菜单
Use this skill when auditing code changes for GDPR compliance, privacy policy accuracy, data flow verification, or consent mechanism review. Don't use for MDR SaMD compliance (use mdr-compliance-check) or general code review (use code-review).
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
基于 SOC 职业分类
Use this skill when reviewing or auditing the AI insights system prompt for hallucination risk, prompt quality, output reliability, and cost. MDR language is delegated to the mdr-compliance-check skill + mdr-string-check CI. Don't use for general MDR audits (use mdr-compliance-check) or code review (use code-review).
Use this skill when implementing API routes, Supabase integration, authentication, webhooks, database migrations, or server-side functionality. Don't use for UI components (use frontend-feature), bug fixes (use bug-triage), or code review (use code-review).
Use this skill when auditing project dependencies for security vulnerabilities, outdated packages, or unnecessary bloat. Use on a monthly cadence or when a security advisory is reported. Complements the dependency-review CI gate (which only blocks high-severity new deps on PRs) with a proactive audit. Don't use for feature development or bug fixes.
Use this skill when triaging, investigating, or fixing a reported bug. Covers reproduction, root cause analysis, fix implementation, and regression testing. Use when assigned a bug report or when investigating unexpected behavior. Don't use for new features (use backend-feature or frontend-feature) or reviews (use code-review).
Use this skill when implementing UI components, dashboard features, landing page changes, chart visualizations, or client-side functionality. Don't use for API routes or backend work (use backend-feature), bug fixes (use bug-triage), or code review (use code-review).
Use this skill when preparing a release, updating the changelog, or managing the deployment pipeline. Use after a set of features have been merged and are ready for production. Don't use for individual feature PRs or bug fixes.
| name | privacy-audit |
| description | Use this skill when auditing code changes for GDPR compliance, privacy policy accuracy, data flow verification, or consent mechanism review. Don't use for MDR SaMD compliance (use mdr-compliance-check) or general code review (use code-review). |
Verify that code changes comply with GDPR and AirwayLab's privacy architecture.
All core analysis runs client-side in a Web Worker. No data leaves the browser. No network requests for health data. Results persist in localStorage (airwaylab_ prefix, 30-day expiry, 4MB cap).
Users explicitly opt in to: AI-powered insights (sends metrics, never raw waveforms), data contribution (anonymised aggregate metrics to Supabase), premium features behind ailab-beta-2026 gate. Every server interaction requires informed, affirmative consent.
## Privacy Audit
**Verdict:** PASS / FAIL / NEEDS_REVIEW
### Data Flow
- [New data flows identified: yes/no]
- [Consent mechanism present: yes/no]
### Storage
- [New data stores: list with retention + deletion path]
### Third-Party
- [New integrations: list with privacy policy status]
### Recommendations
- [prioritized fixes]