Loading skill
Install any skill in seconds. Free to start, no credit card required.
Get Started Free →ledgerhq/detect-data-leaks
Detect new PII leaks introduced by the current branch.
Passed 10 of 17 test cases with the skill, and 6 of 17 without it.
and 9 more in the full report
9 fixed5 passed either way6 still failing3 broke
Tokens, turns and time describe resource use, not a dollar price.
One of 9 test cases the skill fixed. Same model, same prompt, with and without the skill.
You are asked to start a privacy audit for a proposed PR. What initial command should be executed to establish the primary scope of code changes before doing any pattern searches?
| Checked | Without skill | With skill |
|---|---|---|
| Specifies running git diff develop...HEAD as the primary source step. | Missed | Passed |
| Cautions against running grep queries independently to discover initial findings. | Missed | Passed |
The instructions your model reads when the skill loads.
We only consider PII that is sent to third-party services. Any call to our own backend with PII is not considered a data leak.
Every third-party service should be considered, but each has a different risk level. Logging services are the highest risk.
Some information is only PII in context — for example, public addresses are not PII by themselves, but on a logging service such as Datadog, an address can be linked to a location and device, allowing identification of the person behind it.
Crash reports need to be studied alongside logs — they are a common source of data leaks.
Any service that queries the blockchain for an address is not a concern — the query is mandatory for the system to function and the data is not linked to any other identifiable information. This applies to all coin modules. Examples:
api.kaspa.orgapi.trongrid.io)Prioritize these, but do not exclude others:
Treat any of these as high-risk when found in added lines:
location.pathname, window.location.hash, address, walletAccountId, txId, publicKey, signature, rawData, payinAddress, fromAccountAddress, toAccountAddress, binaryPayload
Run git diff develop...HEAD. This is the primary source — start here, not from grep.
In added lines, identify:
track(), trackPage(), logger.*(), captureException()In removed lines, identify:
confidentialityFilter, scrubbing calls, PII-stripping wrappers — flag each removal as a potential leak enabler.test cases passed, vs 6 / 17 without
More skills from the same source and nearby in the registry, with their headline benchmark lift.