Verified skill
Real-time security audit skill scanning for OWASP Top 10 vulnerabilities and infrastructure misconfigurations.
Premium skill
AI Data Governance and Compliance Mapper
This skill discovers all data sources consumed by an AI application, including databases, APIs, file storage, and streaming services, by inspecting code repositories and infrastructure configurations. It identifies data schemas, lineage, and usage patterns, then produces a detailed data constraint map outlining data quality requirements, privacy classifications, and compliance obligations. The skill generates a draft data governance plan, including access controls, retention policies, and audit trails, and verifies current data pipelines against this plan. It flags discrepancies, potential compliance risks, and data quality issues, and continuously monitors for changes to keep the map and plan current. Unverified details are always marked as unresolved, never invented.
What It Does
This skill discovers all data sources consumed by an AI application, including databases, APIs, file storage, and streaming services, by inspecting code repositories and infrastructure configurations. It identifies data schemas, lineage, and usage patterns, then produces a detailed data constraint map outlining data quality requirements, privacy classifications, and compliance obligations. The skill generates a draft data governance plan, including access controls, retention policies, and audit trails, and verifies current data pipelines against this plan. It flags discrepancies, potential compliance risks, and data quality issues, and continuously monitors for changes to keep the map and plan current. Unverified details are always marked as unresolved, never invented.
The Problem It Removes
AI product managers and data teams often lack a clear, centralized understanding of the data constraints and governance requirements for their AI applications. This leads to data quality issues, privacy breaches, non-compliance with regulations, and significant delays in product development.
The real cost includes legal fines for non-compliance, reputational damage from data breaches, poor AI model performance due to low-quality data, and substantial manual effort spent on data auditing and policy enforcement. This also creates a bottleneck in scaling AI initiatives.
This skill removes the recurring, labor-intensive work of manually mapping data sources, assessing quality, identifying compliance needs, and drafting governance policies. It ensures the AI application's data foundation is robust, compliant, and continuously monitored, mitigating risks and accelerating safe AI deployment.
Who It Is For
AI Product Managers, Data Engineers, Compliance Officers, and Legal Teams in organizations developing data-intensive AI applications.
Especially valuable when:
- Companies operating in regulated industries (e.g., healthcare, finance) with strict data compliance needs.
- Organizations handling sensitive user data, requiring robust privacy controls.
- Teams struggling with inconsistent data quality impacting AI model performance.
- Environments with complex data architectures and numerous data sources.
- Startups needing to establish strong data governance practices early on.
- Enterprises aiming to scale AI securely and compliantly across multiple products.
Why This Price
This skill removes the recurring, labor-intensive work of manually mapping data sources, assessing quality, identifying compliance needs, and drafting governance policies. It ensures the AI application's data foundation is robust, compliant, and continuously monitored, mitigating risks and accelerating safe AI deployment.
The value compounds over time as the skill continuously monitors for changes in data schemas, application logic, and regulatory requirements. This proactive approach prevents compliance drift and ensures that governance remains aligned with operational reality, saving countless hours of manual auditing and remediation.
Buyers pay for the automation of complex data discovery and governance planning, the continuous risk mitigation, and the peace of mind that their AI applications are built on a compliant and high-quality data foundation. This goes far beyond simple text generation, providing verifiable insights and actionable remediation steps that directly impact an organization's legal and operational integrity.
One payment, yours permanently. Download it again at any time and get later versions free.
How It Differs From Similar Skills
gdpr-data-handling is specific to GDPR and does not encompass a comprehensive data constraint mapping, quality assessment, or full governance plan generation across all data types and regulations. data-quality-frameworks provides frameworks but doesn't automate the discovery, mapping, and validation.
database-design focuses on database schema design, not the broader data governance and constraint mapping for an AI application's entire data landscape. This skill performs the operational job of continuous discovery, validation, and policy generation for all data aspects relevant to AI.
When To Use
- An AI Product Manager is launching a new AI feature that consumes novel data sources and needs to ensure it's compliant from day one.
- A Data Engineer is tasked with integrating a new dataset into an existing AI application and needs to understand its governance implications and quality requirements.
- A Compliance Officer needs to audit an AI application's data handling practices against a new regulation like CCPA or an update to GDPR.
- A Legal Team is reviewing an AI product for potential privacy risks before market release and requires a comprehensive data constraint map.
- An organization is scaling its AI initiatives and needs a standardized, automated way to ensure data governance across multiple AI projects.
Inputs
code_repo_links: Links to AI application code repositories.
infra_config_links: Access to infrastructure configuration files (e.g., Terraform, Kubernetes manifests).
Outputs
dataConstraintMap: A detailed map of all data sources, their schemas, lineage, sensitive data classifications, data quality requirements, and compliance obligations.
governancePlan: A draft data governance plan including proposed access controls, retention policies, and audit trails.
verificationReport: A report detailing discrepancies between current data pipelines/storage and the proposed governance plan, including compliance risks and data quality issues, with actionable remediation steps.
How It Works From Start To Finish
- Inspect AI application codebases, infrastructure configurations, and data storage systems
- Discover all data sources, schemas, and data lineage
- Analyze data content to identify sensitive information (PII, confidential data)
- Assess data quality, completeness, and consistency
- Identify relevant data privacy regulations (GDPR, HIPAA, CCPA, etc.)
- Map data fields to specific compliance requirements
- Generate a draft data governance plan, including access controls and retention policies
- Verify current data pipelines and storage against identified constraints
- Flag discrepancies, compliance risks, and data quality issues
- Propose remediation steps for identified governance gaps
- Open a pull request or update documentation with the data constraint map and governance plan
- Continuously monitor data sources, code, and regulations for changes
What you supply
- Links to AI application code repositories
- Access to infrastructure configuration files (e.g., Terraform, Kubernetes manifests)
What it finds out on its own
- Database schemas, tables, and views
- API definitions and data transfer objects
- File storage contents and metadata
- Streaming data topics and message schemas
- Existing data access policies and roles
- Relevant regulatory frameworks based on project context (e.g., region, industry)
Step By Step
-
Discover Data Sources
Inspect provided code repositories and infrastructure configurations to identify all data sources (databases, APIs, file storage, streaming services) consumed by the AI application.
Done when: A comprehensive list of all potential data sources consumed by the AI application is compiled.
If it cannot finish: Report inaccessible repositories or configurations and mark them as uninspected, continuing with accessible sources.
-
Map Data Schemas and Lineage
Extract schemas, data types, and data lineage information from the discovered data sources.
Done when: A detailed map of data schemas and their lineage across the AI application is generated.
If it cannot finish: Mark any data source where schema or lineage extraction failed as unresolved, detailing the specific error.
-
Classify Sensitive Data
Analyze data content and schemas using pattern matching, dictionary lookups, and contextual analysis to classify sensitive information (e.g., PII, PHI, confidential).
Done when: All identified data fields are classified for sensitivity, with ambiguous classifications flagged for human review.
If it cannot finish: Flag any data field that cannot be definitively classified for sensitivity and mark it as requiring human input.
-
Assess Data Quality
Apply predefined and configurable data quality metrics (completeness, uniqueness, validity, consistency) to critical data fields based on AI application requirements.
Done when: A data quality report is generated, highlighting fields that do not meet defined thresholds.
If it cannot finish: Report any data quality check failures, detailing the specific issue and the affected data source, and continue with other checks.
-
Identify Compliance Obligations
Determine relevant data privacy and governance regulations (e.g., GDPR, HIPAA, CCPA) based on the AI application's context, data types, and operational region.
Done when: A list of applicable regulatory frameworks and their key data handling requirements is compiled.
If it cannot finish: If regulatory context is unclear, flag the ambiguity and request clarification, proceeding with general best practices.
-
Generate Draft Governance Plan
Create a draft data governance plan including proposed access controls, data retention policies, audit trails, and data handling procedures, tailored to the AI application.
Done when: A comprehensive draft data governance plan document is produced.
If it cannot finish: If a specific policy cannot be formulated due to missing information, mark that section as unresolved and provide a placeholder.
-
Verify Current Implementations
Programmatically audit existing data pipelines, storage solutions, access control lists (ACLs), and IAM policies against the generated draft governance plan.
Done when: A verification report detailing alignment and discrepancies between current implementations and the draft plan is generated.
If it cannot finish: If an existing system cannot be audited, report the access error and mark the corresponding governance aspects as unverified.
-
Flag Discrepancies and Risks
Identify and document all discrepancies, potential compliance risks, and data quality issues found during verification.
Done when: A prioritized list of identified risks and discrepancies is compiled, with clear descriptions.
If it cannot finish: If risk assessment is incomplete due to unverified data, clearly state the missing information and its impact on the assessment.
-
Propose Remediation and Update Documentation
Suggest concrete remediation steps for identified gaps and generate a pull request or update documentation with the final data constraint map and governance plan.
Done when: Remediation suggestions are provided, and the data constraint map and governance plan are updated in the specified format.
If it cannot finish: If documentation update fails, report the error and provide the updated documents as a direct output.
How It Checks Its Own Work
Checks before it delivers
- All identified data sources are accounted for in the constraint map
- Sensitive data fields are correctly classified and protected according to policies
- Data retention policies are applied consistently across relevant data stores
- Data quality metrics meet defined thresholds (e.g., completeness, uniqueness)
- Current data access controls align with the proposed governance plan
- Compliance with identified regulations is verified for each data flow
If something goes wrong
- If a data source is inaccessible, it reports the access error and marks that source's constraints as unverified.
- If a data quality check fails, it flags the specific data issue, its location, and suggests potential remediation strategies.
- If a regulatory requirement is ambiguous, it highlights the ambiguity and requests legal clarification, providing potential interpretations.
- If existing data pipelines show non-compliance, it details the non-compliant aspect and suggests corrective actions without modifying data.
Mistakes It Prevents
| The mistake | What it costs | How the skill prevents it |
|---|---|---|
| Missing critical data sources or data fields during the initial discovery phase. | The governance plan is incomplete, leaving significant portions of the AI application's data landscape unmanaged, leading to hidden compliance risks or data quality issues. | Systematically cross-reference discovered data sources and schemas against infrastructure manifests, application code dependencies, and network traffic logs to ensure comprehensive coverage. |
| Misclassifying sensitive data (e.g., PII, PHI, confidential) due to incomplete analysis or outdated rules. | Sensitive data is either over-restricted, hindering legitimate use, or under-protected, leading to severe privacy breaches, regulatory fines, and reputational damage. | Employ a multi-layered classification approach combining pattern matching, dictionary lookups, and contextual analysis, flagging any ambiguous classifications for mandatory human review. |
| Allowing the data constraint map and governance plan to become outdated as data schemas, application logic, or regulatory requirements evolve. | The documented governance no longer reflects the operational reality, creating a false sense of security and exposing the organization to new, unmanaged risks and non-compliance. | Implement continuous monitoring of code repositories for schema changes, infrastructure configurations, and relevant regulatory updates, automatically triggering re-evaluation and suggesting plan revisions. |
| Applying a generic set of data quality rules without tailoring them to the specific needs and expected data characteristics of the AI application. | Data quality issues specific to the AI model's requirements go undetected, leading to poor model performance, biased outputs, and erosion of trust in the AI system. | Define and apply data quality metrics (e.g., completeness, uniqueness, validity, consistency) that are specific to the AI application's use case and data types, with configurable thresholds. |
| Failing to verify the actual implementation of access controls and retention policies against the generated governance plan. | The governance plan exists on paper but is not enforced in practice, leaving data vulnerable to unauthorized access or improper retention, leading to compliance violations. | Programmatically audit existing access control lists (ACLs), IAM policies, and data lifecycle configurations in storage systems, comparing them directly against the proposed governance plan. |
| Generating a governance plan that is technically infeasible or overly complex for the existing infrastructure and team capabilities. | The plan is ignored or partially implemented, leading to governance gaps, increased operational burden, and a perception that data governance is an insurmountable task. | Incorporate checks for existing infrastructure capabilities and common deployment patterns, suggesting practical and incremental remediation steps rather than an entirely new, disruptive architecture. |
Edge Cases It Handles
- Missing critical data sources or data fields during the initial discovery phase.
- Systematically cross-reference discovered data sources and schemas against infrastructure manifests, application code dependencies, and network traffic logs to ensure comprehensive coverage.
- Misclassifying sensitive data (e.g., PII, PHI, confidential) due to incomplete analysis or outdated rules.
- Employ a multi-layered classification approach combining pattern matching, dictionary lookups, and contextual analysis, flagging any ambiguous classifications for mandatory human review.
- The data constraint map and governance plan become outdated as data schemas, application logic, or regulatory requirements evolve.
- Implement continuous monitoring of code repositories for schema changes, infrastructure configurations, and relevant regulatory updates, automatically triggering re-evaluation and suggesting plan revisions.
- Applying a generic set of data quality rules without tailoring them to the specific needs and expected data characteristics of the AI application.
- Define and apply data quality metrics (e.g., completeness, uniqueness, validity, consistency) that are specific to the AI application's use case and data types, with configurable thresholds.
- Failing to verify the actual implementation of access controls and retention policies against the generated governance plan.
- Programmatically audit existing access control lists (ACLs), IAM policies, and data lifecycle configurations in storage systems, comparing them directly against the proposed governance plan.
- Generating a governance plan that is technically infeasible or overly complex for the existing infrastructure and team capabilities.
- Incorporate checks for existing infrastructure capabilities and common deployment patterns, suggesting practical and incremental remediation steps rather than an entirely new, disruptive architecture.
A Worked Example
An AI product team is developing a new customer sentiment analysis feature that processes user reviews and profile data. They need to ensure GDPR compliance and data quality.
Input
{"code_repo_links": ["https://github.com/example-org/sentiment-ai-app"], "infra_config_links": ["https://github.com/example-org/infra-configs/sentiment-ai-prod.yaml"]}Expected output
{"dataConstraintMap": {"user_reviews_db": {"schema": {"review_id": "UUID", "user_id": "UUID", "text": "TEXT", "timestamp": "DATETIME"}, "sensitive_fields": {"text": "PII_POTENTIAL"}, "quality_requirements": {"text": {"completeness": 0.99, "min_length": 10}}, "compliance_obligations": ["GDPR"]}, "user_profiles_api": {"schema": {"user_id": "UUID", "email": "EMAIL", "country": "STRING", "age_group": "STRING"}, "sensitive_fields": {"email": "PII", "country": "PII_LOCATION"}, "quality_requirements": {"email": {"uniqueness": 1.0}}, "compliance_obligations": ["GDPR"]}}, "governancePlan": {"access_controls": {"user_reviews_db": {"roles": ["sentiment_model_reader"], "permissions": ["read_only"]}, "user_profiles_api": {"roles": ["data_anonymizer"], "permissions": ["read_anonymized"]}}, "retention_policies": {"user_reviews_db": {"policy": "retain_5_years_anonymized", "justification": "model_training"}, "user_profiles_api": {"policy": "retain_1_year_active_users", "justification": "user_management"}}, "audit_trails": ["all_data_access", "sensitive_data_queries"]}, "verificationReport": {"discrepancies": [{"source": "user_reviews_db", "issue": "Access control allows 'dev_team' full access, not read_only.", "severity": "High", "remediation": "Revoke 'dev_team' write access, assign 'sentiment_model_reader' role."}, {"source": "user_profiles_api", "issue": "No automated anonymization pipeline detected for 'email' field.", "severity": "Critical", "remediation": "Implement data anonymization service before API consumption."}], "compliance_risks": ["GDPR_Article_5_Data_Minimization_violation_in_user_profiles_api"], "data_quality_issues": ["user_reviews_db.text: 5% of reviews are empty, below 99% completeness threshold."]}}Why this output: The skill inspects the provided links, discovers the database and API, maps their schemas, identifies 'email' and 'text' as sensitive, and applies GDPR obligations. It then generates a plan for access and retention. During verification, it finds that existing access controls are too broad and anonymization is missing, flagging these as high-severity discrepancies and compliance risks. It also identifies a data quality issue with empty reviews.
Keeping It Current And Knowing Its Limits
Keeping it current
The skill continuously monitors data sources, code repositories, and relevant regulatory updates. Upon detecting changes in data schemas, usage patterns, or legal requirements, it re-evaluates the data constraint map and governance plan, flags new risks, and suggests necessary adjustments to maintain compliance and data quality.
What it will not do
- It will not modify data or enforce policies directly.
- It cannot provide legal advice, only map requirements and flag potential issues for legal review.
- It never invents unverified details, always flagging them for human review.
Limitations
Installation
Register as MCP toolBefore You Run It
Security notes
- This skill requires access to sensitive information, including your AI application's code, infrastructure configurations, and potentially actual data schemas and content. Ensure that the environment where this skill runs is secure and that access credentials are managed appropriately.
- The skill performs read-only operations for discovery and verification. However, the output may contain sensitive data classifications and compliance gaps, which should be handled with care to prevent unauthorized disclosure.
- Always review the generated governance plan and remediation steps before implementing them, especially those affecting access controls or data retention.
Questions People Ask
Does this skill modify my data or enforce policies directly?
No, this skill operates in a read-only mode. It inspects your code, configurations, and existing policies to generate a data constraint map and a draft governance plan. It will flag discrepancies and propose remediation steps, but it will never modify your data or enforce policies without explicit human approval.
Can this skill provide legal advice on compliance regulations?
This skill identifies relevant regulatory frameworks and maps data fields to compliance requirements based on its analysis. However, it does not provide legal advice or definitive interpretations of regulatory texts. All compliance findings should be reviewed by your legal team.
How does the skill handle sensitive data classification?
The skill employs a multi-layered classification approach combining pattern matching, dictionary lookups, and contextual analysis to identify sensitive information like PII or PHI. Any ambiguous classifications are explicitly flagged for mandatory human review to ensure accuracy and prevent misclassification.
What happens if the skill cannot access a data source or configuration?
If a data source or configuration is inaccessible, the skill will report the access error and mark that specific source's constraints or governance aspects as unverified. It will continue processing accessible sources, ensuring that valid work is preserved and the cause of failure is clearly stated for recovery.
How does this skill stay current with evolving regulations and data changes?
The skill is designed for continuous maintenance. It monitors data sources, code repositories, and relevant regulatory updates. Upon detecting changes in data schemas, usage patterns, or legal requirements, it automatically re-evaluates the data constraint map and governance plan, flags new risks, and suggests necessary adjustments to maintain compliance and data quality.
What people say, and where to get help
No ratings yet. If you have used this skill, yours would be the first.
Sign in to leave a rating
An account keeps your review with your name on it, and lets you edit it later. Sign in or create one free.
No reviews yet
This skill has not been rated. If you have run it, a short note about what you used it for helps the next person more than any description can.
Related Skills You May Like
Discover more AI agent skills in the same category to enhance your workflow automation.
Leverages AI-assisted debugging and multi-agent orchestration to systematically diagnose, resolve, and prevent production issues, reducing Mean Time To Recovery (MTTR).
Manage Apple Notes from the command line to create, view, edit, delete, search, move, and export notes.
Premium skill
$120.00 , one time purchase
Automatically identifies, prioritizes, and remediates security vulnerabilities in code, verifying fixes and preventing regressions to maintain a secure.
Use the Gemini CLI for one-shot Q&A, summaries, and content generation directly from your terminal.
Display HTML content on connected OpenClaw nodes (Mac, iOS, Android) for games, visualizations, dashboards, and interactive demos.
Have a Skill to Share?
Join the community and help AI agents learn new capabilities. Submit your skill and reach thousands of developers.