Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/ericrisco/rsc-harness/data-policynpx skills add ericrisco/rsc-harness --skill data-policygit clone --depth 1 https://github.com/ericrisco/rsc-harnessWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/ericrisco/rsc-harness/data-policy)<a href="https://agentmods.dev/skills/ericrisco/rsc-harness/data-policy"><img src="https://agentmods.dev/badge/skills/ericrisco/rsc-harness/data-policy.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00088 | $0.02966 |
| Opus 5 | $0.00044 | $0.01483 |
| Sonnet 5 | $0.00018 | $0.00593 |
| Haiku 4.5 | $0.00009 | $0.00297 |
Grade A, and why
data-policy scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 6d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 151 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Data policy
You produce the structured governance artifacts engineering and ops implement — a retention schedule, a lawful-basis register, a Record of Processing Activities (ROPA), a consent model — not the public-facing notice users read (that is ../gdpr-privacy/SKILL.md). You are not a DPO and you never claim to be one.
A retention rule is only real when it has all four parts: a concrete period, the lawful basis, the expiry action, and the system where deletion actually runs. A policy that names a period but never deletes anything is a paper policy — and a paper policy is precisely what regulators fine. Cumulative GDPR fines hit ~EUR 5.65B across ~2,245 actions by March 2025, and the two failures that recur are no systematic data classification and no automated deletion capability (Secure Privacy / CMS Enforcement Tracker, 2025). Every schedule you emit ends with the DPO/counsel sign-off boundary below.
First move: which artifact does the operator need?
Map the request to one artifact before writing anything. Each routes to a section.
| Operator says | Artifact | Go to |
|---|---|---|
| "How long do we keep X / write our retention policy" | Retention schedule | Build the retention schedule |
| "Is our basis consent or legitimate interest?" | Lawful-basis register | Pick the lawful basis |
| "Set up a ROPA / Article 30 record" | ROPA row | The ROPA |
| "Design consent capture / withdrawal" | Consent matrix | Consent model |
| "Auto-delete but keep legal holds / backups still have data" | Deletion workflow | Make it real in systems |
If they want the public privacy notice, DPA clauses, or SOC 2 readiness instead, stop and route them — see the boundary below.
Build the retention schedule
This is the core artifact. For every category of personal data, walk five columns in order: data category -> purpose -> lawful basis -> retention period -> expiry action -> system of record. GDPR's storage-limitation principle (Art. 5(1)(e)) requires data be held in identifiable form no longer than necessary for the purpose it was collected for; GDPR sets no fixed periods — duration is driven by purpose plus sector law (gdpr-info.eu Art. 5; Usercentrics, 2026).
What ships with it
5 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 6d ago First seen · 151 lines · 88 tokens per session scan A 30feeec194a2
data-policy is a skill published in the GitHub repository ericrisco/rsc-harness (64 stars, last pushed 3d ago), licensed MIT. It adds 88 tokens to every session and 2,966 once invoked, about $0.0004 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
implementing-gdpr-data-protection-controls
The General Data Protection Regulation (EU) 2016/679 (GDPR) is the EU's comprehensive data protection law governing the collection, processing, storage, and transfer of personal data. This skill cover.
gdpr-expert
Expert in GDPR compliance, data protection, privacy by design, consent management, DPO responsibilities, and EU data regulations. Use when the user mentions privacy, data protection, compliance, consent, a DPO, or eu regulation, or when the task involves GDPR Fundamentals, Key Principles, Data Subject Rights, or…
Data Retention Schedule Review
Use when reviewing a draft or existing data retention schedule to inventory data categories against stated purposes, collect retention-period facts, flag legal-hold interactions, and surface orphaned-data and vendor-coverage gaps for attorney review.
privacy-compliance
Use this skill when implementing GDPR or CCPA compliance, designing consent management, conducting DPIAs, or managing data processing agreements. Triggers on GDPR, CCPA, data privacy, consent management, DPIA, data subject rights, privacy policy, cookie consent, and any task requiring privacy regulation compliance or…
GDPR Compliance Testing
Testing GDPR compliance requirements including data deletion, consent management, data portability, right to erasure, and privacy policy enforcement.
consent-management-marketing
Email consent management in Marketing Cloud: configuring Subscription Centers, building Preference Centers on CloudPages, enforcing CAN-SPAM and GDPR requirements, and handling opt-out propagation. Trigger keywords: unsubscribe handling, CAN-SPAM compliance, GDPR consent tracking, publication lists, subscription…