Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add joaoguirunas/team-os --skill security-privacy-data-mapgit clone --depth 1 https://github.com/joaoguirunas/team-osWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/joaoguirunas/team-os/security-privacy-data-map)<a href="https://agentmods.dev/skills/joaoguirunas/team-os/security-privacy-data-map"><img src="https://agentmods.dev/badge/skills/joaoguirunas/team-os/security-privacy-data-map/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/joaoguirunas/team-os/security-privacy-data-map"><img src="https://agentmods.dev/badge/skills/joaoguirunas/team-os/security-privacy-data-map.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00088 | $0.00891 |
| Opus 5.5 | $0.00035 | $0.00356 |
| Sonnet 5.5 | $0.00018 | $0.00178 |
| Haiku 4.5 | $0.00009 | $0.00089 |
Grade A, and why
security-privacy-data-map scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 9d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 51 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Mapa técnico de dados pessoais
Você não protege dado que não encontrou. Este mapa é técnico: onde o dado pessoal está no código, no banco, nos logs e nos terceiros, e por onde ele sai. A base legal e o registro jurídico são da squad Legal (legal-compliance), quando instalada — este mapa alimenta o dela.
1. Onde procurar (todos, não só o banco)
Tabelas e colunas · Storage (arquivos enviados) · logs de aplicação e de erro (Sentry, console do servidor, Vercel) · eventos de analytics (GA4, PostHog, Meta Pixel) · e-mail transacional e CRM · provedores de IA (o que vai no prompt) · webhooks enviados · backups · planilhas exportadas.
# Colunas com cara de dado pessoal nas migrations
grep -rniE "\b(nome|name|email|e_mail|telefone|phone|whatsapp|cpf|cnpj|rg|endereco|address|cep|nascimento|birth|ip_address)\b" --include='*.sql' --exclude-dir=node_modules .
# Dado pessoal indo para log ou analytics
grep -rnE "console\.(log|error)|logger\.|gtag\(|posthog\.capture|fbq\(" --include='*.[jt]s' --include='*.[jt]sx' --exclude-dir=node_modules --exclude-dir=.next . | grep -iE "email|phone|whatsapp|cpf|nome|name|user\b"
2. O mapa
docs/smart-memory/agents/security/privacy/data-map.md — nota viva:
| Campo (categoria) | Onde mora | Quem lê | Para onde vai | Finalidade | Retenção | Caminho de exclusão |
|---|---|---|---|---|---|---|
| e-mail do lead | leads.email |
painel interno (service_role) | CRM via webhook | contato comercial | 24 meses | delete em leads + exclusão no CRM |
Categorias, nunca o dado em si: "e-mail do lead", não um e-mail real.
Campo sem finalidade escrita é recomendação de não coletar. Finalidade e base legal ficam em branco para a squad Legal preencher quando não houver resposta técnica.
3. Regras no código
- Minimizar na coleta: cada campo do formulário precisa de finalidade. Sem finalidade, sai do formulário — é o dado mais barato de proteger.
- Consentimento aplicado onde o dado é usado: opt-out de analytics bloqueia o envio do evento no código, não só grava uma flag.
- Nada de dado pessoal em log, URL ou evento de analytics (e-mail em query string vai parar no log de todo servidor do caminho).
- Prompt de IA: só o dado necessário para a tarefa; nunca documento inteiro "para dar contexto".
- Anonimizado é afirmação a provar: tirar o nome não anonimiza se CEP + data de nascimento + gênero reidentificam.
- Retenção é automática: job de exclusão ou arquivamento, não lembrete.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 9d ago First seen · 51 lines · 88 tokens per session scan A d16ad3985bce
security-privacy-data-map is a skill published in the GitHub repository joaoguirunas/team-os (4 stars, last pushed 2d ago), licensed MIT. It adds 88 tokens to every session and 891 once invoked, about $0.0004 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-10-08.
Other skills, from other repositories
bankvertrag-sparkassen-bauvertrag-vob
Für AGB im Bankvertrag Sparkassen und Banken: ordnet Norm, Beweislast und Gegenargument; Ergebnis: Prüfprodukt mit Risiko und nächstem Schritt. Fachgebiet: AGB-Recht-Prüfer. Route: bankvertrag-sparkassen-bauvertrag-vob.
kaltstart-triage
Ordnet vorgelegte AGB, Vertragsfassungen und Korrespondenz einem konkreten Prüf-, Entwurfs-, Verhandlungs- oder Streitauftrag zu. Liefert einen belegten Erstbefund und führt nur in die für das Ergebnis benötigten Fachprüfungen.
formvorgaben-anzeigen-erklaerungen-309
Für Formvorgaben Anzeigen Erklärungen 309: ordnet Norm, Beweislast und Gegenargument; Ergebnis: Prüfprodukt mit Risiko und nächstem Schritt.
agb-und-cookie-einwilligung-dsgvo
Für AGB und Cookie Einwilligung DSGVO: ordnet Norm, Beweislast und Gegenargument; Ergebnis: Prüfprodukt mit Risiko und nächstem Schritt.
abnahme-testing
Für Abnahme Testing: ordnet Norm, Beweislast und Gegenargument; Ergebnis: Prüfprodukt mit Risiko und nächstem Schritt.
agb-und-ipr-art-6-rom-i-verbraucher
Für AGB und Ipr Art 6 Rom I Verbraucher: ordnet Norm, Beweislast und Gegenargument; Ergebnis: Prüfprodukt mit Risiko und nächstem Schritt. Fachgebiet: AGB-Recht-Prüfer. Route: agb-und-ipr-art-6-rom-i-verbraucher.