# Layerkit Privacy Review

> Review and update client-owned privacy, consent, hashing, redaction, and egress checks before vendor integration changes ship.

- **Type:** Skill
- **Install:** `agentstack add skill-hariharapanigrahy-layerkit-layerkit-privacy-review`
- **Verified:** Yes — security-reviewed for prompt injection and unsafe behavior
- **Seller:** [hariharapanigrahy](https://agentstack.voostack.com/s/hariharapanigrahy)
- **Installs:** 0
- **Category:** [AI & ML](https://agentstack.voostack.com/c/ai-and-ml)
- **Latest version:** 0.1.0
- **License:** MIT
- **Upstream author:** [hariharapanigrahy](https://github.com/hariharapanigrahy)
- **Source:** https://github.com/hariharapanigrahy/layerkit/tree/main/skills/layerkit-privacy-review

## Install

```sh
agentstack add skill-hariharapanigrahy-layerkit-layerkit-privacy-review
```

Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent.

## About

# layerkit-privacy-review

Privacy review is source-code review plus evidence capture. Layerkit does not provide a runtime privacy gate for the client package.

## Protocol

1. Inventory new or changed fields from the vendor contract and client mapper.
2. Classify likely PII/regulated data from field meaning, customer code, and policy evidence.
3. Inspect existing consent, hashing, redaction, allowlist, denylist, and region checks in the client package.
4. Update existing privacy code/tests directly when the vendor change requires it.
5. Move raw API keys, passwords, private keys, bearer tokens, and credentials to environment variables or the client's secrets manager. In public or shared repos, source string literals that contain secrets are release blockers. Do not paste them into Layerkit memory/proposals/tests.
6. Leave a TODO only when customer policy or datalayer support is missing.
7. Record a redacted memory note:

```bash
layerkit memory append --type privacy --title "privacy review " --vendor  --body-file ./privacy-digest.md
```

8. Run the client package tests that cover privacy behavior and `layerkit doctor`.

## Forbidden

- Inventing legal basis, consent meaning, or privacy classification.
- Pasting real PII into Layerkit memory, proposals, tests, or docs.
- Leaving API keys, passwords, or tokens as source string literals.
- Shipping public/shared code while secret-like literals remain in source.
- Adding a parallel privacy layer when the existing client privacy path can be changed.
- Treating a Layerkit proposal as production privacy enforcement.
- Self-approving a privacy-sensitive change in strict maker-checker mode.

## Success Criteria

- [ ] Changed PII fields are covered by existing or updated client checks.
- [ ] Privacy tests were updated when behavior changed.
- [ ] Secret-like values are env/SecretRef/secrets-manager references, not literals.
- [ ] Digest names residual human questions without raw PII.
- [ ] Unsupported data/policy gaps are explicit TODOs in the integration path.

## Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

- **Author:** [hariharapanigrahy](https://github.com/hariharapanigrahy)
- **Source:** [hariharapanigrahy/layerkit](https://github.com/hariharapanigrahy/layerkit)
- **License:** MIT

Install and usage instructions live in the source repository linked above.

## Pricing

- **Free** — Free

## Security capabilities

Automated source analysis of v0.1.0 — what this tool can access:

- **Network access:** no
- **Filesystem access:** no
- **Shell / process execution:** no
- **Environment & secrets:** no
- **Dynamic code execution:** no

*"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.*


## Versions

- **0.1.0** — security scan: passed — Imported from the upstream source.

## Links

- Listing page: https://agentstack.voostack.com/l/skill-hariharapanigrahy-layerkit-layerkit-privacy-review
- Seller: https://agentstack.voostack.com/s/hariharapanigrahy
- Browse the marketplace: https://agentstack.voostack.com/browse

---
Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.