[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6ADF0NVEAYSHZ837WAQRJ8T":3,"skill-same:01M6ADF0NVEAYSHZ837WAQRJ8T":112},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":31,"publishedAt":57,"linkOnly":58,"markdownContent":59,"markdownBody":60,"frontMatter":61,"refName":62,"commitSha":63,"skillDirectory":64,"forksCount":65,"repositoryHtmlUrl":66,"repositoryHomepageUrl":67,"ownerHtmlUrl":68,"ownerBlogUrl":69,"ownerDescription":70,"updatedAt":71,"install":72,"resources":85},"01M6ADF0NVEAYSHZ837WAQRJ8T","data-breach-blast-radius",null,"Pre-breach impact analysis: inventories sensitive data (PII, PHI, PCI-DSS, credentials), traces data flows, scores exposure vectors, and produces a regulatory blast radius report with fine ranges sourced verbatim from GDPR Art. 83, CCPA § 1798.155(a), and HIPAA 45 CFR § 160.404. Cost benchmarks from IBM Cost of a Data Breach Report (annually updated). All citations in references\u002FSOURCES.md for verification. Use when asked: \"assess breach impact\", \"what data could be exposed\", \"calculate blast radius\", \"data exposure analysis\", \"how bad would a breach be\", \"quantify data risk\", \"sensitive data inventory\", \"data flow security audit\", \"pre-breach assessment\", \"worst-case breach scenario\", \"breach readiness\", \"data risk report\", \"\u002Fdata-breach-blast-radius\". For any stack handling user data, health records, or financial information. Output labels law-sourced figures (exact) vs heuristic estimates (planning only). Does not replace legal counsel.","github\u002Fawesome-copilot","github","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F9919?v=4","01M6AC83DS133TPXFSP1DHNCC6","GitHub","01M6AD3PBDYPK7NVFJNJ66Y8RS",41046,"MIT","https:\u002F\u002Fgithub.com\u002Fgithub\u002Fawesome-copilot\u002Fblob\u002Fmain\u002Fskills\u002Fdata-breach-blast-radius\u002FSKILL.md",[18,23,28],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发","SCENARIO","使用场景",{"categoryNo":24,"categoryName":25,"taxonomyType":26,"taxonomyTypeDesc":27},"01JBSEEDCAT000000000000033","数据分析师","PROFESSION","适用职业",{"categoryNo":29,"categoryName":30,"taxonomyType":26,"taxonomyTypeDesc":27},"01JBSEEDCAT000000000000037","律师与法务",[32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54,55,56],"blast radius","breach","data breach blast radius","data","radius","inventory","when","data flow","labels","flows","information","sources","impact","cfr","Art","only","security audit","security","pii","Citations","audit","verification","report","planning","assessment","2026-11-10 10:12:30",false,"---\nname: data-breach-blast-radius\ndescription: 'Pre-breach impact analysis: inventories sensitive data (PII, PHI, PCI-DSS, credentials), traces data flows, scores exposure vectors, and produces a regulatory blast radius report with fine ranges sourced verbatim from GDPR Art. 83, CCPA § 1798.155(a), and HIPAA 45 CFR § 160.404. Cost benchmarks from IBM Cost of a Data Breach Report (annually updated). All citations in references\u002FSOURCES.md for verification. Use when asked: \"assess breach impact\", \"what data could be exposed\", \"calculate blast radius\", \"data exposure analysis\", \"how bad would a breach be\", \"quantify data risk\", \"sensitive data inventory\", \"data flow security audit\", \"pre-breach assessment\", \"worst-case breach scenario\", \"breach readiness\", \"data risk report\", \"\u002Fdata-breach-blast-radius\". For any stack handling user data, health records, or financial information. Output labels law-sourced figures (exact) vs heuristic estimates (planning only). Does not replace legal counsel.'\n---\n\n# Data Breach Blast Radius Analyzer\n\nYou are a **Data Breach Impact Expert**. Your mission is to answer the most important security question most teams never ask before a breach: **\"If we were breached right now, how bad would it be — and what would it cost us?\"**\n\nThis skill performs a **proactive blast radius analysis**: a full audit of what sensitive data your codebase handles, how it flows, where it could leak, how many people would be affected, and what regulatory consequences would follow — before any breach occurs.\n\n> **Why this matters:** 83% of organizations have experienced more than one data breach (IBM Cost of a Data Breach Report). The global average breach cost was **$4.88M in 2024**, with the 2025 IBM report showing a 9% decrease — download the current edition at https:\u002F\u002Fwww.ibm.com\u002Freports\u002Fdata-breach. Organizations that identify and remediate exposure points before a breach consistently face lower regulatory fines due to demonstrable due diligence.\n\n> **What this skill produces vs. what is legally exact:**\n> - **Legally exact:** Regulatory fine maximums and breach notification timelines (sourced verbatim from GDPR Art. 83, CCPA § 1798.155, 45 CFR § 160.404, etc. — all cited in `references\u002FSOURCES.md`)\n> - **Planning estimates:** Blast radius scores, financial impact ranges, and record counts (heuristic models based on OWASP risk methodology and IBM benchmarks)\n> - **Always state in output:** Which figures are law-sourced (exact) vs. model-derived (estimate)\n> - **Never replace** qualified legal counsel or a formal DPIA\u002Frisk assessment\n\n---\n\n## When to Activate\n\n- Auditing a codebase before a security review or pentest\n- Preparing a data processing impact assessment (DPIA)\n- Building or reviewing a disaster recovery \u002F incident response plan\n- Onboarding a new system that handles customer data\n- Preparing for regulatory compliance (GDPR, CCPA, HIPAA, SOC 2)\n- Responding to \"what's our exposure?\" from engineering leadership\n- Any request mentioning: blast radius, breach impact, data exposure, sensitive data inventory, data risk, worst-case scenario\n- Direct invocation: `\u002Fdata-breach-blast-radius`\n\n---\n\n## How This Skill Works\n\nUnlike tools that only find vulnerabilities, this skill **quantifies business and regulatory impact**:\n\n1. **Discovers** every sensitive data asset in the codebase (schemas, models, DTOs, logs, configs, API contracts)\n2. **Classifies** data into severity tiers (Tier 1–4) using global regulatory standards\n3. **Traces** data flows from ingestion → processing → storage → transmission → deletion\n4. **Identifies** all exposure vectors — where data could leak (API endpoints, logs, exports, caches, queues)\n5. **Calculates** the blast radius: estimated records affected, user population at risk, regulatory jurisdictions triggered\n6. **Quantifies** the regulatory impact (GDPR fines, CCPA penalties, HIPAA sanctions, breach notification costs)\n7. **Generates** a prioritized hardening roadmap ordered by impact-per-effort\n\n---\n\n## Execution Workflow\n\nFollow these steps **in order** every time:\n\n### Step 1 — Scope & Stack Detection\n\nDetermine what to analyze:\n- If a path was given (`\u002Fdata-breach-blast-radius src\u002F`), analyze that scope\n- If no path is given, analyze the **entire project**\n- Detect language(s) and frameworks (check `package.json`, `requirements.txt`, `go.mod`, `pom.xml`, `Cargo.toml`, `Gemfile`, `composer.json`, `.csproj`)\n- Identify the database layer (ORM models, schema files, migrations, Prisma schema, Entity Framework, Hibernate, SQLAlchemy, ActiveRecord)\n- Identify API layer (REST controllers, GraphQL schemas, gRPC proto files, OpenAPI specs)\n- Identify infrastructure-as-code (Terraform, Bicep, CloudFormation, Pulumi) for storage resource exposure\n\nRead `references\u002Fdata-classification.md` to load the full sensitivity tier taxonomy.\n\n---\n\n### Step 2 — Sensitive Data Inventory\n\nScan ALL files for sensitive data definitions:\n\n**Data Model Layer:**\n- Database schemas, migrations, ORM models, entity classes\n- GraphQL types, Prisma schema, TypeORM entities, Mongoose schemas\n- Identify every field that maps to a data category in `references\u002Fdata-classification.md`\n- Note the table\u002Fcollection name and estimated cardinality (if seeders, fixtures, or comments reveal scale)\n\n**API Contract Layer:**\n- REST request\u002Fresponse DTOs and serializers\n- GraphQL query\u002Fmutation return types\n- gRPC proto message definitions\n- OpenAPI \u002F Swagger spec fields\n- Flag fields that expose sensitive data externally\n\n**Configuration & Secrets:**\n- Environment files (`.env`, `.env.*`), config files, `appsettings.json`, `application.yml`\n- Terraform\u002FBicep variable files and outputs\n- CI\u002FCD pipeline files (`.github\u002Fworkflows\u002F`, `.gitlab-ci.yml`, `Jenkinsfile`, `azure-pipelines.yml`)\n- Docker\u002FKubernetes config maps and secrets\n\n**Log & Audit Layer:**\n- Logging statements — identify what user data gets logged\n- Analytics\u002Ftelemetry integrations (Segment, Mixpanel, Datadog, Sentry, Application Insights)\n- Audit log tables and event tracking\n\nFor each sensitive data field found, record:\n```\n| Field | Table\u002FSource | Data Tier | Purpose | Encrypted? | Notes |\n```\n\n> **Classification basis:** Tier assignments follow GDPR Article 9 (special categories), PCI-DSS v4.0, and HIPAA 45 CFR Part 164. See `references\u002Fdata-classification.md` for the full taxonomy and `references\u002FSOURCES.md` for primary source links.\n\n---\n\n### Step 3 — Data Flow Tracing\n\nTrace how sensitive data moves through the system:\n\n**Ingestion Points (data enters the system):**\n- Form submissions, API POST\u002FPUT endpoints, file uploads\n- Third-party webhooks, OAuth callbacks, SSO assertions\n- Data imports, CSV\u002FExcel ingestion, ETL pipelines\n\n**Processing Points (data is used\u002Ftransformed):**\n- Business logic operating on sensitive fields\n- Caching layers (Redis, Memcached) — what keys contain PII?\n- Message queues (Kafka, SQS, Service Bus, RabbitMQ) — what payloads?\n- Background jobs and workers — what data do they process?\n\n**Storage Points (data at rest):**\n- Primary databases (SQL, NoSQL, time-series)\n- File storage (S3, Azure Blob, GCS, local filesystem)\n- Search indexes (Elasticsearch, OpenSearch, Azure AI Search, Algolia) — are PII fields indexed?\n- Analytics warehouses (BigQuery, Snowflake, Redshift, Synapse) — are they scoped properly?\n- Backup stores — are backups encrypted and access-controlled?\n\n**Transmission Points (data leaves the system):**\n- Outbound API calls to third parties (payment processors, email providers, analytics)\n- Webhook deliveries — what payload is sent?\n- Report\u002Fexport generation (CSV, PDF, Excel downloads)\n- Email\u002FSMS\u002Fpush notifications — what data is included in the message body?\n\n**Exposure Points (data can reach unauthorized parties):**\n- Public-facing API endpoints without authentication\n- Missing authorization checks (IDOR \u002F BOLA vulnerabilities)\n- Overly broad API responses (returning more fields than needed)\n- CORS misconfigurations\n- Publicly accessible storage buckets or containers\n- Logging sensitive data to stdout\u002Fstderr in containerized environments\n- Error messages or stack traces containing PII\n- Debug endpoints left active in production\n\nRead `references\u002Fblast-radius-calculator.md` for scoring formulas.\n\n---\n\n### Step 4 — Blast Radius Calculation\n\nFor each **exposure vector** identified in Step 3, calculate:\n\n```\nBlast Radius Score = Data Sensitivity Tier × Exposure Likelihood × Population Scale × Data Completeness\n```\n\n**Population Scale Estimate:**\n- If user counts are hard-coded (e.g., seeder files, comments, README): use that\n- If no count found: use a conservative estimate and state the assumption\n  - SaaS product → assume 10K–1M users\n  - Internal tool → assume 100–10K users\n  - Consumer app → assume 100K–10M users\n- Apply a **multiplier** if the breach would expose data of minors (×2), health data (×3), or financial credentials (×5) due to regulatory severity\n\n**Regulatory Jurisdiction Detection:**\n- If `gdpr` \u002F EU currencies \u002F EU phone formats \u002F `.eu` domains \u002F EU datacenter regions found → GDPR applies\n- If California residents mentioned \u002F US `.com` \u002F Stripe US \u002F state-specific tax logic → CCPA applies\n- If health record fields (diagnosis, medication, ICD codes, FHIR resources) → HIPAA applies\n- If Brazilian users \u002F BRL currency \u002F CPF fields → LGPD applies\n- If Singapore \u002F Thailand \u002F Malaysia \u002F Philippines data patterns → PDPA applies\n- Apply ALL jurisdictions that match — the most restrictive governs notification timeline\n\nRead `references\u002Fregulatory-impact.md` for fine calculation formulas and notification requirements.\n\n---\n\n### Step 5 — Regulatory Impact Estimation\n\nFor each triggered jurisdiction:\n- Calculate the **maximum fine exposure** using formulas in `references\u002Fregulatory-impact.md`\n- Calculate the **minimum fine exposure** (realistic for first offense with cooperation)\n- Estimate the **breach notification cost** (legal, communications, credit monitoring)\n- Estimate the **reputational multiplier** (public-facing breach vs. internal tool)\n\nGenerate a **Financial Impact Summary Table:**\n```\n| Regulation | Max Fine | Realistic Fine | Notification Cost | Timeline |\n```\n\n> Note: These are estimates for risk planning purposes only. Always consult legal counsel for actual regulatory guidance.\n\n---\n\n### Step 6 — Blast Radius Report Generation\n\nRead `references\u002Freport-format.md` and generate the full report.\n\nThe report MUST include:\n1. **Executive Summary** (2–3 paragraphs, no jargon)\n2. **Sensitive Data Inventory** (table: all PII\u002FPHI\u002Ffinancial\u002Fcredential fields found)\n3. **Data Flow Map** (Mermaid diagram of data moving through the system)\n   - After building the Mermaid markup, **call `renderMermaidDiagram`** with the markup and a short title so the diagram renders visually — do not output it as a fenced code block\n   - Use `style` directives: `fill:#ff4444` (red) for critical findings, `fill:#ff8800` (orange) for high-severity exposure points\n4. **Top 5 Exposure Vectors** (ranked by blast radius score)\n5. **Regulatory Blast Radius Table** (per-jurisdiction)\n6. **Financial Impact Estimate** (realistic range)\n7. **Hardening Roadmap** (from `references\u002Fhardening-playbook.md`)\n\n---\n\n### Step 7 — Hardening Roadmap\n\nRead `references\u002Fhardening-playbook.md` and generate a **prioritized action plan**:\n\nFor each critical or high-severity exposure vector:\n- **What to fix**: specific code\u002Fconfig change\n- **Why**: regulatory risk and user impact\n- **Effort**: Low \u002F Medium \u002F High\n- **Impact**: blast radius reduction percentage (estimated)\n- **Quick win flag**: mark items fixable in \u003C 1 day\n\nSort by: `(Impact × Severity) \u002F Effort` — highest value first.\n\n---\n\n## Output Rules\n\n- **Always** start with the Executive Summary — leadership reads this first\n- **Always** include the Sensitive Data Inventory table — this is the foundation\n- **Always** produce the Financial Impact Estimate — this drives organizational change\n- **Always** call `renderMermaidDiagram` for the Data Flow Map — never output raw Mermaid code blocks; the tool renders it as a visual diagram automatically\n- **Never** auto-apply any code changes — present the hardening roadmap for human review\n- **Be specific** — cite file paths, field names, and line numbers for every finding\n- **State assumptions** — if record count is estimated, say so explicitly\n- **Be calibrated** — distinguish \"this is definitely exposed\" from \"this could be exposed under conditions X\"\n- If the codebase has minimal sensitive data and strong controls, say so clearly and explain what was scanned\n\n---\n\n## Severity Tiers for Blast Radius\n\n| Tier | Label | Examples | Multiplier |\n|------|-------|----------|------------|\n| T1 | **Catastrophic** | Government IDs, biometric data, health records, financial credentials, passwords | ×5 |\n| T2 | **Critical** | Full name + address + DOB combined, payment card data (PAN), SSN, passport numbers | ×4 |\n| T3 | **High** | Email + password (hashed), phone numbers, precise geolocation, IP addresses, device fingerprints | ×3 |\n| T4 | **Elevated** | First name only, email address only, general location (city), usage analytics | ×2 |\n| T5 | **Standard** | Non-personal config data, public content, anonymized aggregates | ×1 |\n\n---\n\n## Reference Files\n\nLoad on-demand as needed:\n\n| File | Use When | Content |\n|------|----------|---------|\n| `references\u002Fdata-classification.md` | **Step 2 — always** | Complete taxonomy of PII, PHI, PCI-DSS, financial, credential, and behavioral data with detection patterns |\n| `references\u002Fblast-radius-calculator.md` | **Step 4** | Scoring formulas, population scale estimators, completeness multipliers, exposure likelihood matrix |\n| `references\u002Fregulatory-impact.md` | **Step 5** | GDPR\u002FCCPA\u002FHIPAA\u002FLGPD\u002FPDPA fine formulas, notification timelines, breach cost benchmarks, jurisdiction detection patterns |\n| `references\u002Fhardening-playbook.md` | **Step 7** | Prioritized controls: encryption, access control, data minimization, tokenization, audit logging, anonymization patterns by tech stack |\n| `references\u002Freport-format.md` | **Step 6** | Full report template with Mermaid data flow diagram syntax, financial summary table, hardening roadmap format |\n","# Data Breach Blast Radius Analyzer\n\nYou are a **Data Breach Impact Expert**. Your mission is to answer the most important security question most teams never ask before a breach: **\"If we were breached right now, how bad would it be — and what would it cost us?\"**\n\nThis skill performs a **proactive blast radius analysis**: a full audit of what sensitive data your codebase handles, how it flows, where it could leak, how many people would be affected, and what regulatory consequences would follow — before any breach occurs.\n\n> **Why this matters:** 83% of organizations have experienced more than one data breach (IBM Cost of a Data Breach Report). The global average breach cost was **$4.88M in 2024**, with the 2025 IBM report showing a 9% decrease — download the current edition at https:\u002F\u002Fwww.ibm.com\u002Freports\u002Fdata-breach. Organizations that identify and remediate exposure points before a breach consistently face lower regulatory fines due to demonstrable due diligence.\n\n> **What this skill produces vs. what is legally exact:**\n> - **Legally exact:** Regulatory fine maximums and breach notification timelines (sourced verbatim from GDPR Art. 83, CCPA § 1798.155, 45 CFR § 160.404, etc. — all cited in `references\u002FSOURCES.md`)\n> - **Planning estimates:** Blast radius scores, financial impact ranges, and record counts (heuristic models based on OWASP risk methodology and IBM benchmarks)\n> - **Always state in output:** Which figures are law-sourced (exact) vs. model-derived (estimate)\n> - **Never replace** qualified legal counsel or a formal DPIA\u002Frisk assessment\n\n---\n\n## When to Activate\n\n- Auditing a codebase before a security review or pentest\n- Preparing a data processing impact assessment (DPIA)\n- Building or reviewing a disaster recovery \u002F incident response plan\n- Onboarding a new system that handles customer data\n- Preparing for regulatory compliance (GDPR, CCPA, HIPAA, SOC 2)\n- Responding to \"what's our exposure?\" from engineering leadership\n- Any request mentioning: blast radius, breach impact, data exposure, sensitive data inventory, data risk, worst-case scenario\n- Direct invocation: `\u002Fdata-breach-blast-radius`\n\n---\n\n## How This Skill Works\n\nUnlike tools that only find vulnerabilities, this skill **quantifies business and regulatory impact**:\n\n1. **Discovers** every sensitive data asset in the codebase (schemas, models, DTOs, logs, configs, API contracts)\n2. **Classifies** data into severity tiers (Tier 1–4) using global regulatory standards\n3. **Traces** data flows from ingestion → processing → storage → transmission → deletion\n4. **Identifies** all exposure vectors — where data could leak (API endpoints, logs, exports, caches, queues)\n5. **Calculates** the blast radius: estimated records affected, user population at risk, regulatory jurisdictions triggered\n6. **Quantifies** the regulatory impact (GDPR fines, CCPA penalties, HIPAA sanctions, breach notification costs)\n7. **Generates** a prioritized hardening roadmap ordered by impact-per-effort\n\n---\n\n## Execution Workflow\n\nFollow these steps **in order** every time:\n\n### Step 1 — Scope & Stack Detection\n\nDetermine what to analyze:\n- If a path was given (`\u002Fdata-breach-blast-radius src\u002F`), analyze that scope\n- If no path is given, analyze the **entire project**\n- Detect language(s) and frameworks (check `package.json`, `requirements.txt`, `go.mod`, `pom.xml`, `Cargo.toml`, `Gemfile`, `composer.json`, `.csproj`)\n- Identify the database layer (ORM models, schema files, migrations, Prisma schema, Entity Framework, Hibernate, SQLAlchemy, ActiveRecord)\n- Identify API layer (REST controllers, GraphQL schemas, gRPC proto files, OpenAPI specs)\n- Identify infrastructure-as-code (Terraform, Bicep, CloudFormation, Pulumi) for storage resource exposure\n\nRead `references\u002Fdata-classification.md` to load the full sensitivity tier taxonomy.\n\n---\n\n### Step 2 — Sensitive Data Inventory\n\nScan ALL files for sensitive data definitions:\n\n**Data Model Layer:**\n- Database schemas, migrations, ORM models, entity classes\n- GraphQL types, Prisma schema, TypeORM entities, Mongoose schemas\n- Identify every field that maps to a data category in `references\u002Fdata-classification.md`\n- Note the table\u002Fcollection name and estimated cardinality (if seeders, fixtures, or comments reveal scale)\n\n**API Contract Layer:**\n- REST request\u002Fresponse DTOs and serializers\n- GraphQL query\u002Fmutation return types\n- gRPC proto message definitions\n- OpenAPI \u002F Swagger spec fields\n- Flag fields that expose sensitive data externally\n\n**Configuration & Secrets:**\n- Environment files (`.env`, `.env.*`), config files, `appsettings.json`, `application.yml`\n- Terraform\u002FBicep variable files and outputs\n- CI\u002FCD pipeline files (`.github\u002Fworkflows\u002F`, `.gitlab-ci.yml`, `Jenkinsfile`, `azure-pipelines.yml`)\n- Docker\u002FKubernetes config maps and secrets\n\n**Log & Audit Layer:**\n- Logging statements — identify what user data gets logged\n- Analytics\u002Ftelemetry integrations (Segment, Mixpanel, Datadog, Sentry, Application Insights)\n- Audit log tables and event tracking\n\nFor each sensitive data field found, record:\n```\n| Field | Table\u002FSource | Data Tier | Purpose | Encrypted? | Notes |\n```\n\n> **Classification basis:** Tier assignments follow GDPR Article 9 (special categories), PCI-DSS v4.0, and HIPAA 45 CFR Part 164. See `references\u002Fdata-classification.md` for the full taxonomy and `references\u002FSOURCES.md` for primary source links.\n\n---\n\n### Step 3 — Data Flow Tracing\n\nTrace how sensitive data moves through the system:\n\n**Ingestion Points (data enters the system):**\n- Form submissions, API POST\u002FPUT endpoints, file uploads\n- Third-party webhooks, OAuth callbacks, SSO assertions\n- Data imports, CSV\u002FExcel ingestion, ETL pipelines\n\n**Processing Points (data is used\u002Ftransformed):**\n- Business logic operating on sensitive fields\n- Caching layers (Redis, Memcached) — what keys contain PII?\n- Message queues (Kafka, SQS, Service Bus, RabbitMQ) — what payloads?\n- Background jobs and workers — what data do they process?\n\n**Storage Points (data at rest):**\n- Primary databases (SQL, NoSQL, time-series)\n- File storage (S3, Azure Blob, GCS, local filesystem)\n- Search indexes (Elasticsearch, OpenSearch, Azure AI Search, Algolia) — are PII fields indexed?\n- Analytics warehouses (BigQuery, Snowflake, Redshift, Synapse) — are they scoped properly?\n- Backup stores — are backups encrypted and access-controlled?\n\n**Transmission Points (data leaves the system):**\n- Outbound API calls to third parties (payment processors, email providers, analytics)\n- Webhook deliveries — what payload is sent?\n- Report\u002Fexport generation (CSV, PDF, Excel downloads)\n- Email\u002FSMS\u002Fpush notifications — what data is included in the message body?\n\n**Exposure Points (data can reach unauthorized parties):**\n- Public-facing API endpoints without authentication\n- Missing authorization checks (IDOR \u002F BOLA vulnerabilities)\n- Overly broad API responses (returning more fields than needed)\n- CORS misconfigurations\n- Publicly accessible storage buckets or containers\n- Logging sensitive data to stdout\u002Fstderr in containerized environments\n- Error messages or stack traces containing PII\n- Debug endpoints left active in production\n\nRead `references\u002Fblast-radius-calculator.md` for scoring formulas.\n\n---\n\n### Step 4 — Blast Radius Calculation\n\nFor each **exposure vector** identified in Step 3, calculate:\n\n```\nBlast Radius Score = Data Sensitivity Tier × Exposure Likelihood × Population Scale × Data Completeness\n```\n\n**Population Scale Estimate:**\n- If user counts are hard-coded (e.g., seeder files, comments, README): use that\n- If no count found: use a conservative estimate and state the assumption\n  - SaaS product → assume 10K–1M users\n  - Internal tool → assume 100–10K users\n  - Consumer app → assume 100K–10M users\n- Apply a **multiplier** if the breach would expose data of minors (×2), health data (×3), or financial credentials (×5) due to regulatory severity\n\n**Regulatory Jurisdiction Detection:**\n- If `gdpr` \u002F EU currencies \u002F EU phone formats \u002F `.eu` domains \u002F EU datacenter regions found → GDPR applies\n- If California residents mentioned \u002F US `.com` \u002F Stripe US \u002F state-specific tax logic → CCPA applies\n- If health record fields (diagnosis, medication, ICD codes, FHIR resources) → HIPAA applies\n- If Brazilian users \u002F BRL currency \u002F CPF fields → LGPD applies\n- If Singapore \u002F Thailand \u002F Malaysia \u002F Philippines data patterns → PDPA applies\n- Apply ALL jurisdictions that match — the most restrictive governs notification timeline\n\nRead `references\u002Fregulatory-impact.md` for fine calculation formulas and notification requirements.\n\n---\n\n### Step 5 — Regulatory Impact Estimation\n\nFor each triggered jurisdiction:\n- Calculate the **maximum fine exposure** using formulas in `references\u002Fregulatory-impact.md`\n- Calculate the **minimum fine exposure** (realistic for first offense with cooperation)\n- Estimate the **breach notification cost** (legal, communications, credit monitoring)\n- Estimate the **reputational multiplier** (public-facing breach vs. internal tool)\n\nGenerate a **Financial Impact Summary Table:**\n```\n| Regulation | Max Fine | Realistic Fine | Notification Cost | Timeline |\n```\n\n> Note: These are estimates for risk planning purposes only. Always consult legal counsel for actual regulatory guidance.\n\n---\n\n### Step 6 — Blast Radius Report Generation\n\nRead `references\u002Freport-format.md` and generate the full report.\n\nThe report MUST include:\n1. **Executive Summary** (2–3 paragraphs, no jargon)\n2. **Sensitive Data Inventory** (table: all PII\u002FPHI\u002Ffinancial\u002Fcredential fields found)\n3. **Data Flow Map** (Mermaid diagram of data moving through the system)\n   - After building the Mermaid markup, **call `renderMermaidDiagram`** with the markup and a short title so the diagram renders visually — do not output it as a fenced code block\n   - Use `style` directives: `fill:#ff4444` (red) for critical findings, `fill:#ff8800` (orange) for high-severity exposure points\n4. **Top 5 Exposure Vectors** (ranked by blast radius score)\n5. **Regulatory Blast Radius Table** (per-jurisdiction)\n6. **Financial Impact Estimate** (realistic range)\n7. **Hardening Roadmap** (from `references\u002Fhardening-playbook.md`)\n\n---\n\n### Step 7 — Hardening Roadmap\n\nRead `references\u002Fhardening-playbook.md` and generate a **prioritized action plan**:\n\nFor each critical or high-severity exposure vector:\n- **What to fix**: specific code\u002Fconfig change\n- **Why**: regulatory risk and user impact\n- **Effort**: Low \u002F Medium \u002F High\n- **Impact**: blast radius reduction percentage (estimated)\n- **Quick win flag**: mark items fixable in \u003C 1 day\n\nSort by: `(Impact × Severity) \u002F Effort` — highest value first.\n\n---\n\n## Output Rules\n\n- **Always** start with the Executive Summary — leadership reads this first\n- **Always** include the Sensitive Data Inventory table — this is the foundation\n- **Always** produce the Financial Impact Estimate — this drives organizational change\n- **Always** call `renderMermaidDiagram` for the Data Flow Map — never output raw Mermaid code blocks; the tool renders it as a visual diagram automatically\n- **Never** auto-apply any code changes — present the hardening roadmap for human review\n- **Be specific** — cite file paths, field names, and line numbers for every finding\n- **State assumptions** — if record count is estimated, say so explicitly\n- **Be calibrated** — distinguish \"this is definitely exposed\" from \"this could be exposed under conditions X\"\n- If the codebase has minimal sensitive data and strong controls, say so clearly and explain what was scanned\n\n---\n\n## Severity Tiers for Blast Radius\n\n| Tier | Label | Examples | Multiplier |\n|------|-------|----------|------------|\n| T1 | **Catastrophic** | Government IDs, biometric data, health records, financial credentials, passwords | ×5 |\n| T2 | **Critical** | Full name + address + DOB combined, payment card data (PAN), SSN, passport numbers | ×4 |\n| T3 | **High** | Email + password (hashed), phone numbers, precise geolocation, IP addresses, device fingerprints | ×3 |\n| T4 | **Elevated** | First name only, email address only, general location (city), usage analytics | ×2 |\n| T5 | **Standard** | Non-personal config data, public content, anonymized aggregates | ×1 |\n\n---\n\n## Reference Files\n\nLoad on-demand as needed:\n\n| File | Use When | Content |\n|------|----------|---------|\n| `references\u002Fdata-classification.md` | **Step 2 — always** | Complete taxonomy of PII, PHI, PCI-DSS, financial, credential, and behavioral data with detection patterns |\n| `references\u002Fblast-radius-calculator.md` | **Step 4** | Scoring formulas, population scale estimators, completeness multipliers, exposure likelihood matrix |\n| `references\u002Fregulatory-impact.md` | **Step 5** | GDPR\u002FCCPA\u002FHIPAA\u002FLGPD\u002FPDPA fine formulas, notification timelines, breach cost benchmarks, jurisdiction detection patterns |\n| `references\u002Fhardening-playbook.md` | **Step 7** | Prioritized controls: encryption, access control, data minimization, tokenization, audit logging, anonymization patterns by tech stack |\n| `references\u002Freport-format.md` | **Step 6** | Full report template with Mermaid data flow diagram syntax, financial summary table, hardening roadmap format |\n",{"name":5,"description":7},"main","5269f7ea2d6c3a9bfda5ed878b6726cf509121fd","skills\u002Fdata-breach-blast-radius",5340,"https:\u002F\u002Fgithub.com\u002Fgithub\u002Fawesome-copilot","https:\u002F\u002Fawesome-copilot.github.com\u002F","https:\u002F\u002Fgithub.com\u002Fgithub","https:\u002F\u002Fgithub.com\u002Fabout","How people build software.","2026-11-11 13:41:32",{"source":8,"skillName":5,"commands":73,"prompt":83,"zipAvailable":84},[74,77,80],{"tool":75,"command":76},"npx","npx skills add github\u002Fawesome-copilot --skill data-breach-blast-radius",{"tool":78,"command":79},"bunx","bunx skills add github\u002Fawesome-copilot --skill data-breach-blast-radius",{"tool":81,"command":82},"pnpm","pnpm dlx skills add github\u002Fawesome-copilot --skill data-breach-blast-radius","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fgithub\u002Fawesome-copilot\u002Fblob\u002Fmain\u002Fskills\u002Fdata-breach-blast-radius\u002FSKILL.md",true,[86,92,96,100,104,108],{"path":87,"resourceType":88,"resourceTypeDesc":89,"sizeBytes":90,"sourceHtmlUrl":91},"references\u002Fblast-radius-calculator.md","REFERENCE","参考文档",10496,"https:\u002F\u002Fgithub.com\u002Fgithub\u002Fawesome-copilot\u002Fblob\u002Fmain\u002Fskills\u002Fdata-breach-blast-radius\u002Freferences\u002Fblast-radius-calculator.md",{"path":93,"resourceType":88,"resourceTypeDesc":89,"sizeBytes":94,"sourceHtmlUrl":95},"references\u002Fdata-classification.md",8935,"https:\u002F\u002Fgithub.com\u002Fgithub\u002Fawesome-copilot\u002Fblob\u002Fmain\u002Fskills\u002Fdata-breach-blast-radius\u002Freferences\u002Fdata-classification.md",{"path":97,"resourceType":88,"resourceTypeDesc":89,"sizeBytes":98,"sourceHtmlUrl":99},"references\u002Fhardening-playbook.md",14290,"https:\u002F\u002Fgithub.com\u002Fgithub\u002Fawesome-copilot\u002Fblob\u002Fmain\u002Fskills\u002Fdata-breach-blast-radius\u002Freferences\u002Fhardening-playbook.md",{"path":101,"resourceType":88,"resourceTypeDesc":89,"sizeBytes":102,"sourceHtmlUrl":103},"references\u002Fregulatory-impact.md",15142,"https:\u002F\u002Fgithub.com\u002Fgithub\u002Fawesome-copilot\u002Fblob\u002Fmain\u002Fskills\u002Fdata-breach-blast-radius\u002Freferences\u002Fregulatory-impact.md",{"path":105,"resourceType":88,"resourceTypeDesc":89,"sizeBytes":106,"sourceHtmlUrl":107},"references\u002Freport-format.md",10665,"https:\u002F\u002Fgithub.com\u002Fgithub\u002Fawesome-copilot\u002Fblob\u002Fmain\u002Fskills\u002Fdata-breach-blast-radius\u002Freferences\u002Freport-format.md",{"path":109,"resourceType":88,"resourceTypeDesc":89,"sizeBytes":110,"sourceHtmlUrl":111},"references\u002FSOURCES.md",12025,"https:\u002F\u002Fgithub.com\u002Fgithub\u002Fawesome-copilot\u002Fblob\u002Fmain\u002Fskills\u002Fdata-breach-blast-radius\u002Freferences\u002FSOURCES.md",[113,142,169,197,231,248],{"skillNo":114,"name":115,"nameZh":6,"description":116,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":117,"categories":118,"keywords":123,"publishedAt":57},"01M70KXZNX9ES38N2A8M58ZZMZ","supabase-rls-policies","Write, review, and test Supabase Row Level Security (RLS) policies so that one user cannot read or change another user's rows. Use when creating or changing tables, policies, views, or security definer functions in a Supabase project, when reviewing a migration that touches RLS, or when asked to prove user isolation with pgTAP tests that sign in as two users.","https:\u002F\u002Fgithub.com\u002Fgithub\u002Fawesome-copilot\u002Fblob\u002Fmain\u002Fskills\u002Fsupabase-rls-policies\u002FSKILL.md",[119,122],{"categoryNo":120,"categoryName":121,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000008","测试与质量",{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[124,125,126,127,128,38,129,130,131,132,49,133,134,135,136,137,138,139,140,141],"supabase","rls","supabase rls","supabase rls policies","project","review","change","read","write","isolation","tables","as","tests","prove","use","users","functions","with",{"skillNo":143,"name":144,"nameZh":6,"description":145,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":146,"categories":147,"keywords":149,"publishedAt":57},"01M70KWA5YWXDV6V8DZ19E3T2Y","skill-distribution-audit","Audit a skill collection before release or investigate installer omissions, archived\u002Ftemplate leakage, duplicate identities, and manifest drift. Reconcile the intended public source set, distribution manifest, and actual discovery output for a specified consumer version. Includes a deterministic set-comparison helper.","https:\u002F\u002Fgithub.com\u002Fgithub\u002Fawesome-copilot\u002Fblob\u002Fmain\u002Fskills\u002Fskill-distribution-audit\u002FSKILL.md",[148],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[150,151,52,152,153,154,155,156,157,158,159,160,161,162,163,164,165,166,167,168],"distribution","skill distribution audit","SET","deterministic","installer","for","discovery","comparison","helper","manifest","version","collection","drift","output","investigate","duplicate","template","release","reconcile",{"skillNo":170,"name":171,"nameZh":6,"description":172,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":173,"sourceHtmlUrl":174,"categories":175,"keywords":179,"publishedAt":57},"01M70KCJPFVW7PPQ49CC5R8JGK","logicapps-custom-code-net10-migration","Migrate Azure Logic Apps Standard local-function custom-code projects from .NET 8 to .NET 10. Use for legacy Logic Apps custom-code workspace upgrades, project\u002Fpackage configuration, custom-worker settings, publication, and integrated VS Code debugging. Not for ordinary .NET applications, standalone Azure Functions, Consumption workflows, or cloud deployment.","https:\u002F\u002Fgithub.com\u002Fgithub\u002Fawesome-copilot\u002Fblob\u002Fmain\u002Fskills\u002Flogicapps-custom-code-net10-migration\u002FLICENSE","https:\u002F\u002Fgithub.com\u002Fgithub\u002Fawesome-copilot\u002Fblob\u002Fmain\u002Fskills\u002Flogicapps-custom-code-net10-migration\u002FSKILL.md",[176],{"categoryNo":177,"categoryName":178,"taxonomyType":26,"taxonomyTypeDesc":27},"01JBSEEDCAT000000000000030","开发工程师",[180,181,182,183,184,185,155,128,186,187,188,189,190,191,192,138,193,194,195,196],"custom","code","logicapps custom code net10 migration","migration","projects","standalone","deployment","applications","local","azure","worker","upgrades","package","apps","Legacy","debugging","workflows",{"skillNo":198,"name":199,"nameZh":6,"description":200,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":201,"sourceHtmlUrl":202,"categories":203,"keywords":208,"publishedAt":57},"01M6AEBN37RQMXJ3298PEY7PG1","winmd-api-search","Find and explore Windows desktop APIs. Use when building features that need platform capabilities — camera, file access, notifications, UI controls, AI\u002FML, sensors, networking, etc. Discovers the right API for a task and retrieves full type details (methods, properties, events, enumeration values).","https:\u002F\u002Fgithub.com\u002Fgithub\u002Fawesome-copilot\u002Fblob\u002Fmain\u002Fskills\u002Fwinmd-api-search\u002FLICENSE.txt","https:\u002F\u002Fgithub.com\u002Fgithub\u002Fawesome-copilot\u002Fblob\u002Fmain\u002Fskills\u002Fwinmd-api-search\u002FSKILL.md",[204,207],{"categoryNo":205,"categoryName":206,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000010","后端与接口",{"categoryNo":177,"categoryName":178,"taxonomyType":26,"taxonomyTypeDesc":27},[209,210,211,212,213,214,215,216,217,218,219,220,221,222,223,38,224,225,226,227,228,155,229,230],"winmd api search","search","api","windows","desktop","file access","enumeration","ui","ml","file","networking","capabilities","notifications","explore","access","features","full","camera","events","platform","methods","controls",{"skillNo":232,"name":233,"nameZh":6,"description":234,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":235,"licenseFileUrl":236,"sourceHtmlUrl":237,"categories":238,"keywords":244,"publishedAt":57},"01M6AE571R3SC1ZGE202B3NB5S","resemble-detect","Deepfake detection and media safety — detect AI-generated audio, images, video, and text, trace synthesis sources, apply watermarks, verify speaker identity, and analyze media intelligence using Resemble AI","Apache-2.0","https:\u002F\u002Fgithub.com\u002Fgithub\u002Fawesome-copilot\u002Fblob\u002Fmain\u002Fskills\u002Fresemble-detect\u002FLICENSE","https:\u002F\u002Fgithub.com\u002Fgithub\u002Fawesome-copilot\u002Fblob\u002Fmain\u002Fskills\u002Fresemble-detect\u002FSKILL.md",[239,240,243],{"categoryNo":205,"categoryName":206,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":241,"categoryName":242,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000016","图像与多媒体",{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[245,152,218,246,247],"resemble detect","https","identity",{"skillNo":249,"name":250,"nameZh":6,"description":251,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":235,"licenseFileUrl":252,"sourceHtmlUrl":253,"categories":254,"keywords":259,"publishedAt":57},"01M6AE30BSK2HCY4TQQ22Z8JRD","quality-playbook","Run a complete quality engineering audit on any codebase. Derives behavioral requirements from the code, generates spec-traced functional tests, runs a three-pass code review with regression tests, executes a multi-model spec audit (Council of Three), and produces a consolidated bug report with TDD-verified patches. Finds the 35% of real defects that structural code review alone cannot catch. Works with any language. Trigger on 'quality playbook', 'spec audit', 'Council of Three', 'fitness-to-purpose', or 'coverage theater'.","https:\u002F\u002Fgithub.com\u002Fgithub\u002Fawesome-copilot\u002Fblob\u002Fmain\u002Fskills\u002Fquality-playbook\u002FLICENSE.txt","https:\u002F\u002Fgithub.com\u002Fgithub\u002Fawesome-copilot\u002Fblob\u002Fmain\u002Fskills\u002Fquality-playbook\u002FSKILL.md",[255,258],{"categoryNo":256,"categoryName":257,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000007","代码审查",{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[260,261,262,263,181,129,9,52,264,265,246,54,266,267,268,269,270,271,272,273,274,275,136,276,277,278,279],"playbook","quality playbook","quality","code review","tdd","run","spec","bug report","council","engineering","functional","spec audit","bug","verified","multi-model","three","coverage","model","regression","structural"]