submitted payloads are not used for training.
Submitted payloads are not reviewed by humans.
This skill does not target sensitive data.
The response does not contain submitted content.

Your responsibility

Squillify does not determine whether submitted content is sensitive. Your application is responsible for deciding what data it is allowed to submit. Your application is responsible for securing the response.

Read the Microskill Data Handling Policy

Input schema

Field	Type	Required	Description
connectionString	string	Yes	Connection string, 1 through 65537 characters; runtime accepts at most 65536.
dialect	string	No	AUTO, URI, JDBC, ODBC or ADO_NET; omit it for AUTO.
replacement	string	No	Replacement token; only * is published. Omit it for *.

Output schema

Field	Type	Required	Description
redacted	string	Yes	The input with credential spans replaced. Never contains the original secret.
detectedDialect	string	Yes	Dialect that produced the redaction, or AUTO when none matched or results disagreed.
redactedFields	array	Yes	Stable names of credential fields that were masked, such as password or userInfo.
ambiguous	boolean	Yes	True when AUTO found two dialect redactions that disagreed materially.

API contract

POST /v1/execute

curl

curl -sS -X POST "$BASE/v1/execute" -H "Authorization: Bearer $KEY" -H 'Content-Type: application/json' -d '{"skillKey":"database.connection_string_redact","input":{"connectionString":"postgres://app:[email protected]:5432/app"}}'

Integrations

TypeScript SDK

import { Squillify } from "@squillify/sdk";

const sq = new Squillify({ apiKey: process.env.SQUILLIFY_API_KEY });

const { output } = await sq.execute("database.connection_string_redact", {"connectionString":"postgres://app:[email protected]:5432/app"});

Errors

Code	HTTP	Retryable	Description
VALIDATION_ERROR	400	No	The request payload failed schema validation.
UNAUTHORIZED	401	No	Missing or invalid API key.
SKILL_NOT_ACCESSIBLE	403	No	The API key is not granted access to this skill.
SKILL_NOT_AVAILABLE_FOR_PLAN	403	No	This skill is not included in your current plan.
PLAN_ELIGIBILITY_UNAVAILABLE	503	Yes	Plan eligibility could not be decided. Retry after backoff.
SKILL_NOT_FOUND	404	No	The requested skill or version does not exist.
TENANT_RATE_LIMITED	429	Yes	Request rate limit exceeded. Retry after backoff.
QUOTA_EXCEEDED	429	Yes	Plan quota exhausted. Retryable once the quota period resets.
EXECUTION_TIMEOUT	504	Yes	Execution exceeded the allowed time budget.
CONNSTRING_REDACT_LIMIT_EXCEEDED	429	No	A size, quota, rate, or time limit was exceeded.

Other limits

Limit	Value
Recommended inline bytes	32 KiB

Limitations

Does not open a connection
Does not return parsed secret values
Does not encrypt the remaining string
Live connectivity checks
Secret storage

How to call

POST /v1/execute (requires authentication)

Request bodyjson

{
  "skillKey": "database.connection_string_redact",
  "input": {
    "connectionString": "postgres://app:[email protected]:5432/app"
  }
}

Examples

A postgres URI user-info password is replaced

Inputjson

{
  "connectionString": "postgres://app:[email protected]:5432/app"
}

Expected outputjson

{
  "detectedDialect": "URI",
  "ambiguous": false,
  "redacted": "postgres://app:***@db.example.com:5432/app",
  "redactedFields": [
    "userInfo"
  ]
}

Tip

user-info credentials become *** and are listed as userInfo.

A JDBC query password is replaced