AgentSkillsCN

privacy-audit

验证隐私合规性，包括 PII 检测、本地优先验证，以及数据保留检查。

SKILL.md
--- frontmatter
name: privacy-audit
description: Privacy compliance verification including PII detection, local-first validation, and data retention checks.
compatibility: Requires grep/ast-grep for code analysis
metadata:
  invocation: both
  inputs: |
    - scope: string (optional, all|frontend|backend|database, default: all)
    - framework: string (optional, gdpr|ccpa|hipaa, default: gdpr)
  outputs: |
    - report: string (markdown privacy analysis)
    - pii_locations: array (files containing PII handling)

Privacy Audit

Privacy compliance and data protection verification.

Features

  • •PII Detection: Identify handling of personal data
  • •Local-First Validation: Verify data stays on device when expected
  • •Data Retention: Check for proper data lifecycle management
  • •Consent Tracking: Verify consent mechanisms
  • •Third-Party Data Sharing: Detect external data transmission

Checks Performed

1. PII Detection

Data TypePatternRisk Level
Email addressesemail, @, regex patternsMedium
Phone numbersphone, tel, digit patternsMedium
NamesfirstName, lastName, fullNameLow
Addressesaddress, street, cityMedium
SSN/ID numbersssn, national_id, digit patternsCritical
Financial datacreditCard, bankAccountCritical
Health datadiagnosis, prescriptionCritical

2. Local-First Compliance

CheckExpectedSeverity
PII stored locally onlyNo server transmissionHigh
Encryption at restLocal storage encryptedHigh
No cloud sync without consentExplicit opt-inCritical

3. Data Retention

CheckRequirement
Deletion mechanism existsUser can delete data
Retention period definedData not kept indefinitely
Automatic cleanupOld data purged

4. Third-Party Analysis

CheckDetection
Analytics scriptsGoogle Analytics, Mixpanel, etc.
Tracking pixelsFacebook, LinkedIn, etc.
CDN data exposureExternal resource loading
API data sharingPII in external API calls

Usage

bash
# Full privacy audit
./scripts/privacy-audit.sh

# Specific framework
./scripts/privacy-audit.sh --framework hipaa

# Backend only
./scripts/privacy-audit.sh --scope backend

Output Format

markdown
## Privacy Audit Report

**Framework:** GDPR
**Date:** 2025-01-20

### PII Inventory

| Data Type | Locations | Storage | Transmission |
|-----------|-----------|---------|--------------|
| Email | 5 files | Local + Server | ⚠️ API calls |
| Name | 3 files | Local + Server | API calls |
| Phone | 1 file | Local only | ✅ None |

### Local-First Compliance

| Feature | Status | Notes |
|---------|--------|-------|
| Offline functionality | ✅ | Works without network |
| Local encryption | ⚠️ | Missing for user prefs |
| Sync consent | ✅ | Explicit opt-in |

### Third-Party Services

| Service | Data Shared | Consent Required |
|---------|-------------|------------------|
| Google Analytics | Page views | ✅ Cookie consent |
| Stripe | Payment info | ✅ Transaction consent |
| Sentry | Error logs | ⚠️ May contain PII |

### Data Retention

| Data | Retention | Deletion | Status |
|------|-----------|----------|--------|
| User accounts | Indefinite | Manual | ⚠️ Add auto-purge |
| Session logs | 30 days | Automatic | ✅ |
| Analytics | 2 years | Automatic | ✅ |

### Recommendations

1. **CRITICAL**: Encrypt user preferences in localStorage
2. **HIGH**: Scrub PII from Sentry error logs
3. **MEDIUM**: Add account deletion automation after 2 years inactivity

Prerequisites

  • •grep or ast-grep for code analysis
  • •Understanding of applicable privacy framework

See Also