Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add commands/jonase47/ccpr/p1-privacygit clone --depth 1 https://github.com/jonase47/ccprWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/commands/jonase47/ccpr/p1-privacy)<a href="https://agentmods.dev/commands/jonase47/ccpr/p1-privacy"><img src="https://agentmods.dev/badge/commands/jonase47/ccpr/p1-privacy.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00000 | $0.01384 |
| Opus 5 | $0.00000 | $0.00692 |
| Sonnet 5 | $0.00000 | $0.00277 |
| Haiku 4.5 | $0.00000 | $0.00138 |
Grade A, and why
p1-privacy scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured today.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 111 lines — stays where its author put it; the contents beside it link to each section on GitHub.
/p1-privacy – Data Classification & DSGVO Initial Assessment
Conducts a systematic initial assessment of data protection requirements: What personal data is processed, on what legal basis, and what DSGVO (GDPR) obligations arise from this? The result is a well-founded DSGVO initial assessment as a mandatory component of the Concept.
Argument: $ARGUMENTS = [Data type, e.g. "health data", "payment data", "location data"]
If provided: Focus the analysis on the specified data category and its special requirements. If not provided: Read FEATURES.md, USER_JOURNEYS.md and BUSINESS_MODEL.md to determine all processed data categories yourself. If any context is missing, ask for the types of data being processed.
Execution
1. Read Context
Read the following files (if available):
- FEATURES.md (Which functions process data?)
- USER_JOURNEYS.md (What data is generated during usage?)
- BUSINESS_MODEL.md (Which data is relevant to the revenue stream?)
- DISCOVERY.md (Results from
/p0-regulatoryif available)
2. Delegate to security-master Agent (Lead)
Delegate the DSGVO analysis to the security-master agent:
Conduct a DSGVO initial assessment. Focus (if provided): $ARGUMENTS Context from the project files: [Insert features, user journeys, business model]
Create:
A. Data Classification
Data Category Examples Sensitivity DSGVO Category (e.g. contact data) (name, email) Standard Art. 4 No. 1 (e.g. health data) (diagnoses) Particularly sensitive Art. 9 B. Processing Purposes & Legal Bases
- For each purpose: Which legal basis applies? (Art. 6 Para. 1 a–f DSGVO)
- Special categories (Art. 9): Which exception applies?
C. Data Subject Rights
- Access (Art. 15), Rectification (Art. 16), Erasure (Art. 17), Portability (Art. 20)
- What must be technically implemented?
D. Obligations & Measures
- Privacy policy required? (Art. 13/14)
- Data processing agreements (DPA) with third parties?
- Data Protection Impact Assessment (DPIA) required? (Art. 35)
- Record of processing activities (Art. 30)?
E. Risk Assessment
- What data protection risks exist?
- Technical and organisational measures (TOMs) recommended?
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- today Changed · +3 lines e047a809c73a
- 3d ago First seen · 108 lines · 0 tokens per session scan A 1b353c3f74db
p1-privacy is a command published in the GitHub repository jonase47/ccpr (1 stars, last pushed today), licensed MIT. It costs nothing until one of its globs matches a file; then it loads 1,384 tokens. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other commands, from other repositories
python-review
Comprehensive Python code review for PEP 8 compliance, type hints, security, and Pythonic idioms. Invokes the python-reviewer agent.
audit-checklist
Perform an internal audit, review controls, or prepare for an external financial audit.
india-checklist
Interactive non-code compliance checklist — business registration, DPO, GST, CERT-In, grievance officer, and more.
rgpd
Questões de RGPD e violação de dados — referência, playbook e checklist. GDPR and data-breach matters — reference, playbook and checklist.
voice-compliance
Voice/telephony compliance check — invokes voice-ai-reviewer to produce TM-voice-{slug}.md with TCPA, STIR/SHAKEN, state recording-consent, EU AI Act Art. 50, and synth-voice deepfake-law gaps.
arckit.fr-rgpd
You are helping an enterprise architect generate a French CNIL Compliance Assessment — the French-specific GDPR layer applied by the CNIL (Commission Nationale de l'Informatique et des Libertés). Run this after /arckit:eu-rgpd to add French obligations that go beyond the EU GDPR baseline.