skill-parhamb-design-skills-safety-privacy · by Install
$ agentstack add skill-parhamb-design-skills-safety-privacy ✓ scanned · ✓ verified, works with Claude Code, Cursor, and more.
Security review
✓ PassedNo issues found. Passed automated security review. · v0.1.0 How review works →
- ✓ Prompt-injection patterns
- ✓ Secret / credential exfiltration
- ✓ Dangerous shell & filesystem operations
- ✓ Untrusted network calls
- ✓ Known-malicious package signatures
What it can access
- ✓ Network access No
- ✓ Filesystem access No
- ✓ Shell / process execution No
- ✓ Environment & secrets No
- ✓ Dynamic code execution No
From automated source analysis of v0.1.0. “Used” means the capability is present in the source — more access means more to trust, not that it’s unsafe.
Verified badge
Passed review? Show it. Paste this badge into your README, it links to the public security report.
Links to your public security report.[](https://agentstack.voostack.com/security/report/skill-parhamb-design-skills-safety-privacy) Reliability & compatibility
Declared compatibility
Compatibility is declared by the source manifest. End-to-end runtime verification is coming, see below.
We're building live execution health for every listing: tool-call success rate, median latency, uptime, and last-checked timestamps, measured, not self-reported. It isn't live yet, so we don't show numbers we can't stand behind.
How agent discovery & health will work →About
Safety and Privacy UX
Privacy is a user right. Security is a promise. Both must be designed for explicitly — users should not have to choose between convenience and protection.
Checklist
| Item | Guidance | |---|---| | Biometric authentication | Face ID and fingerprint are available for app re-entry and sensitive actions. | | Storage permission prompt | Asked at the moment of use, not on launch. Explains why access is needed. | | Location permission prompt | Request "While Using" first. Upgrade to "Always" only when strictly necessary. | | Permissions listed | All required permissions are explained before the system dialog appears. | | Data protection | Data is encrypted at rest and in transit. Sensitive fields are masked. | | Multi-device management | User can view all signed-in devices and revoke access remotely from Settings. | | Notification management | Per-type notification toggles (transactional, promotional, security). | | Two-factor authentication | TOTP (authenticator app) available with SMS as fallback and backup codes for recovery. | | Privacy policy link | Accessible from Settings > About and during account creation. A link, not a buried PDF. | | GDPR compliance | Data export, data deletion, and consent management are implemented. | | Analytics disclosure | Analytics providers are listed in the privacy policy. |
Permission Best Practices
Ask for permissions in context, not on launch. Requesting camera access when the user first opens the app feels invasive. Asking when the user taps the camera icon feels natural and logical.
Before the system permission dialog appears, show a pre-permission screen that explains what you are asking for and why. This dramatically improves the acceptance rate and reduces the chance the user denies and never comes back.
If a user denies a permission, always provide a recovery path. Show a message like "Enable in Settings > [App] > Camera" rather than silently disabling the feature.
GDPR Requirements and UX Implications
| Requirement | UX implementation | |---|---| | Right to access | "Download your data" option in Account settings | | Right to erasure | "Delete account and all data" flow with confirmation | | Right to portability | Data exported in a machine-readable format (JSON or CSV) | | Consent | Separate opt-in for marketing. Pre-ticked checkboxes are not valid consent. | | Data minimization | Collect only what is used. Delete what is no longer needed. | | Privacy by default | The most private settings are the default, not the most permissive. |
Authentication Security Patterns
Passkeys (FIDO2): Most secure with the best UX. Resistant to phishing. Use as the primary option where supported.
TOTP 2FA: Authenticator app (Google Authenticator, Authy). 6-digit rotating codes.
SMS OTP: More accessible but vulnerable to SIM swap. Use as a fallback, not a primary.
Magic links: Passwordless email login. Single-use and expire after 15 minutes.
Biometrics: Local authentication only. Biometric data never leaves the device.
Source & license
This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.
- Author: parhamb
- Source: parhamb/design-skills
- License: MIT
- Homepage: https://design-skills-pi.vercel.app
Install and usage instructions live in the source repository linked above.
Reviews
No reviews yet, be the first.
Write a review
Versions
- v0.1.0 Imported from the upstream source.