altimate-code: Skill for OpenCode

PII Audit

Requirements

Agent: any (read-only analysis) Tools used: altimate_core_classify_pii, altimate_core_query_pii, schema_detect_pii, schema_inspect, read, glob

When to Use This Skill

Use when the user wants to:

• Scan a database schema for PII columns (SSN, email, phone, name, address, credit card, IP)
• Check if a specific query exposes PII data
• Audit dbt models for PII leakage before production deployment
• Generate a PII inventory for compliance (GDPR, CCPA, HIPAA)

Do NOT use for:

• SQL injection scanning -> use sql-review
• General SQL quality checks -> use sql-review
• Access control auditing -> finops role tools in cost-report

Workflow

1. Classify Schema for PII

Option A — From schema YAML/JSON:

altimate_core_classify_pii(schema_context: <schema_object>)

Analyzes column names, types, and patterns to detect PII categories:

• Direct identifiers: SSN, email, phone, full name, credit card number
• Quasi-identifiers: Date of birth, zip code, IP address, device ID
• Sensitive data: Salary, health records, religious affiliation

Option B — From warehouse connection:

First index the schema, inspect it, then classify:

schema_index(warehouse: <name>)
schema_inspect(warehouse: <name>, database: <db>, schema: <schema>, table: <table>)
schema_detect_pii(warehouse: <name>)

schema_detect_pii scans all indexed columns using pattern matching against the schema cache (requires schema_index to have been run).

2. Check Query PII Exposure

For each query or dbt model, check which PII columns it accesses:

altimate_core_query_pii(sql: <sql>, schema_context: <schema_object>)

Returns:

• Which PII-classified columns are selected, filtered, or joined on
• Risk level per column (HIGH for direct identifiers, MEDIUM for quasi-identifiers)
• Whether PII is exposed in the output (SELECT) vs only used internally (WHERE/JOIN)

3. Audit dbt Models (Batch)

For a full project audit:

glob models/**/*.sql