fevra-dev
UserPrivacy engineering suite — nine Claude Code skills plus a citation-backed regulatory taxonomy of 29 jurisdictional and sectoral records, bridged by a statutory dissolution map. Compliance is a floor; selective disclosure is the ceiling.
Categories
Indexed Skills (9)
privacy-suite
Master privacy skill — diagnoses need and routes to the right specialist skill. Use when — user says "privacy", "OPSEC", "anonymity", "am I safe to share this", "what are my risks", "help me stay private", "secure this", "check this before I post/push/send", or "what could someone learn about me"; when the request spans multiple privacy concerns at once; when starting a new project, identity, or pseudonym and unsure where to begin; when something was accidentally exposed and damage control is needed; when preparing any artifact, schema, file, or communication for external use. Routes to — threat-model-privacy (who wants my data and why, risk baseline, adversary profiles), data-minimization (schema/API/OCSF field audits, what to drop/hash/encrypt, GDPR/PIPEDA compliance), opsec-review (inferential leakage audit before sharing — what an adversary can infer, not just what's explicit), redact (strip PII/credentials/wallet addresses from text and code), metadata-hygiene (clean EXIF/document properties/git history
consent-language
Generates legally compliant privacy notices, consent flows, cookie banners, and data subject rights disclosures for products and services. Use when user says "write a privacy policy", "privacy notice", "cookie consent", "GDPR consent flow", "data subject rights page", "at collection notice", "CCPA disclosure", "PIPEDA privacy statement", "opt-in consent copy", "cookie banner text", "legitimate interests notice", "generate consent UI copy", or when launching a product or feature that collects personal data and needs compliant disclosure language. Produces layered notices (short/full), jurisdiction-specific variations, UI copy for consent flows, cookie categorization text, and rights exercise mechanisms. Grounded in GDPR Arts. 13/14, PIPEDA Clause 4.8, CCPA § 1798.100, Quebec Law 25, COPPA, ePrivacy Directive, and PIPL Art. 17.
data-minimization
Audits data schemas, API payloads, database models, event logs, and data pipelines for violations of data minimization principles — collecting, retaining, or exposing more data than necessary for the stated purpose. Use when user shares a schema, data model, API response, event structure, log format, or data flow and asks about privacy, compliance, GDPR, PIPEDA, unnecessary fields, what to drop, what to hash, or how to reduce data surface. Also triggers for OCSF mapping work, SPL/SIEM schema design, on-chain data structure review, and any request to make a data structure "more privacy-friendly", "compliant", or "minimal". Produces field-level findings with drop/hash/encrypt/aggregate remediation recommendations.
metadata-hygiene
Audits and cleans metadata embedded in files before sharing — EXIF in images, author/revision history in documents, GPS in videos/audio, git config real names, archive internal paths, and binary file headers. Use when user says "strip metadata", "clean this file before sharing", "remove EXIF", "scrub this doc", "anonymize this file", "what metadata does this have", "git history cleanup", "remove my name from this", or when preparing any file for external distribution. Operationally distinct from redact (text content) and opsec-review (inference audit) — this skill handles embedded binary and structured metadata in files, not document text.
opsec-review
Red-teams documents, code, READMEs, social posts, commit messages, and paste content for inadvertent operational security leakage before external exposure. Use when user says "review this before I post", "OPSEC check", "is this safe to share", "audit this README", "pre-flight check", "what does this reveal", "check before I push", or when preparing any artifact for public release, GitHub push, social media, client delivery, or external API submission. Distinct from PII redaction — focuses on what an adversary can INFER from context, metadata, structure, and timing signals, not just explicit identifiers.
privacy-impact-assessment
Conducts structured Privacy Impact Assessments (PIA) and Data Protection Impact Assessments (DPIA) in compliance with GDPR Art. 35, Quebec Law 25 Art. 63.5, HIPAA § 164.308(a)(1) risk analysis, and analogous requirements across PIPEDA, LGPD, PIPL, PDPA, and the EU AI Act. Use when user says "PIA", "DPIA", "privacy impact assessment", "data protection impact assessment", "risk analysis for this system", "I need to document privacy risks", "compliance documentation for a new project", "is a DPIA required", "assess privacy risks before launch", or when starting a new product, feature, AI system, or processing activity that involves personal data. Also triggers when user is responding to a regulator, auditor, or client requesting privacy documentation, or when another skill (data-minimization, threat-model-privacy) has produced findings that require formal documentation. Produces a complete, regulator-ready PIA/DPIA document as output.
redact
Sanitizes documents, text, and code by detecting and removing or masking personally identifiable information (PII) and sensitive data before sharing, logging, or passing to external APIs. Use when user says "redact", "sanitize", "anonymize", "remove PII", "scrub this", "clean this before I share it", "hide personal info", or uploads a file they want checked for sensitive data. Also triggers on requests to prepare content for external use, bug reports, logs, or pastes that may contain credentials, wallet addresses, or personal identifiers.
threat-model-privacy
Conducts structured IC-methodology personal and project-level privacy threat modeling. Produces adversary profiles, asset inventories, attack surface maps, confidence-graded risk assessments, and tiered mitigation plans. Use when user says "threat model", "model my threats", "what are my risks", "who would target me", "privacy risk assessment", "OPSEC plan", "am I a target", "what should I be protecting", "security posture review", or when starting a new project, identity, or operational context that warrants a structured risk baseline. Also triggers for relationship-context threat modeling (stalking, coercive control, harassment scenarios).
privacy-architecture
Selects and applies cryptographic primitives for privacy-by-design — systems where selective disclosure is structural, not procedural. Use when user says "build this with privacy built in", "how do I avoid collecting identity", "zero-knowledge proof for this", "anonymous credential", "can I prove X without revealing Y", "stealth address", "blind signature", "private transaction", "MPC", "homomorphic encryption", "differential privacy for analytics", "TEE", "can I verify without seeing the data", or when designing a new system, protocol, or product and wants privacy to be architectural rather than a policy layer added afterward. The Cypherpunk layer of the privacy suite — implements Eric Hughes' (1993) selective disclosure principle and Timothy May's (1988) anonymous transaction system program using contemporary cryptographic primitives. Distinct from all other privacy skills — those audit and repair; this one builds.
Bio shown is the top-scored skill's repo description as a fallback — real GitHub bios land in a future update.