菜单
Use when auditing privacy, LGPD-oriented governance, consent, terms, privacy policies, retention, deletion, data subject rights, subprocessors, international transfers, and audit evidence. Defensive compliance guidance, not legal advice.
默认使用会先检查来源的 Prompt；你也可以切换为直接命令，或下载本地副本。
决定是否安装前，请先阅读 SKILL.md，以及 SkillsMP 当前展示的配套文件。
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
直接命令不会经过审查 Prompt；运行前请先检查来源。
npx skills add https://github.com/maelrx/skills-aletheia --skill 06-compliance-governance-lgpd命令会保持在同一行。复制前请横向滚动并检查完整内容。
想先保存到本地？可下载 SkillsMP 当前能够提供的文件。
Use before client handoff or production release. Orchestrates frontend security, backend/API security, database security, infrastructure, production operations, compliance, performance, and DevOps into a single go/no-go delivery gate.
Use when auditing or hardening browser-side code in React/Next.js/Vite apps. Checks exposed public env vars, source maps, client-side route protection, localStorage/sessionStorage, CORS/CSP, bundle leakage, and frontend failure states.
Use when auditing or hardening APIs, Next.js API routes, Server Actions, webhooks, and server-side business logic. Checks authentication, authorization, IDOR, input validation, mass assignment, rate limits, timeouts, and safe error handling.
基于 SOC 职业分类
正在显示 SKILL.md
| name | 06-compliance-governance-lgpd |
| description | Use when auditing privacy, LGPD-oriented governance, consent, terms, privacy policies, retention, deletion, data subject rights, subprocessors, international transfers, and audit evidence. Defensive compliance guidance, not legal advice. |
Map and reduce privacy/legal risk in systems that collect, store, process, or share personal data. This skill is practical engineering governance, not legal advice. For regulated or high-risk cases, recommend review by qualified counsel.
Search:
rg -n 'name|email|phone|cpf|document|address|birth|gender|ip|cookie|session|message|prompt|payment|stripe|health|fitness|medical|location|avatar|profile' app pages src server db prisma supabase docs 2>/dev/null
Create a table:
| Data field | Where collected | Where stored | Purpose | Legal basis candidate | Shared with | Retention |
|---|
Apply minimization: if the business purpose does not require the field, recommend removing it.
Sensitive categories need stricter handling. Flag any data related to health, biometrics, children, political opinions, religion, sexuality, ethnicity, union membership, or other high-risk categories.
Search:
rg -n 'consent|terms|privacy|policy|cookie|accept|agree|newsletter|marketing|opt[-_ ]?in|lgpd|legal basis' app pages src docs 2>/dev/null
Required:
Look for documents/pages that explain:
Search:
rg -n 'delete account|export data|download data|privacy request|data request|erase|deletion|portability|rectification|account deletion' app pages src server docs 2>/dev/null
Required capabilities:
Search:
rg -n 'retention|expires_at|deleted_at|soft delete|anonymize|purge|cron|cleanup|archive' app pages src server db prisma supabase docs 2>/dev/null
Required:
Search:
rg -n 'openai|anthropic|stripe|vercel|supabase|sendgrid|resend|analytics|google|meta|hotjar|sentry|posthog|segment|subprocessor|DPA|data processing' package.json app pages src docs .env.example 2>/dev/null
For each third party, record:
Search or recommend tables/artifacts:
consent_records,terms_acceptance,audit_log,# Compliance and Governance Report
Legal note: This is engineering governance support, not legal advice.
## Data inventory
| Field | Purpose | Storage | Sharing | Risk | Recommendation |
|---|---|---|---|---|---|
## Consent and transparency review
## Data subject rights review
## Retention/deletion review
## Third-party/subprocessor review
## Audit evidence gaps
## Findings
| Severity | Evidence | Risk | Fix | Verification |
|---|---|---|---|---|
Stop and escalate for high-risk sensitive data, children’s data, large-scale personal data processing, breach response, legal notices, or production incidents involving personal data.