How to use the Data Minimisation Auditor agent skill

What the skill makes the agent do

An agent skill is a folder of instructions (a SKILL.md file plus optional reference files) that an agent loads when a task matches its description. This one matches requests about reviewing form components, API payloads or client-side storage for fields that are collected but not used by a stated feature.

When active, the agent looks at form components, API request code, client-side storage and analytics or logging code for personal information such as emails, names or phone numbers. It flags fields that have no clear purpose and suggests removing them, replacing them with pseudonymous IDs, or setting a retention period. The approach is based on the GDPR principle of collecting only what is necessary (Article 5(1)(c)).

• Form fields that are collected but never read by an active feature
• API request bodies carrying personal data the endpoint does not need
• localStorage, sessionStorage and cookie keys that hold personal data without a retention rule
• Analytics or log payloads containing raw emails, names, phone numbers or query strings with PII

How to install the skill

Download the ZIP for this skill from the page you are reading. Then install it in one of these ways:

• Personal use: unzip it into ~/.claude/skills/ so the data-minimisation folder sits there.
• Single project: unzip it into your project's .claude/skills/ folder.
• Claude apps: upload the ZIP under Settings → Capabilities → Skills.

How to trigger the skill with natural requests

You do not need a special command. Describe the review you want in ordinary language, and the agent should pick up the skill because the request matches its description. Naming the kind of code helps: forms, payloads, storage or analytics.

• "Review our signup form for fields we collect but never use."
• "Check the API calls in this app for personal data we don't need to send."
• "Audit our analytics events for raw email addresses or phone numbers."
• "Which localStorage keys store personal data without an expiry?"

Example: reviewing a newsletter form

The skill's reference material uses a newsletter sign-up as a worked example. The over-collecting version asks for first name, last name, phone and date of birth, but the newsletter feature only needs an email address. The minimal version keeps just the field the feature uses.

Expect a similar result from your own code: the agent should point to each field, explain why it appears unused, and propose removal, anonymisation or a retention window.

What the skill needs and how it runs

The skill lists no requirements. It does not run scripts and does not use the network, so it works by reading your code and reporting on it. Because it only reads and reasons about what is in front of it, its output depends on the code and files the agent can see.

• Requires: nothing listed
• Runs scripts: no
• Uses network: no

Limits and tips

This is an engineering checklist, not legal advice. The skill covers code-level data minimisation and does not cover the full legal obligations under GDPR or other laws. Treat its findings as a starting point for a developer review, and involve a lawyer or data protection officer for compliance sign-off.

• Give it the whole relevant path: form component, the function that sends it, and the storage it writes to.
• Ask about one feature at a time for more focused findings.
• Check every suggested removal against what the business actually uses before deleting data.
• It is not useful for projects with no forms, API payloads or client-side storage.