Scan for data privacy issues and sensitive information exposure. Use when reviewing data handling practices. Trigger with 'scan privacy issues', 'check sensitive data', or 'validate data protection'.
npxskills add jeremylongshore/claude-code-plugins-plus-skills--skill scanning-for-data-privacy-issuesLoading…
Scan codebases for data privacy violations, PII exposure, and non-compliance with privacy regulations including GDPR, CCPA, HIPAA, and LGPD. This skill detects hardcoded personal data, unprotected PII in logs and databases, missing consent mechanisms, improper data retention, and insufficient anonymization or pseudonymization of sensitive fields.
${CLAUDE_SKILL_DIR}/${CLAUDE_SKILL_DIR}/references/README.md for scanner API documentation, GDPR compliance guide, and sensitive data pattern definitions[a-zA-Z0-9+_.-]+@[a-zA-Z0-9.-]+), SSN patterns (\d{3}-\d{2}-\d{4}), credit card patterns (Luhn-valid 13-19 digit sequences), and phone number patterns. Flag each as CWE-312 (Cleartext Storage of Sensitive Information).console.log, logger.info, logging.debug, Log.d) for PII field references -- flag any logging of user email, password, token, SSN, or credit card fields as CWE-532 (Insertion of Sensitive Information into Log File), severity high.email, phone, ssn, date_of_birth, address that lack encryption-at-rest annotations or transparent data encryption.| Error | Cause | Solution |
|---|---|---|
| High false positive rate on PII patterns | Regex patterns matching non-PII strings (e.g., UUIDs matching SSN patterns) | Refine patterns with context-aware checks; filter results by file type and surrounding code context |
| Encrypted PII not detected | Application uses transparent encryption that masks PII at the code level | Check encryption configuration separately; mark encrypted fields as "protected" in the inventory |
| Third-party data processors not visible | PII sent to external services via API calls | Grep for HTTP client calls and map destination URLs; flag external services requiring Data Processing Agreements |
| Large codebase scan timeout | Millions of lines to scan | Scope to high-risk directories first (src/, api/, config/); exclude node_modules/, vendor/, and build artifacts |
| Test data flagged as PII exposure | Test fixtures use realistic but fake data | Verify test data is synthetic; recommend using obviously fake data (e.g., [email protected]) to avoid false positives |
Grep ${CLAUDE_SKILL_DIR}/src/ for logging statements that reference user fields:
logger.info.*email, console.log.*password, Log.d.*phone. Flag each match
as CWE-532, severity high. Recommend implementing a log sanitizer middleware
that redacts PII fields before writing to log output.
Scan ${CLAUDE_SKILL_DIR}/src/api/ for endpoints supporting data subject rights: user
data export (GET /api/users/:id/export), data deletion (DELETE /api/users/:id),
and consent withdrawal. Flag missing endpoints as GDPR Article 15/17/21 gaps,
severity high. Recommend implementing a data subject request handler.
Search for credit card number patterns across all source files using
\b[0-9]{13,19}\b with Luhn validation context. Check that any payment
processing code uses tokenization rather than storing raw card numbers. Flag
PAN storage as PCI DSS Requirement 3 violation and CWE-312, severity critical.
Create or update AgentSkills. Use when designing, structuring, or packaging skills with scripts, references, and assets.
Create or update AgentSkills. Use when designing, structuring, or packaging skills with scripts, references, and assets.
Set up and use 1Password CLI (op). Use when installing the CLI, enabling desktop app integration, signing in (single or multi-account), or reading/injecting/running secrets via op.
CLI to manage emails via IMAP/SMTP. Use `himalaya` to list, read, write, reply, forward, search, and organize emails from the terminal. Supports multiple accounts and message composition with MML (MIME Meta Language).
Create or update AgentSkills. Use when designing, structuring, or packaging skills with scripts, references, and assets.
Create or update AgentSkills. Use when designing, structuring, or packaging skills with scripts, references, and assets.
Set up and use 1Password CLI (op). Use when installing the CLI, enabling desktop app integration, signing in (single or multi-account), or reading/injecting/running secrets via op.
CLI to manage emails via IMAP/SMTP. Use `himalaya` to list, read, write, reply, forward, search, and organize emails from the terminal. Supports multiple accounts and message composition with MML (MIME Meta Language).