[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6AFZXDJZQ9EABKAC2Y5DXRB":3,"skill-same:01M6AFZXDJZQ9EABKAC2Y5DXRB":130},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":31,"publishedAt":52,"linkOnly":53,"markdownContent":54,"markdownBody":55,"frontMatter":56,"refName":73,"commitSha":74,"skillDirectory":75,"forksCount":76,"repositoryHtmlUrl":77,"repositoryHomepageUrl":78,"ownerHtmlUrl":79,"ownerBlogUrl":80,"ownerDescription":81,"updatedAt":82,"install":83,"resources":96},"01M6AFZXDJZQ9EABKAC2Y5DXRB","performing-privacy-impact-assessment",null,"Automates the Privacy Impact Assessment (PIA) workflow including data flow mapping, privacy risk scoring matrices, GDPR Article 35 DPIA and CCPA\u002FCPRA alignment checks, data inventory cataloging, and remediation tracking. Implements the NIST Privacy Framework PRAM methodology and ICO DPIA guidance for systematic identification and mitigation of privacy risks across processing activities. Use when conducting privacy assessments for new systems, evaluating regulatory compliance posture, or building automated privacy governance programs.","mukul975\u002FAnthropic-Cybersecurity-Skills","mukul975","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42860185?v=4","01M6ADEQR8T5M4EEG6C67BQCWF","Mahipal","01M6ADJPMYWG1E5GM1FWBE3128",35884,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-privacy-impact-assessment\u002FSKILL.md",[18,23,28],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发","SCENARIO","使用场景",{"categoryNo":24,"categoryName":25,"taxonomyType":26,"taxonomyTypeDesc":27},"01JBSEEDCAT000000000000033","数据分析师","PROFESSION","适用职业",{"categoryNo":29,"categoryName":30,"taxonomyType":26,"taxonomyTypeDesc":27},"01JBSEEDCAT000000000000037","律师与法务",[32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51],"performing privacy impact assessment","assessment","privacy","remediation","data-flow-mapping","impact-assessment","inventory","risk","t1059","t1078","ico","dpia","cybersecurity","NIST","data","flow","framework","pr","risk scoring","workflow","2026-11-10 10:12:30",false,"---\nname: performing-privacy-impact-assessment\ndescription: 'Automates the Privacy Impact Assessment (PIA) workflow including data\n  flow mapping, privacy risk scoring matrices, GDPR Article 35 DPIA and CCPA\u002FCPRA\n  alignment checks, data inventory cataloging, and remediation tracking. Implements\n  the NIST Privacy Framework PRAM methodology and ICO DPIA guidance for systematic\n  identification and mitigation of privacy risks across processing activities. Use\n  when conducting privacy assessments for new systems, evaluating regulatory compliance\n  posture, or building automated privacy governance programs.\n\n  '\ndomain: cybersecurity\nsubdomain: privacy-compliance\ntags:\n- privacy\n- impact-assessment\n- GDPR\n- CCPA\n- NIST\n- DPIA\n- data-flow-mapping\n- risk-scoring\nversion: '1.0'\nauthor: mukul975\nlicense: Apache-2.0\nnist_csf:\n- GV.PO-01\n- PR.DS-01\n- GV.OC-05\nmitre_attack:\n- T1078\n- T1190\n- T1059\n---\n\n# Performing Privacy Impact Assessment\n\n## When to Use\n\n- When launching a new system, product, or processing activity that handles personal data\n- When conducting GDPR Article 35 Data Protection Impact Assessments (DPIAs)\n- When evaluating CCPA\u002FCPRA compliance for data processing operations\n- When performing privacy risk assessments aligned to the NIST Privacy Framework\n- When mapping data flows across organizational boundaries and third-party processors\n- When building automated privacy governance and assessment pipelines\n- When preparing for regulatory audits or demonstrating accountability obligations\n\n## Prerequisites\n\n- Familiarity with GDPR, CCPA\u002FCPRA, and NIST Privacy Framework concepts\n- Access to data processing inventories and system architecture documentation\n- Python 3.8+ with required dependencies installed\n- Appropriate authorization from the Data Protection Officer (DPO) or privacy team\n- Knowledge of organizational data flows and third-party processor relationships\n\n## Instructions\n\n### Phase 1: Data Inventory and Processing Activity Catalog\n\nBuild a complete inventory of personal data processing activities. Each record of\nprocessing activity (ROPA) entry must capture the data categories, legal basis,\nretention periods, and data subjects involved.\n\n```python\nfrom agent import PrivacyImpactAssessmentEngine\n\nengine = PrivacyImpactAssessmentEngine()\n\n# Register a processing activity for assessment\nactivity = engine.register_processing_activity(\n    name=\"Customer Analytics Platform\",\n    description=\"Collects browsing behavior and purchase history for personalization\",\n    data_controller=\"Acme Corp\",\n    data_processor=\"CloudAnalytics Inc\",\n    data_categories=[\"browsing_history\", \"purchase_records\", \"ip_address\", \"device_id\"],\n    data_subjects=[\"customers\", \"website_visitors\"],\n    legal_basis=\"consent\",\n    retention_period_days=730,\n    cross_border_transfer=True,\n    transfer_destinations=[\"US\", \"IN\"],\n    automated_decision_making=True,\n)\nprint(f\"Registered activity: {activity['activity_id']}\")\n```\n\n### Phase 2: Data Flow Mapping\n\nMap all data flows from collection to deletion, identifying every touchpoint,\ntransformation, and storage location. This reveals hidden privacy risks in data\nmovement across systems.\n\n```python\n# Build the data flow map\nflow_map = engine.map_data_flows(\n    activity_id=activity[\"activity_id\"],\n    flows=[\n        {\n            \"stage\": \"collection\",\n            \"source\": \"Web browser cookie + form submission\",\n            \"destination\": \"CDN edge server\",\n            \"data_elements\": [\"ip_address\", \"device_id\", \"browsing_history\"],\n            \"encryption_in_transit\": True,\n            \"protocol\": \"TLS 1.3\",\n        },\n        {\n            \"stage\": \"processing\",\n            \"source\": \"CDN edge server\",\n            \"destination\": \"Analytics data warehouse (US-East)\",\n            \"data_elements\": [\"browsing_history\", \"purchase_records\", \"device_id\"],\n            \"encryption_in_transit\": True,\n            \"encryption_at_rest\": True,\n            \"protocol\": \"mTLS\",\n        },\n        {\n            \"stage\": \"storage\",\n            \"source\": \"Analytics data warehouse\",\n            \"destination\": \"S3 encrypted bucket\",\n            \"data_elements\": [\"browsing_history\", \"purchase_records\"],\n            \"encryption_at_rest\": True,\n            \"retention_days\": 730,\n            \"access_controls\": \"IAM role-based, MFA required\",\n        },\n        {\n            \"stage\": \"sharing\",\n            \"source\": \"Analytics data warehouse\",\n            \"destination\": \"Third-party ML provider (IN)\",\n            \"data_elements\": [\"browsing_history\", \"purchase_records\"],\n            \"encryption_in_transit\": True,\n            \"data_processing_agreement\": True,\n            \"cross_border\": True,\n        },\n        {\n            \"stage\": \"deletion\",\n            \"source\": \"S3 bucket + data warehouse\",\n            \"destination\": \"Secure erasure\",\n            \"method\": \"Cryptographic erasure + lifecycle policy\",\n            \"verification\": \"Automated deletion audit log\",\n        },\n    ],\n)\nengine.render_data_flow_diagram(flow_map)\n```\n\n### Phase 3: Privacy Risk Assessment with Scoring Matrix\n\nApply a structured risk scoring methodology evaluating likelihood and impact\nacross multiple privacy risk dimensions. The matrix aligns with both the\nNIST PRAM and ICO DPIA risk assessment approaches.\n\n```python\n# Run the risk assessment\nrisk_report = engine.assess_privacy_risks(\n    activity_id=activity[\"activity_id\"],\n    assessment_type=\"full_dpia\",\n)\n\n# Display risk matrix results\nfor risk in risk_report[\"risks\"]:\n    print(f\"[{risk['severity']}] {risk['category']}: {risk['description']}\")\n    print(f\"  Likelihood: {risk['likelihood']}\u002F5 | Impact: {risk['impact']}\u002F5 | Score: {risk['risk_score']}\u002F25\")\n    print(f\"  Mitigation: {risk['recommended_mitigation']}\")\n```\n\nRisk categories evaluated include:\n1. **Data Minimization** -- Excessive collection beyond stated purpose\n2. **Purpose Limitation** -- Secondary use without legal basis\n3. **Cross-Border Transfer** -- Transfers without adequate safeguards (SCCs, BCRs)\n4. **Automated Decision Making** -- Profiling without human oversight or appeal\n5. **Data Subject Rights** -- Inability to fulfill access\u002Ferasure\u002Fportability requests\n6. **Third-Party Risk** -- Processor compliance gaps, subprocessor chains\n7. **Security Controls** -- Encryption, access control, breach response gaps\n8. **Retention** -- Storing data beyond necessity or legal requirement\n9. **Consent Management** -- Invalid or ambiguous consent mechanisms\n10. **Breach Notification** -- Inability to detect and notify within 72 hours (GDPR)\n\n### Phase 4: GDPR and CCPA\u002FCPRA Alignment Checks\n\nRun automated compliance checks against specific regulatory requirements.\nThe engine maps each processing activity against article-level GDPR obligations\nand CCPA\u002FCPRA consumer rights requirements.\n\n```python\n# GDPR compliance check\ngdpr_report = engine.check_gdpr_compliance(activity_id=activity[\"activity_id\"])\nprint(f\"GDPR Score: {gdpr_report['compliance_score']}\u002F100\")\nfor finding in gdpr_report[\"findings\"]:\n    print(f\"  [{finding['status']}] Art.{finding['article']}: {finding['description']}\")\n\n# CCPA\u002FCPRA compliance check\nccpa_report = engine.check_ccpa_compliance(activity_id=activity[\"activity_id\"])\nprint(f\"CCPA Score: {ccpa_report['compliance_score']}\u002F100\")\nfor finding in ccpa_report[\"findings\"]:\n    print(f\"  [{finding['status']}] Sec.{finding['section']}: {finding['description']}\")\n```\n\n### Phase 5: Remediation Plan and Report Generation\n\nGenerate a prioritized remediation plan with specific action items, responsible\nparties, deadlines, and generate the formal PIA\u002FDPIA report document.\n\n```python\n# Generate remediation plan\nremediation = engine.generate_remediation_plan(\n    activity_id=activity[\"activity_id\"],\n    risk_report=risk_report,\n    gdpr_report=gdpr_report,\n    ccpa_report=ccpa_report,\n)\n\nfor item in remediation[\"action_items\"]:\n    print(f\"[{item['priority']}] {item['action']}\")\n    print(f\"  Owner: {item['owner']} | Deadline: {item['deadline']}\")\n    print(f\"  Addresses: {', '.join(item['addresses_risks'])}\")\n\n# Generate formal DPIA report\nengine.generate_dpia_report(\n    activity_id=activity[\"activity_id\"],\n    output_path=\"dpia_report_customer_analytics.json\",\n    format=\"json\",\n)\nprint(\"[+] DPIA report generated\")\n```\n\n## Examples\n\n### Quick Screening Assessment\n\nDetermine whether a full DPIA is required using the ICO screening checklist:\n\n```python\nengine = PrivacyImpactAssessmentEngine()\n\nscreening = engine.run_screening_checklist(\n    uses_special_category_data=False,\n    large_scale_processing=True,\n    systematic_monitoring=True,\n    automated_decision_making=True,\n    cross_border_transfer=True,\n    vulnerable_data_subjects=False,\n    innovative_technology=True,\n    denial_of_service_or_rights=False,\n)\nprint(f\"DPIA Required: {screening['dpia_required']}\")\nprint(f\"Triggers: {screening['triggers']}\")\n# Output: DPIA Required: True\n# Triggers: ['large_scale_processing', 'systematic_monitoring',\n#            'automated_decision_making', 'cross_border_transfer',\n#            'innovative_technology']\n```\n\n### Batch Assessment of Multiple Processing Activities\n\n```python\nengine = PrivacyImpactAssessmentEngine()\n\nactivities = [\n    {\"name\": \"Email Marketing\", \"data_categories\": [\"email\", \"name\"],\n     \"legal_basis\": \"consent\", \"cross_border_transfer\": False},\n    {\"name\": \"HR Analytics\", \"data_categories\": [\"employee_id\", \"performance_scores\",\n     \"health_data\"], \"legal_basis\": \"legitimate_interest\", \"cross_border_transfer\": True},\n    {\"name\": \"Fraud Detection\", \"data_categories\": [\"transaction_data\", \"ip_address\",\n     \"device_fingerprint\"], \"legal_basis\": \"legitimate_interest\",\n     \"automated_decision_making\": True, \"cross_border_transfer\": False},\n]\n\nfor act_def in activities:\n    activity = engine.register_processing_activity(**act_def)\n    risk = engine.assess_privacy_risks(activity_id=activity[\"activity_id\"])\n    print(f\"{act_def['name']}: Overall Risk={risk['overall_risk_level']} \"\n          f\"({risk['risk_count_by_severity']})\")\n```\n\n### NIST Privacy Framework Profile Mapping\n\n```python\nengine = PrivacyImpactAssessmentEngine()\n\nprofile = engine.generate_nist_privacy_profile(\n    activity_id=activity[\"activity_id\"],\n    target_tier=\"tier_3\",  # Repeatable\n)\n\nfor function_id, outcomes in profile[\"functions\"].items():\n    print(f\"\\n{function_id}:\")\n    for outcome in outcomes:\n        status = \"PASS\" if outcome[\"implemented\"] else \"GAP\"\n        print(f\"  [{status}] {outcome['subcategory']}: {outcome['description']}\")\n```\n","# Performing Privacy Impact Assessment\n\n## When to Use\n\n- When launching a new system, product, or processing activity that handles personal data\n- When conducting GDPR Article 35 Data Protection Impact Assessments (DPIAs)\n- When evaluating CCPA\u002FCPRA compliance for data processing operations\n- When performing privacy risk assessments aligned to the NIST Privacy Framework\n- When mapping data flows across organizational boundaries and third-party processors\n- When building automated privacy governance and assessment pipelines\n- When preparing for regulatory audits or demonstrating accountability obligations\n\n## Prerequisites\n\n- Familiarity with GDPR, CCPA\u002FCPRA, and NIST Privacy Framework concepts\n- Access to data processing inventories and system architecture documentation\n- Python 3.8+ with required dependencies installed\n- Appropriate authorization from the Data Protection Officer (DPO) or privacy team\n- Knowledge of organizational data flows and third-party processor relationships\n\n## Instructions\n\n### Phase 1: Data Inventory and Processing Activity Catalog\n\nBuild a complete inventory of personal data processing activities. Each record of\nprocessing activity (ROPA) entry must capture the data categories, legal basis,\nretention periods, and data subjects involved.\n\n```python\nfrom agent import PrivacyImpactAssessmentEngine\n\nengine = PrivacyImpactAssessmentEngine()\n\n# Register a processing activity for assessment\nactivity = engine.register_processing_activity(\n    name=\"Customer Analytics Platform\",\n    description=\"Collects browsing behavior and purchase history for personalization\",\n    data_controller=\"Acme Corp\",\n    data_processor=\"CloudAnalytics Inc\",\n    data_categories=[\"browsing_history\", \"purchase_records\", \"ip_address\", \"device_id\"],\n    data_subjects=[\"customers\", \"website_visitors\"],\n    legal_basis=\"consent\",\n    retention_period_days=730,\n    cross_border_transfer=True,\n    transfer_destinations=[\"US\", \"IN\"],\n    automated_decision_making=True,\n)\nprint(f\"Registered activity: {activity['activity_id']}\")\n```\n\n### Phase 2: Data Flow Mapping\n\nMap all data flows from collection to deletion, identifying every touchpoint,\ntransformation, and storage location. This reveals hidden privacy risks in data\nmovement across systems.\n\n```python\n# Build the data flow map\nflow_map = engine.map_data_flows(\n    activity_id=activity[\"activity_id\"],\n    flows=[\n        {\n            \"stage\": \"collection\",\n            \"source\": \"Web browser cookie + form submission\",\n            \"destination\": \"CDN edge server\",\n            \"data_elements\": [\"ip_address\", \"device_id\", \"browsing_history\"],\n            \"encryption_in_transit\": True,\n            \"protocol\": \"TLS 1.3\",\n        },\n        {\n            \"stage\": \"processing\",\n            \"source\": \"CDN edge server\",\n            \"destination\": \"Analytics data warehouse (US-East)\",\n            \"data_elements\": [\"browsing_history\", \"purchase_records\", \"device_id\"],\n            \"encryption_in_transit\": True,\n            \"encryption_at_rest\": True,\n            \"protocol\": \"mTLS\",\n        },\n        {\n            \"stage\": \"storage\",\n            \"source\": \"Analytics data warehouse\",\n            \"destination\": \"S3 encrypted bucket\",\n            \"data_elements\": [\"browsing_history\", \"purchase_records\"],\n            \"encryption_at_rest\": True,\n            \"retention_days\": 730,\n            \"access_controls\": \"IAM role-based, MFA required\",\n        },\n        {\n            \"stage\": \"sharing\",\n            \"source\": \"Analytics data warehouse\",\n            \"destination\": \"Third-party ML provider (IN)\",\n            \"data_elements\": [\"browsing_history\", \"purchase_records\"],\n            \"encryption_in_transit\": True,\n            \"data_processing_agreement\": True,\n            \"cross_border\": True,\n        },\n        {\n            \"stage\": \"deletion\",\n            \"source\": \"S3 bucket + data warehouse\",\n            \"destination\": \"Secure erasure\",\n            \"method\": \"Cryptographic erasure + lifecycle policy\",\n            \"verification\": \"Automated deletion audit log\",\n        },\n    ],\n)\nengine.render_data_flow_diagram(flow_map)\n```\n\n### Phase 3: Privacy Risk Assessment with Scoring Matrix\n\nApply a structured risk scoring methodology evaluating likelihood and impact\nacross multiple privacy risk dimensions. The matrix aligns with both the\nNIST PRAM and ICO DPIA risk assessment approaches.\n\n```python\n# Run the risk assessment\nrisk_report = engine.assess_privacy_risks(\n    activity_id=activity[\"activity_id\"],\n    assessment_type=\"full_dpia\",\n)\n\n# Display risk matrix results\nfor risk in risk_report[\"risks\"]:\n    print(f\"[{risk['severity']}] {risk['category']}: {risk['description']}\")\n    print(f\"  Likelihood: {risk['likelihood']}\u002F5 | Impact: {risk['impact']}\u002F5 | Score: {risk['risk_score']}\u002F25\")\n    print(f\"  Mitigation: {risk['recommended_mitigation']}\")\n```\n\nRisk categories evaluated include:\n1. **Data Minimization** -- Excessive collection beyond stated purpose\n2. **Purpose Limitation** -- Secondary use without legal basis\n3. **Cross-Border Transfer** -- Transfers without adequate safeguards (SCCs, BCRs)\n4. **Automated Decision Making** -- Profiling without human oversight or appeal\n5. **Data Subject Rights** -- Inability to fulfill access\u002Ferasure\u002Fportability requests\n6. **Third-Party Risk** -- Processor compliance gaps, subprocessor chains\n7. **Security Controls** -- Encryption, access control, breach response gaps\n8. **Retention** -- Storing data beyond necessity or legal requirement\n9. **Consent Management** -- Invalid or ambiguous consent mechanisms\n10. **Breach Notification** -- Inability to detect and notify within 72 hours (GDPR)\n\n### Phase 4: GDPR and CCPA\u002FCPRA Alignment Checks\n\nRun automated compliance checks against specific regulatory requirements.\nThe engine maps each processing activity against article-level GDPR obligations\nand CCPA\u002FCPRA consumer rights requirements.\n\n```python\n# GDPR compliance check\ngdpr_report = engine.check_gdpr_compliance(activity_id=activity[\"activity_id\"])\nprint(f\"GDPR Score: {gdpr_report['compliance_score']}\u002F100\")\nfor finding in gdpr_report[\"findings\"]:\n    print(f\"  [{finding['status']}] Art.{finding['article']}: {finding['description']}\")\n\n# CCPA\u002FCPRA compliance check\nccpa_report = engine.check_ccpa_compliance(activity_id=activity[\"activity_id\"])\nprint(f\"CCPA Score: {ccpa_report['compliance_score']}\u002F100\")\nfor finding in ccpa_report[\"findings\"]:\n    print(f\"  [{finding['status']}] Sec.{finding['section']}: {finding['description']}\")\n```\n\n### Phase 5: Remediation Plan and Report Generation\n\nGenerate a prioritized remediation plan with specific action items, responsible\nparties, deadlines, and generate the formal PIA\u002FDPIA report document.\n\n```python\n# Generate remediation plan\nremediation = engine.generate_remediation_plan(\n    activity_id=activity[\"activity_id\"],\n    risk_report=risk_report,\n    gdpr_report=gdpr_report,\n    ccpa_report=ccpa_report,\n)\n\nfor item in remediation[\"action_items\"]:\n    print(f\"[{item['priority']}] {item['action']}\")\n    print(f\"  Owner: {item['owner']} | Deadline: {item['deadline']}\")\n    print(f\"  Addresses: {', '.join(item['addresses_risks'])}\")\n\n# Generate formal DPIA report\nengine.generate_dpia_report(\n    activity_id=activity[\"activity_id\"],\n    output_path=\"dpia_report_customer_analytics.json\",\n    format=\"json\",\n)\nprint(\"[+] DPIA report generated\")\n```\n\n## Examples\n\n### Quick Screening Assessment\n\nDetermine whether a full DPIA is required using the ICO screening checklist:\n\n```python\nengine = PrivacyImpactAssessmentEngine()\n\nscreening = engine.run_screening_checklist(\n    uses_special_category_data=False,\n    large_scale_processing=True,\n    systematic_monitoring=True,\n    automated_decision_making=True,\n    cross_border_transfer=True,\n    vulnerable_data_subjects=False,\n    innovative_technology=True,\n    denial_of_service_or_rights=False,\n)\nprint(f\"DPIA Required: {screening['dpia_required']}\")\nprint(f\"Triggers: {screening['triggers']}\")\n# Output: DPIA Required: True\n# Triggers: ['large_scale_processing', 'systematic_monitoring',\n#            'automated_decision_making', 'cross_border_transfer',\n#            'innovative_technology']\n```\n\n### Batch Assessment of Multiple Processing Activities\n\n```python\nengine = PrivacyImpactAssessmentEngine()\n\nactivities = [\n    {\"name\": \"Email Marketing\", \"data_categories\": [\"email\", \"name\"],\n     \"legal_basis\": \"consent\", \"cross_border_transfer\": False},\n    {\"name\": \"HR Analytics\", \"data_categories\": [\"employee_id\", \"performance_scores\",\n     \"health_data\"], \"legal_basis\": \"legitimate_interest\", \"cross_border_transfer\": True},\n    {\"name\": \"Fraud Detection\", \"data_categories\": [\"transaction_data\", \"ip_address\",\n     \"device_fingerprint\"], \"legal_basis\": \"legitimate_interest\",\n     \"automated_decision_making\": True, \"cross_border_transfer\": False},\n]\n\nfor act_def in activities:\n    activity = engine.register_processing_activity(**act_def)\n    risk = engine.assess_privacy_risks(activity_id=activity[\"activity_id\"])\n    print(f\"{act_def['name']}: Overall Risk={risk['overall_risk_level']} \"\n          f\"({risk['risk_count_by_severity']})\")\n```\n\n### NIST Privacy Framework Profile Mapping\n\n```python\nengine = PrivacyImpactAssessmentEngine()\n\nprofile = engine.generate_nist_privacy_profile(\n    activity_id=activity[\"activity_id\"],\n    target_tier=\"tier_3\",  # Repeatable\n)\n\nfor function_id, outcomes in profile[\"functions\"].items():\n    print(f\"\\n{function_id}:\")\n    for outcome in outcomes:\n        status = \"PASS\" if outcome[\"implemented\"] else \"GAP\"\n        print(f\"  [{status}] {outcome['subcategory']}: {outcome['description']}\")\n```\n",{"name":5,"tags":57,"author":9,"domain":44,"license":15,"version":62,"nist_csf":63,"subdomain":67,"description":68,"mitre_attack":69},[34,37,58,59,45,60,36,61],"GDPR","CCPA","DPIA","risk-scoring","1.0",[64,65,66],"GV.PO-01","PR.DS-01","GV.OC-05","privacy-compliance","Automates the Privacy Impact Assessment (PIA) workflow including data flow mapping, privacy risk scoring matrices, GDPR Article 35 DPIA and CCPA\u002FCPRA alignment checks, data inventory cataloging, and remediation tracking. Implements the NIST Privacy Framework PRAM methodology and ICO DPIA guidance for systematic identification and mitigation of privacy risks across processing activities. Use when conducting privacy assessments for new systems, evaluating regulatory compliance posture, or building automated privacy governance programs.\n",[70,71,72],"T1078","T1190","T1059","main","54a798831d2266a3ca61ce68a7acb80b81160d57","skills\u002Fperforming-privacy-impact-assessment",4379,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills","https:\u002F\u002Fmahipal.engineer\u002FAnthropic-Cybersecurity-Skills\u002F","https:\u002F\u002Fgithub.com\u002Fmukul975","Mahipal.engineer","🔐 Cybersecurity | 💻 Dev | 📷 Street Photographer\r\n🎓 MSc | 📚 Research & AI Security","2026-08-31 12:32:44",{"source":8,"skillName":5,"commands":84,"prompt":94,"zipAvailable":95},[85,88,91],{"tool":86,"command":87},"npx","npx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill performing-privacy-impact-assessment",{"tool":89,"command":90},"bunx","bunx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill performing-privacy-impact-assessment",{"tool":92,"command":93},"pnpm","pnpm dlx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill performing-privacy-impact-assessment","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-privacy-impact-assessment\u002FSKILL.md",true,[97,103,108,112,116,120,124],{"path":98,"resourceType":99,"resourceTypeDesc":100,"sizeBytes":101,"sourceHtmlUrl":102},"agents\u002Fopenai.yaml","REFERENCE","参考文档",220,"https:\u002F\u002Fgithub.com\u002Fnoirelab\u002Flinux-setup\u002Fblob\u002Fmain\u002Fconfigs\u002Fcommon\u002Fclaude\u002Fskills\u002Fux-psychic\u002Fagents\u002Fopenai.yaml",{"path":104,"resourceType":104,"resourceTypeDesc":105,"sizeBytes":106,"sourceHtmlUrl":107},"LICENSE","许可证",11255,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-privacy-impact-assessment\u002FLICENSE",{"path":109,"resourceType":99,"resourceTypeDesc":100,"sizeBytes":110,"sourceHtmlUrl":111},"references\u002Fapi-reference.md",7597,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-privacy-impact-assessment\u002Freferences\u002Fapi-reference.md",{"path":113,"resourceType":99,"resourceTypeDesc":100,"sizeBytes":114,"sourceHtmlUrl":115},"references\u002Faudit-scorecard.md",6661,"https:\u002F\u002Fgithub.com\u002Fnoirelab\u002Flinux-setup\u002Fblob\u002Fmain\u002Fconfigs\u002Fcommon\u002Fclaude\u002Fskills\u002Fux-psychic\u002Freferences\u002Faudit-scorecard.md",{"path":117,"resourceType":99,"resourceTypeDesc":100,"sizeBytes":118,"sourceHtmlUrl":119},"references\u002Fprinciples.md",19293,"https:\u002F\u002Fgithub.com\u002Fnoirelab\u002Flinux-setup\u002Fblob\u002Fmain\u002Fconfigs\u002Fcommon\u002Fclaude\u002Fskills\u002Fux-psychic\u002Freferences\u002Fprinciples.md",{"path":121,"resourceType":99,"resourceTypeDesc":100,"sizeBytes":122,"sourceHtmlUrl":123},"references\u002Fvisual-craft.md",4458,"https:\u002F\u002Fgithub.com\u002Fnoirelab\u002Flinux-setup\u002Fblob\u002Fmain\u002Fconfigs\u002Fcommon\u002Fclaude\u002Fskills\u002Fux-psychic\u002Freferences\u002Fvisual-craft.md",{"path":125,"resourceType":126,"resourceTypeDesc":127,"sizeBytes":128,"sourceHtmlUrl":129},"scripts\u002Fagent.py","SCRIPT","脚本",64215,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-privacy-impact-assessment\u002Fscripts\u002Fagent.py",[131,157,181,208,233,257],{"skillNo":132,"name":133,"nameZh":6,"description":134,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":135,"categories":136,"keywords":138,"publishedAt":52},"01M6AGDM3HJXTKXX15ZZ0ZVCJ3","verifying-build-provenance-with-slsa-sigstore","Verifies artifact signatures and SLSA provenance using Sigstore's cosign (verify, verify-attestation, verify-blob-attestation) and slsa-verifier (verify-artifact), enforcing keyless OIDC builder identity and source repo against SLSA Build levels. Use in CI\u002FCD before deploying artifacts, when consuming third-party attestations, establishing a SLSA Build L3 pipeline, or confirming provenance during incident response or admission control.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fverifying-build-provenance-with-slsa-sigstore\u002FSKILL.md",[137],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[139,140,141,142,143,44,144,145,49,146,147,148,149,150,151,152,153,154,155,156],"sigstore","provenance","slsa","verifying build provenance with slsa sigstore","security","incident response","identity","code","artifacts","ci","supply-chain","pipeline","supply-chain-security","t1195","attestation","code-signing","cosign","keyless",{"skillNo":158,"name":159,"nameZh":6,"description":160,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":161,"categories":162,"keywords":164,"publishedAt":52},"01M6AGDGBPWYVZ2F11GFKJ4HZ9","validating-tpm-measured-boot-attestation","Verifies TPM 2.0 measured-boot integrity and remote attestation with tpm2-tools -- reading PCRs (tpm2_pcrread), replaying the boot event log, generating and checking signed quotes (tpm2_quote\u002Ftpm2_checkquote), and sealing secrets to a PCR policy. Use to confirm a system booted trusted firmware\u002Fkernel for Zero Trust device posture, detect boot-chain tampering via PCR drift, or build a golden-value baseline for fleet attestation.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-tpm-measured-boot-attestation\u002FSKILL.md",[163],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[165,153,166,167,143,168,44,49,169,170,171,172,173,174,175,176,177,178,179,180],"boot","TPM","validating tpm measured boot attestation","policy","verification","ZeRO","firmware","Tools","measured-boot","PCR","integrity","secrets","remote-attestation","tpm2-tools","integrity-verification","trusted-computing",{"skillNo":182,"name":183,"nameZh":6,"description":184,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":185,"categories":186,"keywords":191,"publishedAt":52},"01M6AGDCW0Y4FXZ3362GT1941M","validating-backup-integrity-for-recovery","Validates backup integrity through cryptographic hash verification, automated restore testing, corruption detection, and recoverability checks to confirm backups are reliable for disaster recovery and ransomware response. Use before relying on backups for recovery, when building post-backup validation pipelines, auditing backup infrastructure for compliance, or checking immutable\u002Fair-gapped backups for silent corruption or tampering.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-backup-integrity-for-recovery\u002FSKILL.md",[187,190],{"categoryNo":188,"categoryName":189,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000008","测试与质量",{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[175,192,193,194,195,44,196,197,169,198,199,200,201,202,203,41,204,205,206,207],"backup","recovery","validating backup integrity for recovery","testing","infrastructure","validation","compliance","hash-verification","incident-response","ransomware","cryptocurrency","detection","t1490","immutable","disaster-recovery","restore-testing",{"skillNo":209,"name":210,"nameZh":6,"description":211,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":212,"categories":213,"keywords":215,"publishedAt":52},"01M6AGD9GBG2KZ336AE763J3WH","triaging-windows-with-kape","Runs KAPE (Kroll Artifact Parser and Extractor) to collect targeted forensic artifacts (registry hives, $MFT, event logs, prefetch, browser data) via Targets and parse them with Modules wrapping Eric Zimmerman's EZ Tools (PECmd, MFTECmd, RECmd). Use during early incident containment\u002Ftriage when full disk imaging is impractical but a defensible, parseable Windows artifact set is needed quickly, including at-scale remote collection.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-windows-with-kape\u002FSKILL.md",[214],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[216,217,218,44,219,220,221,222,223,224,225,46,226,227,228,229,172,230,231,232],"windows","kape","triaging windows with kape","registry","browser","logs","windows-forensics","dfir","mft","mftecmd","prefetch","eric-zimmerman","digital-forensics","SET","collection","pecmd","artifact-collection",{"skillNo":234,"name":235,"nameZh":6,"description":236,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":237,"categories":238,"keywords":240,"publishedAt":52},"01M6AGD5PW5J4EVZM958WD74ZQ","triaging-vulnerabilities-with-ssvc-framework","Triages and prioritizes vulnerabilities with CISA's Stakeholder-Specific Vulnerability Categorization (SSVC) decision tree, weighing exploitation status (via the CISA KEV catalog and FIRST EPSS API), technical impact, automatability, and mission prevalence to output Track\u002FTrack*\u002FAttend\u002FAct decisions. Use when prioritizing vulnerability scan results (OpenVAS, Nessus, Qualys) for remediation planning beyond raw CVSS scores.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-vulnerabilities-with-ssvc-framework\u002FSKILL.md",[239],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[241,48,242,44,243,244,245,246,247,248,249,250,251,35,39,252,253,254,255,256],"vulnerabilities","triaging vulnerabilities with ssvc framework","status","planning","CISA","vulnerability-management","risk-management","nessus","qualys","openvas","cvss","vulnerability","api","prioritization","ssvc","decision-tree",{"skillNo":258,"name":259,"nameZh":6,"description":260,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":261,"categories":262,"keywords":264,"publishedAt":52},"01M6AGD24TTQQM4CXG69E3B9TJ","triaging-security-incident","Performs initial triage of security incidents using the NIST SP 800-61r3 and SANS PICERL frameworks, classifying incident type, assigning priority by business impact, and routing to the appropriate response team. Use when a SIEM\u002FEDR alert needs human classification, concurrent alerts must be prioritized, or a user report or threat-intel IOC match requires initial incident categorization.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-security-incident\u002FSKILL.md",[263],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[143,265,44,266,267,268,269,270,45,271,272,41,273,204,274,275,276,277,278,279],"triaging security incident","siem","file","ioc","soc","NIST-800-61","severity","edr","execution","analysis","classification","severity-classification","incident-triage","SANS-PICERL","SOC-operations"]