사용 방법
- 설치 명령을 복사하고 자신의 에이전트 환경에 설치하기 전에 소스 패키지를 확인하세요.
- 필요한 도구, 인증 정보, 지원 환경은 원본 문서에서 확인하세요.
- 입력과 원하는 산출물을 설명하고 출처와 결과를 대조하세요.
npx skills add https://github.com/majesticlabs-dev/majestic-marketplace --skill privacy-reviewer시작 전 확인
- 설치에는 모델 구독, API 한도, 파일 접근 권한이 포함되지 않습니다.
- 별점 수와 설치 수는 활동 지표이며 독립적인 품질·보안 검증이 아닙니다.
원본 Skill 문서
원본 저장소의 제목, 예시, 코드, 표, 링크, 이미지를 유지해 표시합니다.
Privacy Compliance Review
Review PII identification, encryption, data deletion, and regulatory compliance.
PII Identification Checklist
| Category | Examples | Treatment |
|---|---|---|
| Direct identifiers | Name, email, phone, SSN | Encrypt at rest |
| Indirect identifiers | IP address, device ID | Hash or encrypt |
| Location data | GPS, address, zip code | Encrypt, retention limits |
| Financial | Card numbers, bank accounts | PCI compliance required |
| Health | Medical records, conditions | HIPAA compliance required |
| Behavioral | Browsing history, preferences | Consent required |
Encryption for Sensitive Fields
ruby
# Rails 7+ built-in encryption
class User < ApplicationRecord
encrypts :ssn
encrypts :date_of_birth
encrypts :medical_notes, deterministic: false # Non-searchable
end
# Configuration in credentials
# active_record_encryption:
# primary_key: <32-byte key>
# deterministic_key: <32-byte key>
# key_derivation_salt: <salt>Right to Deletion (GDPR Article 17)
ruby
# PROBLEM: Hard delete loses audit trail
user.destroy
# SOLUTION: Anonymization with audit preservation
def anonymize!
transaction do
update!(
email: "deleted_#{id}@anonymized.local",
name: "Deleted User",
phone: nil,
address: nil,
deleted_at: Time.current
)
# Keep orders for accounting, anonymize PII
orders.update_all(
customer_name: "Anonymized",
shipping_address: nil
)
end
endData Retention
ruby
# Automated cleanup job
class PiiRetentionJob < ApplicationJob
def perform
# Delete inactive users after retention period
User.where("last_activity_at < ?", 3.years.ago)
.find_each(&:anonymize!)
# Purge old logs
AuditLog.where("created_at < ?", 7.years.ago).delete_all
end
endAudit Trails
ruby
# Track PII access
class PiiAccessLog < ApplicationRecord
belongs_to :user # Whose data was accessed
belongs_to :accessed_by, class_name: 'User'
# Log: what, when, why, who
# user_id, accessed_by_id, field_accessed, purpose, created_at
end
# In model
def ssn
PiiAccessLog.create!(user: self, accessed_by: Current.user, field_accessed: 'ssn')
super
endConsent Management
ruby
class UserConsent < ApplicationRecord
belongs_to :user
# Track: what consented, when, version, withdrawal
# consent_type, granted_at, policy_version, withdrawn_at
end
# Check before processing
def can_send_marketing?(user)
user.consents.active.exists?(consent_type: 'marketing')
endData Export (GDPR Article 20)
ruby
def export_personal_data
{
profile: attributes.slice('name', 'email', 'phone'),
orders: orders.map(&:export_data),
activity: activity_logs.map(&:export_data),
exported_at: Time.current.iso8601
}.to_json
endReview Checklist
- [ ] All PII fields identified and documented?
- [ ] Sensitive fields encrypted at rest?
- [ ] Anonymization method exists for deletion requests?
- [ ] Data retention policies implemented?
- [ ] PII access logged for audit?
- [ ] Consent tracked before data processing?
- [ ] Data export available for portability requests?
Output Format
markdown
## Privacy Review: [PASS/WARN/FAIL]
### Unencrypted PII
- [model.field]: [PII type, should be encrypted]
### Deletion Compliance
- [issue]: [hard deletes without anonymization option]
### Missing Audit Trails
- [model]: [PII accessed without logging]
### Consent Gaps
- [feature]: [processes data without consent check]
### Recommendations
1. [Prioritized fixes]
