Can this skill automatically fix privacy issues?

Yes, when used with the --fix flag, the skill can generate consent gates, privacy notice references, and draft implementations for data dashboards.

Is there a STRIDE equivalent for this skill?

No, Unawareness is unique to privacy frameworks like LINDDUN and does not have a direct equivalent in the security-focused STRIDE model.

How does this skill help with GDPR compliance?

It checks for transparency requirements mandated by GDPR, such as ensuring consent is obtained before tracking begins and verifying the existence of data access and deletion endpoints.

What is 'Unawareness' in privacy threat modeling?

Unawareness (LINDDUN Category U) refers to situations where data subjects are not properly informed about how their personal data is collected, processed, or shared, often leading to invalid consent.

Does it support third-party analytics detection?

Yes, it specifically greps for common analytics initializations like Google Tag Manager, Mixpanel, Segment, and others to ensure they are gated by consent.

Privacy Unawareness Analysis

Name: Privacy Unawareness Analysis
Author: florianbuetow

byflorianbuetow

•

Security & Testing

Identifies and audits source code for privacy threats related to undisclosed data collection, missing consent mechanisms, and transparency gaps.

The Privacy Unawareness Analysis skill is designed to help developers and security auditors align their applications with the LINDDUN privacy framework (Category U). It scans source code to detect instances where personal data might be collected, processed, or shared without the user's knowledge. By identifying analytics scripts that initialize before consent, missing data-subject rights endpoints (like 'Right to be Forgotten'), and undisclosed third-party integrations, this skill ensures that applications maintain high transparency standards and comply with regulations like GDPR and CCPA.

Key Features

01Auditing of third-party SDKs and scripts for privacy disclosure gaps.

02Verification of Data Subject Access Request (DSAR) endpoints like export and deletion.

036 GitHub stars

04Identification of missing granular consent controls and cookie management flows.

05Detection of analytics and telemetry initialization before user consent.

06Automated mapping of data collection points to transparency requirements.

Use Cases

01Preparing an application for a formal GDPR, CCPA, or ePrivacy Directive compliance audit.

02Remediating 'dark patterns' that pressure users into broader data collection than necessary.

03Automating privacy-by-design reviews during the CI/CD pipeline to catch tracking leaks.

What are Skills?·How to Install

Install with 🐟 Skill.Fish

npx skillfish add florianbuetow/claude-code unawareness

For use in Claude.ai and ChatGPT

Download Skill