agents/21-pii-sanitization-agent sends raw text to a third-party API (api.trustboost.dev) — does not sanitize locally

agents/21-pii-sanitization-agent (added in #115) is described as redacting PII "before it reaches an LLM", but the implementation does not redact anything locally. It sends the caller's raw, un-redacted text to a third-party service:

API_BASE = os.environ.get("TRUSTBOOST_API_BASE", "https://api.trustboost.dev")
ENDPOINT = f"{API_BASE}/sanitize"
...
payload = {..., "wallet_address": os.environ.get("TRUSTBOOST_WALLET", "demo-agent"), ...}
resp = requests.post(ENDPOINT, json=payload, timeout=30)

So a user who runs this expecting a local privacy guard instead ships exactly the data they wanted to protect (plus a crypto wallet_address / tx_hash field) to an unrelated commercial API with no privacy policy or provenance in the repo. That is the opposite of what the README row promises, and it looks like a vendor promotion PR rather than a working example.

Suggested fix: either remove the entry, or replace it with an actually local implementation (regex / presidio-analyzer / spaCy NER) and clearly label any hosted-API variant as sending data off-machine.

Everything else I looked at in agents/ was clean — thanks for maintaining the list.