conducting-gdpr-compliance-assessment

Conduct comprehensive GDPR compliance assessments by evaluating data processing activities against EU Regulation 2016/679, including Article 30 records of processing, lawful basis validation, data subject rights implementation, Data Protection Impact Assessments (DPIAs) under Article 35, breach notification procedures, international transfer safeguards (SCCs, adequacy decisions), and technical/organizational measures under Article 32. Use when processing personal data of EU residents, preparing for supervisory authority audits, implementing privacy-by-design for new systems, scoping compliance gaps for M&A due diligence, assessing third-party processors, or responding to data subject access requests at scale. Incorporates 2026 guidance from ICO, EDPB, and post-Data (Use and Access) Act 2025 UK-GDPR considerations. Do not use for implementing specific Article 32 controls — use implementing-gdpr-data-protection-controls; or for DSAR automation — use implementing-gdpr-data-subject-access-request.

インストールへ移動

リポジトリ: mukul975/Anthropic-Cybersecurity-Skills
ソースの最終更新活動: 2026年8月24日 10:35
検出された SKILL.md の言語: 英語
スター: 31,065
フォーク: 3,698

インストール方法

デフォルトでは、最初にソースを確認する Prompt が選択されています。直接コマンドに切り替えるか、ローカルコピーをダウンロードすることもできます。

Codex または Claude でインストールこの Prompt をコピーして Codex、Claude、または他のアシスタントに貼り付けると、Skill ページを確認してインストールできます。

直接コマンドでは確認用 Prompt が省略されます。実行前にソースを確認してください。

npx skills add https://github.com/mukul975/Anthropic-Cybersecurity-Skills --skill conducting-gdpr-compliance-assessment

コマンドは1行のまま表示されます。コピー前に横へスクロールして全体を確認してください。

ローカルで確認しますか？SkillsMP が現在取得できるファイルをダウンロードできます。

ソースファイルを確認

インストールを決める前に、SKILL.md と SkillsMP に表示されている付属ファイルをお読みください。

ファイルエクスプローラー

9 ファイル

SKILL.md

ソースの指示 · 読み取り専用プレビュー

検索に戻るインストールに戻る

analyzing-kubernetes-audit-logs

Parses Kubernetes API server audit logs (JSON lines) to detect exec-into-pod, secret access, RBAC modifications, privileged pod creation, and anonymous API access, and builds SIEM detection rules from the event patterns. Use when investigating a suspected cluster compromise, reconstructing what an attacker did through the API server, or writing Kubernetes-specific detection content. Keywords: audit policy, audit log, kube-apiserver, exec into pod, RBAC change, anonymous access, detection rules. Do not use for syscall-level detection inside a running container - use detecting-container-runtime-threats-with-falco. '

2026-08-23

auditing-kubernetes-rbac-privilege-escalation

Finds over-permissive RBAC roles and service-account token abuse paths in a Kubernetes cluster using kubectl auth can-i, rbac-police, kubectl-who-can, and rakkess, tracing which subjects can escalate toward cluster-admin. Use when reviewing who can escalate privileges in a cluster, hunting exploitable RoleBindings during an authorized review, or validating least privilege after an RBAC change. Keywords: RBAC, ClusterRoleBinding, service account token, auth can-i, rbac-police, escalate, bind, impersonate. Do not use for designing and applying hardened RBAC - use implementing-rbac-hardening-for-kubernetes.

2026-08-23

benchmarking-kubernetes-with-kube-bench

Installs and runs the kube-bench tool against a Kubernetes cluster as a Job, DaemonSet, or standalone binary, selecting the correct benchmark version and targets (control plane, etcd, kubelet, worker nodes) and emitting JSON or JUnit output for pipelines. Use when setting kube-bench up for the first time, choosing which benchmark version and node targets to run, wiring it into CI, or troubleshooting skipped or misdetected checks. Keywords: kube-bench, DaemonSet, --benchmark, --targets, JSON output, JUnit, CI integration. Do not use for interpreting the findings or producing an audit report - use performing-kubernetes-cis-benchmark-with-kube-bench.

2026-08-23

このリポジトリのすべてを見る

Conducting GDPR Compliance Assessment

Effective Date: August 2026
Legal Basis: EU Regulation 2016/679 (GDPR), UK GDPR as amended by Data Protection Act 2018 and Data (Use and Access) Act 2025 (ukpga/2025/18)
Pending Changes: Digital Omnibus proposal (COM(2025) 837) would change Article 30(5) threshold from 250 to 750 employees and Article 33 breach notification from 72h to 96h. Still in proposal stage; current requirements remain in force.

When to Use

When an organization processes personal data of EU residents (Article 3 territorial scope applies)

When preparing for a supervisory authority audit (ICO, CNIL, BfDI) or responding to formal inquiry

When implementing privacy-by-design requirements (Article 25) for new systems or data flows

When scoping compliance gaps before M&A due diligence or contract negotiations with EU entities

When responding to data subject access requests (DSARs) and discovering gaps in data inventory

When assessing third-party processors for GDPR compliance before signing Data Processing Agreements (DPAs)

After data breach incidents to verify notification procedures meet 72-hour requirement (Article 33)

Do not use for:

Technical implementation of specific GDPR controls (encryption, pseudonymization, access controls) — use implementing-gdpr-data-protection-controls for Article 32 technical/organizational measures

Automated DSAR processing workflows (identity verification, PII discovery, redaction, delivery) — use implementing-gdpr-data-subject-access-request for DSAR automation

Non-EU privacy frameworks alone (CCPA, PIPEDA, LGPD); those require separate assessments with jurisdiction-specific criteria

This skill is for comprehensive compliance assessment across all GDPR articles; use the specialized skills for focused implementation tasks

Prerequisites

Understanding of GDPR Articles 5-32 and key definitions

Access to Article 30 records of processing activities

Data Processing Agreements with third-party processors

Privacy policies, consent forms, cookie notices

Knowledge of lawful bases (Article 6)

Data breach response plan and incident register

List of international data transfers with safeguards

Conducting GDPR Compliance Assessment

When to Use

When an organization processes personal data of EU residents (Article 3 territorial scope applies)

When preparing for a supervisory authority audit (ICO, CNIL, BfDI) or responding to formal inquiry

When implementing privacy-by-design requirements (Article 25) for new systems or data flows

When scoping compliance gaps before M&A due diligence or contract negotiations with EU entities

When responding to data subject access requests (DSARs) and discovering gaps in data inventory

When assessing third-party processors for GDPR compliance before signing Data Processing Agreements (DPAs)

After data breach incidents to verify notification procedures meet 72-hour requirement (Article 33)

Do not use for:

Automated DSAR processing workflows (identity verification, PII discovery, redaction, delivery) — use implementing-gdpr-data-subject-access-request for DSAR automation

Non-EU privacy frameworks alone (CCPA, PIPEDA, LGPD); those require separate assessments with jurisdiction-specific criteria

This skill is for comprehensive compliance assessment across all GDPR articles; use the specialized skills for focused implementation tasks

Prerequisites

Understanding of GDPR Articles 5-32 and key definitions

Access to Article 30 records of processing activities

Data Processing Agreements with third-party processors

Privacy policies, consent forms, cookie notices

Knowledge of lawful bases (Article 6)

Data breach response plan and incident register

List of international data transfers with safeguards

name	conducting-gdpr-compliance-assessment
description	Conduct comprehensive GDPR compliance assessments by evaluating data processing activities against EU Regulation 2016/679, including Article 30 records of processing, lawful basis validation, data subject rights implementation, Data Protection Impact Assessments (DPIAs) under Article 35, breach notification procedures, international transfer safeguards (SCCs, adequacy decisions), and technical/organizational measures under Article 32. Use when processing personal data of EU residents, preparing for supervisory authority audits, implementing privacy-by-design for new systems, scoping compliance gaps for M&A due diligence, assessing third-party processors, or responding to data subject access requests at scale. Incorporates 2026 guidance from ICO, EDPB, and post-Data (Use and Access) Act 2025 UK-GDPR considerations. Do not use for implementing specific Article 32 controls — use implementing-gdpr-data-protection-controls; or for DSAR automation — use implementing-gdpr-data-subject-access-request.
domain	cybersecurity
subdomain	compliance-governance
tags	["gdpr","data-protection","privacy","compliance","dpia","data-subject-rights","article-30","controller","processor","eu-regulation","ico","supervisory-authority"]
version	1.0
author	dakshverma23
license	Apache-2.0
nist_csf	["GV.OC-02","GV.PO-01","GV.RM-04","PR.DS-01","PR.DS-02","ID.AM-05"]
mitre_attack	["T1530","T1567"]

name	conducting-gdpr-compliance-assessment
description	Conduct comprehensive GDPR compliance assessments by evaluating data processing activities against EU Regulation 2016/679, including Article 30 records of processing, lawful basis validation, data subject rights implementation, Data Protection Impact Assessments (DPIAs) under Article 35, breach notification procedures, international transfer safeguards (SCCs, adequacy decisions), and technical/organizational measures under Article 32. Use when processing personal data of EU residents, preparing for supervisory authority audits, implementing privacy-by-design for new systems, scoping compliance gaps for M&A due diligence, assessing third-party processors, or responding to data subject access requests at scale. Incorporates 2026 guidance from ICO, EDPB, and post-Data (Use and Access) Act 2025 UK-GDPR considerations. Do not use for implementing specific Article 32 controls — use implementing-gdpr-data-protection-controls; or for DSAR automation — use implementing-gdpr-data-subject-access-request.
domain	cybersecurity
subdomain	compliance-governance
tags	["gdpr","data-protection","privacy","compliance","dpia","data-subject-rights","article-30","controller","processor","eu-regulation","ico","supervisory-authority"]
version	1.0
author	dakshverma23
license	Apache-2.0
nist_csf	["GV.OC-02","GV.PO-01","GV.RM-04","PR.DS-01","PR.DS-02","ID.AM-05"]
mitre_attack	["T1530","T1567"]

Basis	Use Case	Key Requirement
Consent (6(1)(a))	Marketing, profiling	Freely given, specific, withdrawable
Contract (6(1)(b))	Order fulfillment	Strictly necessary only
Legal Obligation (6(1)(c))	Tax records	Cite specific law
Legitimate Interest (6(1)(f))	Fraud prevention, analytics	Three-part test + balancing

Term	Definition
Controller	Determines purposes and means of processing (Article 4(7))
Processor	Processes on behalf of controller (Article 4(8); requires DPA per Article 28)
Personal Data	Any information relating to identified/identifiable natural person (Article 4(1))
Special Categories	Health, biometric, genetic, racial, political, religious, trade union, sex life data (Article 9; heightened protection)
Consent	Freely given, specific, informed, unambiguous indication of wishes (Article 4(11))
Legitimate Interest	Lawful basis requiring three-part test: purpose, necessity, balancing (Recital 47)
DPIA	Data Protection Impact Assessment for high-risk processing (Article 35)
DPO	Data Protection Officer (Article 37; mandatory for public authorities, large-scale monitoring/special categories)
SCCs	Standard Contractual Clauses for international transfers (Commission Implementing Decision 2021/914)
Supervisory Authority	National data protection regulator (ICO for UK, CNIL for France, BfDI for Germany)

conducting-gdpr-compliance-assessment

インストール方法

ソースファイルを確認