skills.rest
github
githubOFFICIAL
Explore all skills by this author →
WebsiteGitHub

data-breach-blast-radius

Analyzes codebases to inventory sensitive data, trace data flows, and estimate regulatory breach impact.

38.5k|4.9k|Updated Jun 11, 2025
Search Tags:#data breach#risk analysis#blast radius#gdpr#pII#Security audit#Compliance
One-click install
npx skills add https://github.com/github/awesome-copilot --skill data-breach-blast-radius
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: data-breach-blast-radius
Source: https://github.com/github/awesome-copilot/tree/main/skills/data-breach-blast-radius
Command: npx skills add https://github.com/github/awesome-copilot --skill data-breach-blast-radius

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

Most teams never ask how bad a breach would be until one happens. This Skill performs a proactive pre-breach impact analysis of a codebase: it inventories sensitive data (PII, PHI, PCI-DSS, credentials), traces how that data flows through the system, scores exposure vectors, and quantifies the regulatory and financial blast radius before an incident occurs.

Core Features & Use Cases

  • Sensitive Data Inventory: Scans models, schemas, DTOs, configs, and logs to classify every sensitive field into severity tiers based on GDPR Article 9, PCI-DSS v4.0, and HIPAA.
  • Blast Radius Scoring: Calculates a 0-100 score per exposure vector using tier weight, exposure likelihood, population scale, completeness, and context multipliers.
  • Regulatory Impact Estimation: Detects applicable jurisdictions (GDPR, CCPA, HIPAA, LGPD, PDPA) and computes fine ranges sourced verbatim from legal texts, plus breach notification timelines.
  • Hardening Roadmap: Produces a prioritized remediation plan sorted by impact-per-effort, with stack-specific code patterns for fixes like IDOR authorization checks and field-level encryption.
  • Use Case: Before a security review or DPIA, run the analysis on your repository to receive an executive summary, a Mermaid data flow diagram, a financial impact estimate, and a P0-P3 hardening roadmap.

Quick Start

Ask the AI to run a data breach blast radius analysis on this repository and report the top exposure vectors with estimated regulatory fines.

Frequently Asked Questions about data-breach-blast-radius

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I assess data breach impact before a breach happens?▼

Run a blast radius analysis that inventories sensitive data fields in your codebase, traces data flows from ingestion to transmission, and scores each exposure vector. The output includes estimated records at risk, applicable regulations, and financial impact ranges.

What regulations does a breach impact analysis cover?▼

The analysis detects jurisdiction signals for GDPR, CCPA/CPRA, HIPAA, LGPD, Singapore PDPA, and others based on currency, locale, cloud region, and field patterns in the code. Fine formulas are sourced verbatim from GDPR Article 83, CCPA Section 1798.155(a), and 45 CFR Section 160.404.

How is the blast radius score calculated?▼

The score multiplies data sensitivity tier weight, exposure likelihood, population scale, data completeness, and context multipliers such as health data or minors' data. Raw scores normalize to a 0-100 scale with Low, Medium, High, and Critical bands.

Does the breach analysis work with any programming language or framework?▼

Yes, it detects stacks via package.json, requirements.txt, go.mod, pom.xml, and similar files, then inspects ORM models, API contracts, and infrastructure-as-code. Reference patterns cover Django, Prisma, Spring, EF Core, Express, and others.

Are the regulatory fine estimates legally exact?▼

Fine maximums and notification timelines are transcribed verbatim from primary legal texts and cited in references/SOURCES.md. Blast radius scores and financial ranges are heuristic planning estimates, and the output explicitly labels which figures are law-sourced versus model-derived.

What are the limitations of a pre-breach blast radius analysis?▼

Population counts are estimated from codebase signals or conservative defaults when no explicit numbers exist, so record counts are assumptions. The analysis does not replace legal counsel, a formal DPIA, or an actual penetration test.

Related Skills

Explore More Software Engineering Skills→
FernanSuozaFernanSuoza

sec-risk-security-review

Perform OWASP ASVS-aligned threat modeling and risk assessment for proposed architectures.

Community
Advanced
pacphipacphi
6

n8n-security-testing

Scan n8n workflows for credential exposure and security flaws.

Community
Advanced
wojonswojons
4

testing-security

Test applications and infrastructure for security vulnerabilities and weaknesses.

Community
Advanced
zangjeicyzangjeicy

web-pentest

Conduct authorized web application penetration tests with phased reconnaissance, vulnerability analysis, and proof-based exploitation.

Community
Advanced