Privacy check

Skill haabe/mycelium/plugins/mycelium/skills/privacy-check

AI made building cheap. It didn't make deciding cheap. Mycelium is a Claude Code harness that makes your agent run discovery and weigh evidence before it writes code. It earns the right to start. Built for software, courses, AI tools, and services.

Install

npx -y skills add haabe/mycelium --skill privacy-check

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

What its author says it does

Copied from the file, not written here

Use to assess Privacy by Design compliance and GDPR/data protection alignment for a feature or system.

SKILL.md

3.4 KB, as published. Nobody here has run it

Privacy Check Skill

Privacy by Design assessment.

Workflow

7 Foundational Principles (Cavoukian)

Proactive not Reactive: Are privacy measures built in from the start?
- Privacy considered in design phase, not bolted on
- Risks identified before implementation
Privacy as Default: Is the most private option the default?
- Data collection opt-in, not opt-out
- Minimum data collected by default
- Sharing disabled by default
Privacy Embedded in Design: Is privacy integral to the system?
- Privacy controls are core features, not add-ons
- Architecture supports data minimization
Positive-Sum, not Zero-Sum (originally "Full Functionality"): Privacy without trade-offs?
- Privacy features don't degrade user experience
- Not a false choice between privacy and functionality
- Avoid false dichotomies: privacy vs. security, privacy vs. business value
End-to-End Security: Data protected throughout its lifecycle?
- Encryption at rest and in transit
- Secure deletion when no longer needed
- Access controls throughout the data lifecycle
Visibility and Transparency: Is data processing transparent?
- Users know what data is collected and why
- Processing purposes documented and communicated
- Third-party sharing disclosed
Respect for User Privacy: Are user interests centered?
- Users can access their data
- Users can correct their data
- Users can delete their data
- Consent is informed, specific, and revocable

Data Protection Assessment

What data is collected? List all personal data fields.
Why? Lawful basis for each data element.
How long? Retention period for each data type.
Who accesses it? List all parties with access.
Where is it stored? Data residency and cross-border transfers.
How is it protected? Encryption, access control, monitoring.
What if breached? Incident response plan exists?

Output

## Privacy Assessment: [Feature/System]

### PbD Principles
| Principle | Status | Notes |
|-----------|--------|-------|
| Proactive | Pass/Fail | ... |
| Default privacy | Pass/Fail | ... |
| Embedded | Pass/Fail | ... |
| Full functionality | Pass/Fail | ... |
| End-to-end security | Pass/Fail | ... |
| Transparency | Pass/Fail | ... |
| User respect | Pass/Fail | ... |

### Data Inventory
| Data | Purpose | Basis | Retention | Protection |
|------|---------|-------|-----------|-----------|
| ... | ... | ... | ... | ... |

### Risks and Recommendations
1. [risk and recommended action]

Decision Log (MANDATORY per G-P4)

APPEND a ### Privacy Assessment entry to .claude/harness/decision-log.md with: principles assessed, data flows identified, risks found, GDPR compliance status.

Theory Citations

Cavoukian: Privacy by Design (7 principles)
GDPR: Data protection regulation

Keep looking

Skills are one crate of 328,083. Ordering is by how many stacks a row turns up in, so the top of any crate is what has actually been picked rather than what has the most stars.