agentic-security:privacy-data-flow

Classify PII/PHI/PCI data flows and write DATA_FLOW.md artifacts.

73|15|Updated May 6, 2026

Search Tags:#compliance #privacy #pii #data-flow #phi #pci

Ready to run

npx skills add https://github.com/Clear-Capabilities/agentic-security --skill agentic-security-privacy-data-flow

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: agentic-security:privacy-data-flow
Source: https://github.com/Clear-Capabilities/agentic-security/tree/main/skills/privacy-data-flow
Command: npx skills add https://github.com/Clear-Capabilities/agentic-security --skill agentic-security-privacy-data-flow

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Privacy review before handling user data. Activate on PII/PHI/PCI shapes (email, SSN, CC, MRN). Writes DATA_FLOW.md.

Core Features & Use Cases

Pause before data-handling edits to surface privacy risks early.
Classify touched data (PII/PHI/PCI) and map destinations (storage, transit, logs, backups).
Use during code reviews, PRs, and architecture changes affecting data flows.

Quick Start

Run a privacy data-flow review before editing code that processes user data.

Frequently Asked Questions about agentic-security:privacy-data-flow

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I identify privacy risks in code paths that process PII and PHI?▼

To identify privacy risks in PII and PHI code paths, you need to map data-flow destinations across storage, transit, and logs. This Skill classifies touched data and generates a DATA_FLOW.md artifact to surface privacy review risks early.

When do I need to perform a privacy data-flow review for PCI data?▼

A privacy data-flow review for PCI data is needed during code reviews, PRs, and architecture changes affecting data flows. It pre-validates data handling across backups and retention policies before edits are applied.

How do I map data classification and flow for jurisdiction considerations?▼

Map data classification and flow for jurisdiction considerations by classifying how user data moves through code paths that read, store, or transmit PII/PHI/PCI. This produces concrete guidance encoded in a DATA_FLOW.md artifact.

Does this privacy review approach work for third-party processor changes?▼

Yes, privacy review works for third-party processor changes by analyzing how user data transits to external services. It maps these data-flow destinations to satisfy privacy review criteria and surface compliance risks.

What is the best way to pre-validate privacy before handling user data?▼

The best way to pre-validate privacy before handling user data is to pause before data-handling edits to classify touched data and map destinations. This generates a DATA_FLOW.md artifact capturing retention and flow risks.