Borrowing it
Nothing to install: this file belongs to doncheli/don-cheli-sdd. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/doncheli/don-cheli-sdd/main/.agent/skills/doncheli-data-policy/SKILL.mdgit clone --depth 1 https://github.com/doncheli/don-cheli-sddWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/doncheli/don-cheli-sdd/doncheli-data-policy)<a href="https://agentmods.dev/skills/doncheli/don-cheli-sdd/doncheli-data-policy"><img src="https://agentmods.dev/badge/skills/doncheli/don-cheli-sdd/doncheli-data-policy/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/doncheli/don-cheli-sdd/doncheli-data-policy"><img src="https://agentmods.dev/badge/skills/doncheli/don-cheli-sdd/doncheli-data-policy.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 1 finding, up to high
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- high Tool Misuse · line 43 Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).Fix: Validate all tool parameters against an allowlist. Reject dangerous parameter values (shell=True, --force, -rf /) and use safe defaults.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00054 | $0.00467 |
| Opus 5 | $0.00027 | $0.00234 |
| Sonnet 5 | $0.00011 | $0.00093 |
| Haiku 4.5 | $0.00005 | $0.00047 |
Grade A, and why
doncheli-data-policy scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 12d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
What it actually says
Don Cheli: Data Policy Auditor
Instructions
- Scan the codebase for PII and sensitive data patterns:
- Database models / schemas for fields like email, phone, name, address, IP, location
- API request/response payloads
- Logging statements that may capture sensitive fields
- Third-party integrations that receive user data
- Build a data inventory table: field name, model, purpose, retention, shared with
- Check against common compliance requirements:
- GDPR: lawful basis, right to erasure, data minimization
- CCPA: disclosure, opt-out
- SOC2: access controls, encryption at rest/transit
- Flag violations as [critical | warning | info]
- Generate a draft Privacy Notice section if requested (
--generate-notice) - Save the audit to
.dc/data-policy-audit-<date>.md - Never make assumptions about compliance status — only report findings and flag gaps
Output Format
## Data Policy Audit — 2026-03-28
### Data Inventory
| Field | Model | Purpose | Retention | Shared With |
|-----------|-----------|---------------|-----------|----------------|
| email | User | Auth, comms | Indefinite| SendGrid, Auth0|
| ip_address| AuditLog | Security | 90 days | Internal only |
### Compliance Gaps
🔴 CRITICAL: ip_address logged in plain text in audit_logs — encrypt or hash
🟡 WARNING: No data retention policy enforced for User.email — GDPR Art. 5(e)
🟢 INFO: No right-to-erasure endpoint found — required for GDPR compliance
### Recommendations
1. Add @Encrypted() decorator to ip_address field
2. Implement DELETE /users/:id endpoint that purges all PII
3. Document data retention in Privacy Policy
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 12d ago First seen · 46 lines · 54 tokens per session scan A ad36ca008c10
doncheli-data-policy is a skill published in the GitHub repository doncheli/don-cheli-sdd (57 stars, last pushed 1mo ago), licensed Apache-2.0. It adds 54 tokens to every session and 467 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
negotiator
Negotiation analyst for high-stakes deals: co-founder exits, business separations, contract terms, salary negotiations, investor terms. Use when the user asks to: (1) analyze a counterparty's position or message, (2) score/review a draft message before sending, (3) draft a counter-offer, (4) structure BATNA/ZOPA…
autonomous
Run multiple phases hands-free. Chains discuss, plan, build, and verify automatically.
quick
Execute an ad-hoc task with atomic commits. Skips full plan/review.
audit
Review past Claude Code sessions for PBR workflow compliance and UX quality.
debug
Systematic debugging with hypothesis testing. Persistent across sessions.
explore
Explore ideas, think through approaches, and route insights to the right artifacts.