# Privacy Surface Mapper

> Internal security specialist—not a direct entry point. Invoked by security-agent after pm-agent handoff to map personal-data collection, privacy obligations, GDPR/CCPA concerns, and data-flow exposure.

- **Type:** Skill
- **Install:** `agentstack add skill-neplich-dev-agent-skills-privacy-surface-mapper`
- **Verified:** Yes — security-reviewed for prompt injection and unsafe behavior
- **Seller:** [Neplich](https://agentstack.voostack.com/s/neplich)
- **Installs:** 0
- **Category:** [Agent Skills](https://agentstack.voostack.com/c/agent-skills)
- **Latest version:** 0.1.0
- **License:** Apache-2.0
- **Upstream author:** [Neplich](https://github.com/Neplich)
- **Source:** https://github.com/Neplich/dev-agent-skills/tree/main/agents/security/skills/privacy-surface-mapper

## Install

```sh
agentstack add skill-neplich-dev-agent-skills-privacy-surface-mapper
```

Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent.

## About

## PM Handoff Entry Gate

Before privacy mapping, require a PM/Security handoff packet or equivalent
confirmed data-scope context. If the user directly invokes this specialist
without PM handoff context, confirmed data categories, or a confirmed
`feature_path` for feature-scoped work, return the request to `pm-agent` for
classification.

Use the PM-side packet definition in
`agents/product_manager/skills/idea-to-spec/_internal/_shared/skill-map.md`.

## Execution Steps

### Step 1: Understand Data Requirements

1. **Resolve feature scope**:
   - For feature-scoped privacy mapping, use the confirmed `feature_path`.
   - Read `docs/pm/{feature_path}/PRD.md`.
   - Read `docs/engineer/{feature_path}/TRD.md` and
     `docs/engineer/{feature_path}/IMPLEMENTATION_PLAN.md` when architecture,
     storage, integrations, or release scope affect data handling.
   - If `feature_path` is unclear, return to PM for PRD/path clarification or
     Engineer for missing/stale TRD or implementation plan; do not invent a
     new top-level security directory.

2. **Read PM documents**:
   - PRD: identify what user data is collected and why
   - Extract data fields (name, email, phone, address, etc.)

### Step 2: Map Data Collection Points

**A. Find data collection code:**
- Search for form inputs, API endpoints collecting user data
- Search for user registration/profile endpoints
- Search for analytics/tracking code

**B. Classify data types:**
- **Personal Identifiable Information (PII):** name, email, phone, address
- **Sensitive data:** health info, financial data, biometric data
- **Behavioral data:** browsing history, preferences, usage patterns

### Step 3: Analyze Data Storage and Transmission

**A. Storage:**
- Where is data stored (database, files, cache)
- Is data encrypted at rest
- Data retention period

**B. Transmission:**
- Is data encrypted in transit (HTTPS)
- Third-party data sharing
- Cross-border data transfers

### Step 4: Check User Rights Implementation

**GDPR/CCPA requires:**
- Right to access (data export)
- Right to deletion (data erasure)
- Right to rectification (data correction)
- Right to portability (data download)

Search for implementation of these features.

### Step 5: Generate Privacy Map Report

Create `docs/security/{feature_path}/privacy-map.md`:

**Frontmatter:**
```yaml
---
feature: {feature}
feature_path: {feature_path}
parent_feature: {parent_feature}
feature_level: {feature_level}
version: v1
date: YYYY-MM-DD
last_updated: YYYY-MM-DD
---
```

**Report Structure:**

1. **Personal Data Inventory**
   - Table of all personal data collected
   - Data type, purpose, legal basis

2. **Data Flow Diagram**
   - Collection → Storage → Processing → Deletion

3. **Third-Party Data Sharing**
   - List of third parties receiving data
   - Purpose and legal basis

4. **User Rights Implementation Status**
   - Access: ✅/❌
   - Deletion: ✅/❌
   - Export: ✅/❌
   - Correction: ✅/❌

5. **Privacy Risks**
   - Compliance gaps
   - Missing consent mechanisms
   - Inadequate data protection

6. **Recommendations**
   - Priority fixes for compliance
   - Privacy policy updates needed

## Output Format

```markdown
## Personal Data Inventory

| Data Field | Type | Purpose | Legal Basis | Retention |
|-----------|------|---------|-------------|-----------|
| Email | PII | Account login | Contract | Account lifetime |
| Name | PII | Personalization | Consent | Account lifetime |
| IP Address | PII | Security | Legitimate interest | 90 days |

## User Rights Status

- ✅ Right to Access: Implemented via /api/user/export
- ❌ Right to Deletion: Not implemented
- ❌ Right to Export: Partial (missing transaction history)
- ✅ Right to Correction: Implemented via profile edit

## Privacy Risks

### [HIGH] Missing Data Deletion Endpoint

**Issue:** No way for users to delete their account and data

**Compliance Impact:** GDPR Article 17 violation

**Fix:** Implement account deletion endpoint with cascading data removal
```

## Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

- **Author:** [Neplich](https://github.com/Neplich)
- **Source:** [Neplich/dev-agent-skills](https://github.com/Neplich/dev-agent-skills)
- **License:** Apache-2.0

Install and usage instructions live in the source repository linked above.

## Pricing

- **Free** — Free

## Security capabilities

Automated source analysis of v0.1.0 — what this tool can access:

- **Network access:** no
- **Filesystem access:** no
- **Shell / process execution:** no
- **Environment & secrets:** no
- **Dynamic code execution:** no

*"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.*


## Versions

- **0.1.0** — security scan: passed — Imported from the upstream source.

## Links

- Listing page: https://agentstack.voostack.com/l/skill-neplich-dev-agent-skills-privacy-surface-mapper
- Seller: https://agentstack.voostack.com/s/neplich
- Browse the marketplace: https://agentstack.voostack.com/browse

---
Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.