[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6AF45F34RC5H67D6EF3D0FQ":3,"skill-same:01M6AF45F34RC5H67D6EF3D0FQ":116},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":26,"publishedAt":38,"linkOnly":39,"markdownContent":40,"markdownBody":41,"frontMatter":42,"refName":47,"commitSha":48,"skillDirectory":49,"forksCount":50,"repositoryHtmlUrl":51,"repositoryHomepageUrl":6,"ownerHtmlUrl":52,"ownerBlogUrl":53,"ownerDescription":54,"updatedAt":55,"install":56,"resources":69},"01M6AF45F34RC5H67D6EF3D0FQ","saas-vendor-inventory",null,"SaaS vendor data processing inventory management. Covers shadow IT discovery, API-based data flow detection, processing purpose mapping, contract status tracking, and continuous inventory reconciliation for cloud service providers.","mukul975\u002FPrivacy-Data-Protection-Skills","mukul975","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42860185?v=4","01M6ADEQR8T5M4EEG6C67BQCWF","Mahipal","01M6ADNKWX1HF4Q5DKEXT5M774",337,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fplugins\u002Fprivacy-skills-complete\u002Fskills\u002Fsaas-vendor-inventory\u002FSKILL.md",[18,23],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000033","数据分析师","PROFESSION","适用职业",{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000037","律师与法务",[27,28,29,30,31,32,33,34,35,36,37],"saas","saas vendor inventory","status","cloud","services","privacy","flow","data","detection","shadow-IT","Providers","2026-11-10 10:12:30",false,"---\nname: saas-vendor-inventory\ndescription: >-\n  SaaS vendor data processing inventory management. Covers shadow IT discovery,\n  API-based data flow detection, processing purpose mapping, contract status\n  tracking, and continuous inventory reconciliation for cloud service providers.\nlicense: Apache-2.0\nmetadata:\n  author: mukul975\n  version: \"1.0\"\n  domain: privacy\n  subdomain: vendor-privacy-management\n  tags: \"saas-inventory, shadow-it, data-flow-detection, vendor-register, cloud-services\"\n---\n\n# SaaS Vendor Data Processing Inventory\n\n## Overview\n\nModern organizations rely on dozens to hundreds of SaaS applications, many of which process personal data. GDPR Article 30 requires controllers to maintain records of processing activities, which includes documenting all processors. Shadow IT — SaaS applications adopted by business units without formal procurement or privacy review — creates significant compliance risk because unrecorded processing cannot be properly governed.\n\nThe EDPB Guidelines 07\u002F2020 emphasize that controllers cannot claim ignorance of processing performed by vendors they engage, even if the engagement happened informally. Summit Cloud Partners maintains a comprehensive SaaS Vendor Data Processing Inventory to track all cloud services processing personal data, including those discovered through shadow IT detection.\n\n## Inventory Framework\n\n### Tier 1: Sanctioned SaaS — Formally Procured\n\nApplications that have gone through formal procurement, privacy review, and DPA execution.\n\n| Field | Description |\n|-------|-------------|\n| Vendor name | Legal entity name |\n| Product\u002Fservice name | SaaS product name |\n| Category | CRM, HR, Analytics, Communication, DevOps, etc. |\n| Business owner | Department and named individual |\n| Procurement date | When the service was contracted |\n| DPA status | Executed \u002F In negotiation \u002F Not required |\n| DPA reference | DPA document reference number |\n| Privacy review status | Completed \u002F In progress \u002F Pending |\n| Risk tier | Per vendor risk scoring model |\n| Personal data categories | What personal data is processed |\n| Data subjects | Whose data is processed |\n| Processing purposes | Why data is processed |\n| Processing locations | Where data is stored\u002Fprocessed |\n| Integration method | SSO, API, manual upload, etc. |\n| Data flow direction | Inbound \u002F Outbound \u002F Bidirectional |\n| Contract expiry | When the contract term ends |\n| Auto-renewal date | When auto-renewal triggers |\n| Annual cost | Total annual spend |\n| License count | Number of active users\u002Fseats |\n\n### Tier 2: Known Unsanctioned — Shadow IT Detected\n\nApplications detected through discovery tools that lack formal procurement or privacy review.\n\n| Field | Description |\n|-------|-------------|\n| Application name | As detected |\n| Detection method | CASB, DNS, expense, SSO log, etc. |\n| Detection date | When first observed |\n| Usage scope | Estimated users and frequency |\n| Likely data categories | Inferred from application type |\n| Risk assessment | Preliminary risk level |\n| Remediation status | Under review \u002F Sanctioning in progress \u002F Blocked \u002F Accepted |\n| Business unit | Department(s) using the application |\n\n### Tier 3: Evaluated and Excluded\n\nApplications evaluated and determined to not process personal data.\n\n| Field | Description |\n|-------|-------------|\n| Application name | Product name |\n| Evaluation date | When reviewed |\n| Determination | No personal data processing |\n| Rationale | Why excluded from inventory |\n| Next review date | When to re-evaluate |\n\n## Shadow IT Discovery Methods\n\n### Method 1: Cloud Access Security Broker (CASB)\n\nDeploy a CASB solution to monitor network traffic and identify cloud service usage.\n\n**Detection Capabilities:**\n- SaaS application identification via API call pattern matching\n- User activity monitoring across sanctioned and unsanctioned services\n- Data transfer volume estimation\n- Risk scoring of discovered applications\n\n**Implementation at Summit Cloud Partners:**\n\n| Component | Detail |\n|-----------|--------|\n| CASB vendor | Deployed as inline proxy and API connector |\n| Coverage | All corporate network egress and managed endpoints |\n| Discovery scope | HTTP\u002FHTTPS traffic to known SaaS domains |\n| Update frequency | Real-time discovery, weekly consolidated reporting |\n| Integration | Feeds into SaaS inventory system via API |\n\n### Method 2: DNS and Firewall Log Analysis\n\nAnalyze DNS resolution logs and firewall traffic logs to identify connections to SaaS providers.\n\n**Process:**\n1. Aggregate DNS query logs from internal resolvers\n2. Match resolved domains against SaaS provider domain databases\n3. Cross-reference with sanctioned vendor list\n4. Flag unmatched SaaS domains for investigation\n\n### Method 3: SSO and Identity Provider Logs\n\nReview identity provider (IdP) logs for OAuth consent grants and SAML integrations.\n\n**Detection Signals:**\n- OAuth application consent grants not in approved list\n- SAML service provider registrations\n- OpenID Connect client registrations\n- API token generation for third-party services\n\n### Method 4: Expense and Procurement Analysis\n\nReview corporate expense reports and credit card statements for SaaS subscriptions.\n\n**Detection Signals:**\n- Recurring charges to known SaaS providers\n- Expense claims categorized as \"software\" or \"subscriptions\"\n- Purchase order requests for cloud services bypassing IT procurement\n\n### Method 5: API Integration Audit\n\nScan internal systems for outbound API connections to third-party services.\n\n**Detection Signals:**\n- Outbound API calls to non-sanctioned endpoints\n- Webhook configurations sending data to external services\n- Integration platform (Zapier, Workato, etc.) connections\n- Custom script connections to third-party APIs\n\n## Data Flow Mapping\n\nFor each sanctioned SaaS vendor, document the complete data flow:\n\n```\nData Flow Template:\n\nSummit Cloud Partners Internal Systems\n         │\n         ├─► [SaaS Application Name]\n         │     │\n         │     ├─ Integration: [SSO\u002FAPI\u002FManual Upload\u002FBrowser Plugin]\n         │     ├─ Authentication: [SAML SSO \u002F OAuth 2.0 \u002F Username-Password]\n         │     ├─ Encryption in transit: [TLS version]\n         │     ├─ Data categories sent: [list]\n         │     ├─ Data categories received: [list]\n         │     ├─ Data categories stored by vendor: [list]\n         │     ├─ Vendor processing locations: [locations]\n         │     ├─ Vendor sub-processors: [per sub-processor register]\n         │     ├─ Data retention at vendor: [period]\n         │     └─ Data deletion capability: [Yes\u002FNo — method]\n         │\n         └─► [Next SaaS Application]\n```\n\n## Inventory Reconciliation\n\n### Quarterly Reconciliation Process\n\n| Step | Activity | Responsible |\n|------|----------|-------------|\n| 1 | Extract current CASB discovery report | InfoSec |\n| 2 | Extract current sanctioned vendor list | Privacy Team |\n| 3 | Compare: identify new unsanctioned applications | Privacy Team |\n| 4 | Compare: identify sanctioned apps no longer in use | Privacy Team |\n| 5 | Verify DPA status for all sanctioned vendors | Privacy Team |\n| 6 | Check contract expiry dates (90-day lookahead) | Legal\u002FProcurement |\n| 7 | Update inventory records | Privacy Team |\n| 8 | Report to DPO | Privacy Team Lead |\n\n### Reconciliation Outcomes\n\n| Finding | Action |\n|---------|--------|\n| New unsanctioned SaaS discovered | Initiate shadow IT remediation workflow |\n| Sanctioned SaaS no longer in use | Initiate vendor termination data workflow |\n| DPA expired or missing | Expedite DPA execution or service suspension |\n| Contract approaching expiry | Trigger renewal privacy review |\n| Data processing scope change detected | Initiate DPA amendment review |\n\n## Contract Status Tracking\n\n| Status | Definition | Action Required |\n|--------|-----------|-----------------|\n| **Active — Compliant** | Contract active, DPA executed, privacy review current | Standard monitoring |\n| **Active — DPA Pending** | Contract active, DPA in negotiation | Expedite DPA; restrict data sharing if > 30 days |\n| **Active — Review Overdue** | Contract active, privacy review past due | Schedule immediate review |\n| **Expiring (\u003C 90 days)** | Contract approaching expiry | Initiate renewal assessment |\n| **Expired** | Contract term ended | Initiate termination data workflow |\n| **Suspended** | Service suspended pending privacy issue resolution | Track resolution |\n| **Terminated** | Contract terminated, data return\u002Fdeletion in progress | Track deletion certification |\n\n## Key Regulatory References\n\n- GDPR Article 30(1)(d) — Controller ROPA must include categories of recipients (processors)\n- GDPR Article 28(1) — Use only processors with sufficient guarantees\n- GDPR Article 5(2) — Accountability principle — must document all processing relationships\n- GDPR Article 24 — Controller responsibility for demonstrating compliance\n- EDPB Guidelines 07\u002F2020 — Controller knowledge of processing operations\n- EDPB Guidelines 04\u002F2019 — Data Protection by Design and by Default (privacy in procurement)\n","# SaaS Vendor Data Processing Inventory\n\n## Overview\n\nModern organizations rely on dozens to hundreds of SaaS applications, many of which process personal data. GDPR Article 30 requires controllers to maintain records of processing activities, which includes documenting all processors. Shadow IT — SaaS applications adopted by business units without formal procurement or privacy review — creates significant compliance risk because unrecorded processing cannot be properly governed.\n\nThe EDPB Guidelines 07\u002F2020 emphasize that controllers cannot claim ignorance of processing performed by vendors they engage, even if the engagement happened informally. Summit Cloud Partners maintains a comprehensive SaaS Vendor Data Processing Inventory to track all cloud services processing personal data, including those discovered through shadow IT detection.\n\n## Inventory Framework\n\n### Tier 1: Sanctioned SaaS — Formally Procured\n\nApplications that have gone through formal procurement, privacy review, and DPA execution.\n\n| Field | Description |\n|-------|-------------|\n| Vendor name | Legal entity name |\n| Product\u002Fservice name | SaaS product name |\n| Category | CRM, HR, Analytics, Communication, DevOps, etc. |\n| Business owner | Department and named individual |\n| Procurement date | When the service was contracted |\n| DPA status | Executed \u002F In negotiation \u002F Not required |\n| DPA reference | DPA document reference number |\n| Privacy review status | Completed \u002F In progress \u002F Pending |\n| Risk tier | Per vendor risk scoring model |\n| Personal data categories | What personal data is processed |\n| Data subjects | Whose data is processed |\n| Processing purposes | Why data is processed |\n| Processing locations | Where data is stored\u002Fprocessed |\n| Integration method | SSO, API, manual upload, etc. |\n| Data flow direction | Inbound \u002F Outbound \u002F Bidirectional |\n| Contract expiry | When the contract term ends |\n| Auto-renewal date | When auto-renewal triggers |\n| Annual cost | Total annual spend |\n| License count | Number of active users\u002Fseats |\n\n### Tier 2: Known Unsanctioned — Shadow IT Detected\n\nApplications detected through discovery tools that lack formal procurement or privacy review.\n\n| Field | Description |\n|-------|-------------|\n| Application name | As detected |\n| Detection method | CASB, DNS, expense, SSO log, etc. |\n| Detection date | When first observed |\n| Usage scope | Estimated users and frequency |\n| Likely data categories | Inferred from application type |\n| Risk assessment | Preliminary risk level |\n| Remediation status | Under review \u002F Sanctioning in progress \u002F Blocked \u002F Accepted |\n| Business unit | Department(s) using the application |\n\n### Tier 3: Evaluated and Excluded\n\nApplications evaluated and determined to not process personal data.\n\n| Field | Description |\n|-------|-------------|\n| Application name | Product name |\n| Evaluation date | When reviewed |\n| Determination | No personal data processing |\n| Rationale | Why excluded from inventory |\n| Next review date | When to re-evaluate |\n\n## Shadow IT Discovery Methods\n\n### Method 1: Cloud Access Security Broker (CASB)\n\nDeploy a CASB solution to monitor network traffic and identify cloud service usage.\n\n**Detection Capabilities:**\n- SaaS application identification via API call pattern matching\n- User activity monitoring across sanctioned and unsanctioned services\n- Data transfer volume estimation\n- Risk scoring of discovered applications\n\n**Implementation at Summit Cloud Partners:**\n\n| Component | Detail |\n|-----------|--------|\n| CASB vendor | Deployed as inline proxy and API connector |\n| Coverage | All corporate network egress and managed endpoints |\n| Discovery scope | HTTP\u002FHTTPS traffic to known SaaS domains |\n| Update frequency | Real-time discovery, weekly consolidated reporting |\n| Integration | Feeds into SaaS inventory system via API |\n\n### Method 2: DNS and Firewall Log Analysis\n\nAnalyze DNS resolution logs and firewall traffic logs to identify connections to SaaS providers.\n\n**Process:**\n1. Aggregate DNS query logs from internal resolvers\n2. Match resolved domains against SaaS provider domain databases\n3. Cross-reference with sanctioned vendor list\n4. Flag unmatched SaaS domains for investigation\n\n### Method 3: SSO and Identity Provider Logs\n\nReview identity provider (IdP) logs for OAuth consent grants and SAML integrations.\n\n**Detection Signals:**\n- OAuth application consent grants not in approved list\n- SAML service provider registrations\n- OpenID Connect client registrations\n- API token generation for third-party services\n\n### Method 4: Expense and Procurement Analysis\n\nReview corporate expense reports and credit card statements for SaaS subscriptions.\n\n**Detection Signals:**\n- Recurring charges to known SaaS providers\n- Expense claims categorized as \"software\" or \"subscriptions\"\n- Purchase order requests for cloud services bypassing IT procurement\n\n### Method 5: API Integration Audit\n\nScan internal systems for outbound API connections to third-party services.\n\n**Detection Signals:**\n- Outbound API calls to non-sanctioned endpoints\n- Webhook configurations sending data to external services\n- Integration platform (Zapier, Workato, etc.) connections\n- Custom script connections to third-party APIs\n\n## Data Flow Mapping\n\nFor each sanctioned SaaS vendor, document the complete data flow:\n\n```\nData Flow Template:\n\nSummit Cloud Partners Internal Systems\n         │\n         ├─► [SaaS Application Name]\n         │     │\n         │     ├─ Integration: [SSO\u002FAPI\u002FManual Upload\u002FBrowser Plugin]\n         │     ├─ Authentication: [SAML SSO \u002F OAuth 2.0 \u002F Username-Password]\n         │     ├─ Encryption in transit: [TLS version]\n         │     ├─ Data categories sent: [list]\n         │     ├─ Data categories received: [list]\n         │     ├─ Data categories stored by vendor: [list]\n         │     ├─ Vendor processing locations: [locations]\n         │     ├─ Vendor sub-processors: [per sub-processor register]\n         │     ├─ Data retention at vendor: [period]\n         │     └─ Data deletion capability: [Yes\u002FNo — method]\n         │\n         └─► [Next SaaS Application]\n```\n\n## Inventory Reconciliation\n\n### Quarterly Reconciliation Process\n\n| Step | Activity | Responsible |\n|------|----------|-------------|\n| 1 | Extract current CASB discovery report | InfoSec |\n| 2 | Extract current sanctioned vendor list | Privacy Team |\n| 3 | Compare: identify new unsanctioned applications | Privacy Team |\n| 4 | Compare: identify sanctioned apps no longer in use | Privacy Team |\n| 5 | Verify DPA status for all sanctioned vendors | Privacy Team |\n| 6 | Check contract expiry dates (90-day lookahead) | Legal\u002FProcurement |\n| 7 | Update inventory records | Privacy Team |\n| 8 | Report to DPO | Privacy Team Lead |\n\n### Reconciliation Outcomes\n\n| Finding | Action |\n|---------|--------|\n| New unsanctioned SaaS discovered | Initiate shadow IT remediation workflow |\n| Sanctioned SaaS no longer in use | Initiate vendor termination data workflow |\n| DPA expired or missing | Expedite DPA execution or service suspension |\n| Contract approaching expiry | Trigger renewal privacy review |\n| Data processing scope change detected | Initiate DPA amendment review |\n\n## Contract Status Tracking\n\n| Status | Definition | Action Required |\n|--------|-----------|-----------------|\n| **Active — Compliant** | Contract active, DPA executed, privacy review current | Standard monitoring |\n| **Active — DPA Pending** | Contract active, DPA in negotiation | Expedite DPA; restrict data sharing if > 30 days |\n| **Active — Review Overdue** | Contract active, privacy review past due | Schedule immediate review |\n| **Expiring (\u003C 90 days)** | Contract approaching expiry | Initiate renewal assessment |\n| **Expired** | Contract term ended | Initiate termination data workflow |\n| **Suspended** | Service suspended pending privacy issue resolution | Track resolution |\n| **Terminated** | Contract terminated, data return\u002Fdeletion in progress | Track deletion certification |\n\n## Key Regulatory References\n\n- GDPR Article 30(1)(d) — Controller ROPA must include categories of recipients (processors)\n- GDPR Article 28(1) — Use only processors with sufficient guarantees\n- GDPR Article 5(2) — Accountability principle — must document all processing relationships\n- GDPR Article 24 — Controller responsibility for demonstrating compliance\n- EDPB Guidelines 07\u002F2020 — Controller knowledge of processing operations\n- EDPB Guidelines 04\u002F2019 — Data Protection by Design and by Default (privacy in procurement)\n",{"name":5,"license":15,"metadata":43,"description":7},{"tags":44,"author":9,"domain":32,"version":45,"subdomain":46},"saas-inventory, shadow-it, data-flow-detection, vendor-register, cloud-services","1.0","vendor-privacy-management","main","9b2ef9eae161c00a17241d42a388571321b33e9f","plugins\u002Fprivacy-skills-complete\u002Fskills\u002Fsaas-vendor-inventory",68,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills","https:\u002F\u002Fgithub.com\u002Fmukul975","Mahipal.engineer","🔐 Cybersecurity | 💻 Dev | 📷 Street Photographer\r\n🎓 MSc | 📚 Research & AI Security","2026-03-17 04:06:52",{"source":8,"skillName":5,"commands":57,"prompt":67,"zipAvailable":68},[58,61,64],{"tool":59,"command":60},"npx","npx skills add mukul975\u002FPrivacy-Data-Protection-Skills --skill saas-vendor-inventory",{"tool":62,"command":63},"bunx","bunx skills add mukul975\u002FPrivacy-Data-Protection-Skills --skill saas-vendor-inventory",{"tool":65,"command":66},"pnpm","pnpm dlx skills add mukul975\u002FPrivacy-Data-Protection-Skills --skill saas-vendor-inventory","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fplugins\u002Fprivacy-skills-complete\u002Fskills\u002Fsaas-vendor-inventory\u002FSKILL.md",true,[70,76,82,86,90,94,98,104,108,112],{"path":71,"resourceType":72,"resourceTypeDesc":73,"sizeBytes":74,"sourceHtmlUrl":75},"assets\u002Ftemplate.md","ASSET","资产文件",3007,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fplugins\u002Fprivacy-skills-complete\u002Fskills\u002Fsaas-vendor-inventory\u002Fassets\u002Ftemplate.md",{"path":77,"resourceType":78,"resourceTypeDesc":79,"sizeBytes":80,"sourceHtmlUrl":81},"references\u002Fllm_integration_guide.md","REFERENCE","参考文档",1421,"https:\u002F\u002Fgithub.com\u002Fshengdabai\u002FTony-Claude-Code-Skills\u002Fblob\u002Fmain\u002Fskills\u002Frsmdt-the-startup\u002Falirezarezvani-claude-skills\u002Fengineering-team\u002Fsenior-ml-engineer\u002Freferences\u002Fllm_integration_guide.md",{"path":83,"resourceType":78,"resourceTypeDesc":79,"sizeBytes":84,"sourceHtmlUrl":85},"references\u002Fmlops_production_patterns.md",1429,"https:\u002F\u002Fgithub.com\u002Fshengdabai\u002FTony-Claude-Code-Skills\u002Fblob\u002Fmain\u002Fskills\u002Frsmdt-the-startup\u002Falirezarezvani-claude-skills\u002Fengineering-team\u002Fsenior-ml-engineer\u002Freferences\u002Fmlops_production_patterns.md",{"path":87,"resourceType":78,"resourceTypeDesc":79,"sizeBytes":88,"sourceHtmlUrl":89},"references\u002Frag_system_architecture.md",1425,"https:\u002F\u002Fgithub.com\u002Fshengdabai\u002FTony-Claude-Code-Skills\u002Fblob\u002Fmain\u002Fskills\u002Frsmdt-the-startup\u002Falirezarezvani-claude-skills\u002Fengineering-team\u002Fsenior-ml-engineer\u002Freferences\u002Frag_system_architecture.md",{"path":91,"resourceType":78,"resourceTypeDesc":79,"sizeBytes":92,"sourceHtmlUrl":93},"references\u002Fstandards.md",3756,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fplugins\u002Fprivacy-skills-complete\u002Fskills\u002Fsaas-vendor-inventory\u002Freferences\u002Fstandards.md",{"path":95,"resourceType":78,"resourceTypeDesc":79,"sizeBytes":96,"sourceHtmlUrl":97},"references\u002Fworkflows.md",6798,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fplugins\u002Fprivacy-skills-complete\u002Fskills\u002Fsaas-vendor-inventory\u002Freferences\u002Fworkflows.md",{"path":99,"resourceType":100,"resourceTypeDesc":101,"sizeBytes":102,"sourceHtmlUrl":103},"scripts\u002Fml_monitoring_suite.py","SCRIPT","脚本",2782,"https:\u002F\u002Fgithub.com\u002Fshengdabai\u002FTony-Claude-Code-Skills\u002Fblob\u002Fmain\u002Fskills\u002Frsmdt-the-startup\u002Falirezarezvani-claude-skills\u002Fengineering-team\u002Fsenior-ml-engineer\u002Fscripts\u002Fml_monitoring_suite.py",{"path":105,"resourceType":100,"resourceTypeDesc":101,"sizeBytes":106,"sourceHtmlUrl":107},"scripts\u002Fmodel_deployment_pipeline.py",2812,"https:\u002F\u002Fgithub.com\u002Fshengdabai\u002FTony-Claude-Code-Skills\u002Fblob\u002Fmain\u002Fskills\u002Frsmdt-the-startup\u002Falirezarezvani-claude-skills\u002Fengineering-team\u002Fsenior-ml-engineer\u002Fscripts\u002Fmodel_deployment_pipeline.py",{"path":109,"resourceType":100,"resourceTypeDesc":101,"sizeBytes":110,"sourceHtmlUrl":111},"scripts\u002Fprocess.py",15934,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fplugins\u002Fprivacy-skills-complete\u002Fskills\u002Fsaas-vendor-inventory\u002Fscripts\u002Fprocess.py",{"path":113,"resourceType":100,"resourceTypeDesc":101,"sizeBytes":114,"sourceHtmlUrl":115},"scripts\u002Frag_system_builder.py",2777,"https:\u002F\u002Fgithub.com\u002Fshengdabai\u002FTony-Claude-Code-Skills\u002Fblob\u002Fmain\u002Fskills\u002Frsmdt-the-startup\u002Falirezarezvani-claude-skills\u002Fengineering-team\u002Fsenior-ml-engineer\u002Fscripts\u002Frag_system_builder.py",[117,141,156,169,186,198],{"skillNo":118,"name":119,"nameZh":6,"description":120,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":121,"categories":122,"keywords":132,"publishedAt":38},"01M6AG6K8R3XW10ENWH2FH18RH","workplace-email-privacy","Implements email and internet monitoring compliance in the workplace per Barbulescu v Romania (ECHR Grand Chamber), EDPB guidance, and national labour law. Covers acceptable use policies, legitimate expectation of privacy, proportionality testing, and content vs metadata monitoring. Keywords: email monitoring, Barbulescu, workplace privacy, internet monitoring, acceptable use policy, ECHR, proportionality.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fprivacy\u002Fworkplace-email-privacy\u002FSKILL.md",[123,128,131],{"categoryNo":124,"categoryName":125,"taxonomyType":126,"taxonomyTypeDesc":127},"01JBSEEDCAT000000000000005","邮件与沟通","SCENARIO","使用场景",{"categoryNo":129,"categoryName":130,"taxonomyType":126,"taxonomyTypeDesc":127},"01JBSEEDCAT000000000000008","测试与质量",{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[133,134,32,135,136,34,137,138,139,140],"email","workplace email privacy","compliance","content","policy","testing","monitoring","metadata",{"skillNo":142,"name":143,"nameZh":6,"description":144,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":145,"categories":146,"keywords":149,"publishedAt":38},"01M6AG6FRCBJY7D061BJZMNV49","whistleblower-data","Implements data protection compliance for whistleblowing systems under EU Directive 2019\u002F1937 and GDPR. Covers anonymous reporting channels, identity protection for whistleblowers and accused persons, retention limits, access restrictions, and retaliation prevention. Addresses national transpositions and DPA guidance. Keywords: whistleblower, Directive 2019\u002F1937, anonymous reporting, identity protection, retaliation, retention, reporting channel.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fprivacy\u002Fwhistleblower-data\u002FSKILL.md",[147,148],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[34,150,151,152,135,153,154,32,155],"whistleblower data","identity","reporting","data protection","gdpr","prevention",{"skillNo":157,"name":158,"nameZh":6,"description":159,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":160,"categories":161,"keywords":163,"publishedAt":38},"01M6AG6CJP0PW3X65HC7VP9SR9","vendor-termination-data","Vendor termination data return and deletion procedures per GDPR Article 28(3)(g). Covers data extraction formats, deletion certification requirements, transition planning, residual data handling, and post-termination verification.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fprivacy\u002Fvendor-termination-data\u002FSKILL.md",[162],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[34,164,165,166,167,154,32,168],"vendor termination data","planning","verification","extraction","certification",{"skillNo":170,"name":171,"nameZh":6,"description":172,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":173,"categories":174,"keywords":176,"publishedAt":38},"01M6AG69E277DXZB2NF6KV17ZA","vendor-risk-scoring","Vendor privacy risk tiering methodology for processor management. Covers scoring factors including data volume, sensitivity, transfer locations, certifications, breach history, and control maturity with weighted risk calculation and tier assignment.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fprivacy\u002Fvendor-risk-scoring\u002FSKILL.md",[175],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[177,178,179,180,181,182,183,184,32,34,185],"vendor risk scoring","risk","risk scoring","methodology","risk-scoring","assessment","transfer","certifications","processor",{"skillNo":187,"name":188,"nameZh":6,"description":189,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":190,"categories":191,"keywords":193,"publishedAt":38},"01M6AG6655ABFKT2BBWHCP4PAT","vendor-privacy-due-diligence","Pre-contract vendor privacy due diligence per GDPR Article 28(1). Covers risk questionnaires, technical controls assessment, certification review, data flow analysis, and documented sufficiency decisions for processor engagement.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fprivacy\u002Fvendor-privacy-due-diligence\u002FSKILL.md",[192],{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[32,194,154,195,182,196,33,34,185,178,168,197],"vendor privacy due diligence","review","onboarding","analysis",{"skillNo":199,"name":200,"nameZh":6,"description":201,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":202,"categories":203,"keywords":211,"publishedAt":38},"01M6AG62C3VD8SYNGH4N7RHZTE","vendor-privacy-audit","On-site and remote vendor audit procedures per GDPR Article 28(3)(h). Covers audit planning, evidence collection methodologies, finding classification, remediation tracking, and audit report generation for processor compliance verification.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fprivacy\u002Fvendor-privacy-audit\u002FSKILL.md",[204,207,210],{"categoryNo":205,"categoryName":206,"taxonomyType":126,"taxonomyTypeDesc":127},"01JBSEEDCAT000000000000018","写作与文案",{"categoryNo":208,"categoryName":209,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000036","内容创作者",{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[212,213,32,214,166,215,135,154,216,185,217,218,219,165],"vendor privacy audit","audit","report","audit report","remediation","collection","remediation-tracking","classification"]