From pii-exposure-checker
Audits AI system data inputs, outputs, training datasets, and pipelines for PII exposure risks under GDPR and EU AI Act Article 10 data governance requirements. Use whenever someone says "check for PII", "audit my data for personal information", "is there personal data in this", "data minimization check", "GDPR data audit", "scan my training data for PII", "flag personal data", "PII exposure risk", "does my dataset contain sensitive data", "check my AI inputs for privacy risks", or "am I processing personal data I shouldn't be". Also trigger when someone is preparing EU AI Act Article 10 compliance for a high-risk AI system, or when a data governance review is needed before model training or deployment. Produces a structured PII exposure report with risk ratings and specific remediation actions for each finding — not just a list of what was found.
How this skill is triggered — by the user, by Claude, or both
Slash command
/pii-exposure-checker:pii-exposure-checkerThe summary Claude sees in its skill listing — used to decide when to auto-load this skill
Audits AI system data — inputs, outputs, training sets, or pipeline descriptions —
Audits AI system data — inputs, outputs, training sets, or pipeline descriptions — for personal data exposure risks. Produces a structured report with risk ratings and remediation actions scoped to GDPR and EU AI Act Article 10 requirements.
Before auditing, understand what is being checked and why. Ask only for what's missing:
What is being audited?
What is the AI system's purpose and deployment context? (Needed to assess whether PII is necessary or excessive for the use case)
What is the legal basis for processing personal data, if known? (Consent, legitimate interest, legal obligation, etc.)
Is this system subject to EU AI Act Article 10?
Article 10 applies to HIGH-RISK AI systems. If risk tier is unconfirmed,
recommend running eu-ai-act-classifier first.
Has a Data Protection Impact Assessment (DPIA) been conducted? (If yes, findings should be consistent with DPIA conclusions)
If the user provides a data sample or schema directly, proceed to Step 2 immediately using what's available.
Always load both reference files before auditing:
references/pii-categories.md — GDPR personal data categories, special categories,
sensitivity tiers, and EU AI Act-specific data types to flagreferences/eu-ai-act-data-requirements.md — Article 10 data governance obligations,
data minimization requirements, and relevance/accuracy standardsreferences/remediation-actions.md — remediation techniques mapped to PII category
and risk level (masking, pseudonymization, deletion, access controls, etc.)Work through the data systematically. For each data element or field identified:
references/pii-categories.md)references/pii-categories.md)references/eu-ai-act-data-requirements.md)For each finding, produce a Finding Block:
┌─────────────────────────────────────────┐
│ FINDING: [field name / data element] │
├─────────────────────────────────────────┤
│ PII Category: [category] │
│ Special Category: [Yes / No] │
│ Risk Level: 🔴 High / 🟡 Medium / 🟢 Low │
│ Necessity: [Necessary / Excessive / Unclear] │
│ Article 10 flag: [Yes / No / N/A] │
│ Issue: [plain-language description of the exposure risk] │
│ Remediation: [specific action — see references/remediation-actions.md] │
└─────────────────────────────────────────┘
After auditing all data elements, output a consolidated report:
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
🔍 PII EXPOSURE REPORT
System / Dataset: [name or description]
Audit scope: [training data / inputs / outputs / pipeline]
Frameworks: GDPR, EU AI Act Article 10
Date: [today]
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
⚠️ ADVISORY NOTICE
───────────────────
This output is generated by an AI skill and is provided for informational and
governance support purposes only. It does not constitute legal advice, regulatory
advice, or a formal compliance determination. Do not rely on this output as a
substitute for advice from qualified legal counsel, a licensed compliance
professional, or a certified auditor. Review all outputs with appropriate human
expertise before taking compliance action.
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
SUMMARY
───────
Total data elements reviewed: [N]
PII elements identified: [N]
🔴 High risk: [N]
🟡 Medium risk: [N]
🟢 Low risk: [N]
Special categories present: [Yes / No]
Data minimization violations: [N]
Article 10 flags (high-risk): [N]
FINDINGS
─────────
[Finding blocks from Step 3, ordered by risk level — high first]
REMEDIATION PRIORITY LIST
──────────────────────────
Priority 1 — Resolve before training / deployment:
• [Action] — [Field] — [Technique]
Priority 2 — Resolve within 30 days:
• [Action] — [Field] — [Technique]
Priority 3 — Address in next review cycle:
• [Action] — [Field] — [Technique]
COMPLIANCE STATUS
──────────────────
GDPR data minimization: [✅ Met / ⚠️ Partial / ❌ Not met]
GDPR special categories: [✅ Met / ⚠️ Requires review / ❌ Not met]
EU AI Act Article 10: [✅ Met / ⚠️ Partial / ❌ Not met / — N/A]
DPIA required: [Yes — trigger now / Likely — recommend / No]
RECOMMENDED NEXT STEPS
────────────────────────
1. [Most urgent action]
2. [Second]
3. [Third]
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
After presenting the report, offer:
.md file for records or DPIA appendixdocx skill for a formatted .docxhitl-compliance-gate with EU AI Act pre-selected if Article 10 flags were raisedreferences/remediation-actions.md for specificsSearches MemPalace before answering questions about past work, people, projects, or prior decisions. Returns verbatim stored content instead of guessing from model memory.
Guides Payload CMS config (payload.config.ts), collections, fields, hooks, access control, APIs. Debugs validation errors, security, relationships, queries, transactions, hook behavior.
Implements vector databases with Pinecone, Weaviate, Qdrant, Milvus, pgvector for semantic search, RAG, recommendations, and similarity systems. Optimizes embeddings, indexing, and hybrid search.
npx claudepluginhub unqdlphn/quirgs --plugin pii-exposure-checker