ai-tooling-data-flow-reviewerlisted

# ai-tooling-data-flow-reviewer The skill that answers "if we wire AI tool X into system Y, where does our regulated data end up?" Specialized for AI integrations because the data flow is non-obvious (inference happens off-org-network) and the controls are different (content exclusion + residency vs traditional network egress). ## When to use - New AI tool integration proposed (Copilot knowledge base, internal LLM gateway, Cursor on regulated repo, MCP server enabling agentic actions). - Existing AI integration adds a new data source. - AI tool vendor announces a new data-handling feature (e.g., residency change, new context-loading path). - Pre-CAB review for any AI-related change. ## When NOT to use - Generic data-flow review without AI angle → `secure-design-reviewer`. - AI tool selection / vendor evaluation → [`vendor-security-eval`](../vendor-security-eval/SKILL.md). - Specific Copilot policy question → `copilot-faq-answerer`. ## Workflow 1. **Identify the integration scope**: components, source data, destination. 2. **Build the data-flow diagram** (ASCII): every hop from data source through AI tool to consumer. 3. **Per-hop classification**: at each hop, what data classification crosses? Does it cross a trust boundary? What's the control at that hop? 4. **Cross-reference vault facts**: check Copilot data-residency posture, content exclusion config, audit log path, IP indemnity scope — does the org's existing posture cover this flow's claims? 5. **Find the gaps**: