Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add shennawardana23/skillme --skill data-retention-and-privacy-by-designgit clone --depth 1 https://github.com/shennawardana23/skillmeWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/shennawardana23/skillme/data-retention-and-privacy-by-design)<a href="https://agentmods.dev/skills/shennawardana23/skillme/data-retention-and-privacy-by-design"><img src="https://agentmods.dev/badge/skills/shennawardana23/skillme/data-retention-and-privacy-by-design/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/shennawardana23/skillme/data-retention-and-privacy-by-design"><img src="https://agentmods.dev/badge/skills/shennawardana23/skillme/data-retention-and-privacy-by-design.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00109 | $0.01570 |
| Opus 5 | $0.00055 | $0.00785 |
| Sonnet 5 | $0.00022 | $0.00314 |
| Haiku 4.5 | $0.00011 | $0.00157 |
Grade A, and why
data-retention-and-privacy-by-design scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 12d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 128 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Data Retention and Privacy by Design
Privacy decisions made at schema-design time are cheap. The same decisions made after a data breach, a regulator inquiry, or a customer's deletion request are expensive and sometimes impossible (data already replicated to backups, analytics warehouses, and third-party processors). Design for minimal collection and bounded retention from the first migration.
Privacy by Design: 7 foundational principles (Cavoukian)
Ann Cavoukian's framework, adopted explicitly into GDPR (Article 25, "Data protection by design and by default"), gives seven principles. The two with the most day-to-day engineering weight:
- Proactive, not reactive. Privacy risks are addressed before code ships, not patched in after an incident.
- Privacy as the default setting. A user who does nothing gets the most private configuration automatically — opt-in for extra data use, never opt-out.
- Privacy embedded into design. Not a separate compliance layer bolted onto a finished system, but a property of the architecture itself (schema shape, retention jobs, access controls).
- Full functionality — positive-sum. Privacy protections shouldn't be framed as a tradeoff against product functionality; look for designs that deliver both (e.g., store a hashed lookup key instead of the raw value when only equality-matching is needed).
- End-to-end security. Data is protected across its whole lifecycle — collection, transit, storage, and secure deletion — not just at rest.
- Visibility and transparency. Data subjects and auditors can verify what's actually collected and done with data, not just read a privacy policy that describes intended behavior.
- Respect for user privacy. Design choices center the individual's interests, not just the organization's convenience.
GDPR's data minimization principle
GDPR Article 5(1)(c) requires personal data to be "adequate, relevant, and limited to what is necessary" for the stated purpose. In practice this means, for every field you're about to add to a schema:
What ships with it
1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 12d ago First seen · 128 lines · 109 tokens per session scan A 5fd86f7ea622
data-retention-and-privacy-by-design is a skill published in the GitHub repository shennawardana23/skillme (2 stars, last pushed 15d ago), licensed Apache-2.0. It adds 109 tokens to every session and 1,570 once invoked, about $0.0005 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
compliance
A guide to following Xiaohongshu’s platform rules, including content, advertising, intellectual-property, and account-safety requirements. Xiaohongshu is a social platform where users publish and discover lifestyle content.
postgresql-development-cloudbase
Use when building, debugging, or evaluating CloudBase PostgreSQL / CloudBase PG / PG mode apps, including Postgres schema setup, queryPgDatabase/managePgDatabase, JS SDK v3 app.rdb() CRUD/RPC, PG HTTP API fallback, RLS-style permissions, username-password auth, and Web CMS/admin CRUD flows backed by CloudBase PG.
cloudbase-document-database-web-sdk
Use CloudBase document database Web SDK only for confirmed NoSQL collection work. Query, create, update, and delete document data; if the task mentions PostgreSQL / CloudBase PG / app.rdb(), route to postgresql-development instead.
minimal-web-baas-demo
A quick setup path for a small CloudBase web application with a database. CloudBase is a backend service that provides hosting and data storage, while CRUD means creating, reading, updating, and deleting records.
data-model-creation
Sibling CloudBase skills ship beside this skill. Use local relative paths such as ../auth-tool-cloudbase/SKILL.md.
relational-database-web-cloudbase
Sibling CloudBase skills ship beside this skill. Use local relative paths such as ../auth-tool-cloudbase/SKILL.md.