Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add kensaurus/cursor-kenji --skill plan-privacy-compliancegit clone --depth 1 https://github.com/kensaurus/cursor-kenjiWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/kensaurus/cursor-kenji/plan-privacy-compliance)<a href="https://agentmods.dev/skills/kensaurus/cursor-kenji/plan-privacy-compliance"><img src="https://agentmods.dev/badge/skills/kensaurus/cursor-kenji/plan-privacy-compliance/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/kensaurus/cursor-kenji/plan-privacy-compliance"><img src="https://agentmods.dev/badge/skills/kensaurus/cursor-kenji/plan-privacy-compliance.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00061 | $0.01567 |
| Opus 5 | $0.00030 | $0.00783 |
| Sonnet 5 | $0.00012 | $0.00313 |
| Haiku 4.5 | $0.00006 | $0.00157 |
Grade A, and why
plan-privacy-compliance scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 5d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 148 lines — stays where its author put it; the contents beside it link to each section on GitHub.
plan-privacy-compliance — Data-flow & legal-surface plan
Degree of freedom: HIGH — interpretive inventory and plan. Stay plan-only. T4 before presenting the burndown.
Role: Privacy engineer (operational compliance, not legal advice).
Task: Map what the code collects, diff it against the written policy and
store labels, emit plan-privacy-compliance.md. Audit & plan only — no policy
rewrites, SDK gates, or deletion jobs until each phase is approved.
The gap that sinks apps is collection-vs-claimed: the code gathers more than the privacy policy admits, and the store label is wrong.
Not legal advice. This operationalizes common GDPR and Japan APPI (個人情報保護法) requirements into engineering findings. Flag genuine ambiguity for a lawyer.
This skill vs neighbors
| Skill | Owns |
|---|---|
| plan-privacy-compliance (this) | Data inventory, consent timing, deletion/export, store labels |
audit-analytics |
Event taxonomy + whether analytics fires before consent |
plan-mobile-readiness |
Submission mechanics (demo account, 2.5.2) — not the data-flow diff |
plan-rls-audit |
Who can read rows — not what you promised to collect |
plan-error-handling |
PII in Sentry/logs |
enhance-email-deliverability |
Lawful send / unsubscribe (consent to mail) |
Do not fire for "privacy manifest / Data Safety form paperwork only" if the
user is mid-store-submit → still run this for the data-flow half, then
plan-mobile-readiness for the rest.
How to reason (every plan item)
- Propose — what must change (policy, SDK gate, deletion path, label)
- Risk — what stays non-compliant or leaking if we skip it
- Keep-working — collection that is already disclosed and gated
- Phase — P0 / P1 / P2 (do not execute)
Worked example
Propose: delay PostHog init until consent; add account-deletion that reaches Sentry + the analytics project. Risk: GDPR consent-after-fire + incomplete erasure (PII in traces). Keep-working: essential auth cookies already disclosed. Phase: P0 — consent timing + deletion completeness. Execute-via:
audit-analytics(event gate) +plan-error-handling(logs).
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 5d ago First seen · 148 lines · 61 tokens per session scan A 9047a2b757dd
plan-privacy-compliance is a skill published in the GitHub repository kensaurus/cursor-kenji (9 stars, last pushed 11d ago), licensed MIT. It adds 61 tokens to every session and 1,567 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.
Other skills, from other repositories
meta-ad-policy-checker
Pre-flight policy check for Meta ads. Takes ad copy plus advertiser context, resolves and fetches the relevant Meta transparency-center policy pages at runtime, and returns a Pass / Fix Required / Block verdict with cited findings and rewrites.
810-regulations-eu-mifid-ii
Use when reviewing Java enterprise evidence for MiFID II investment services, investment activities, client classification, suitability, appropriateness, order-handling evidence, best-execution evidence, algorithmic-trading governance evidence, market-access governance evidence, transaction evidence, record keeping…
811-regulations-eu-market-abuse-regulation
Use when reviewing, designing, or modifying Java enterprise systems that may support EU Market Abuse Regulation concerns, market surveillance, suspicious order and transaction reports, insider dealing controls, unlawful disclosure controls, market manipulation detection, inside information disclosure workflows…
812-regulations-eu-product-liability-directive
Use when reviewing, designing, or modifying Java enterprise software products, AI-enabled products, RAG assistants, AI agents, generated instructions, related services, automated updates, vulnerability handling, corrective updates, warnings, instructions, or product-safety evidence under Directive (EU) 2024/2853, the…
801-regulations-eu-ai-act
Use when reviewing, designing, or modifying Java enterprise systems that use AI, LLMs, AI agents, RAG, tool calling, workflow automation, or model-based decision support and need EU AI Act regulatory awareness. This should trigger for requests such as Review a Java AI system for EU AI Act controls; Design governance…
802-regulations-dora
Use when reviewing, designing, or modifying Java enterprise systems that may support financial entities, critical ICT services, third-party ICT provider integrations, or operational resilience obligations under DORA. This should trigger for requests such as Review a Java platform for DORA ICT risk controls; Design…