Loading skill
Install any skill in seconds. Free to start, no credit card required.
Get Started Free →Use when reviewing form components, API payloads, or client-side storage to identify fields that are collected but not consumed by a stated feature.
.claude/skills/thedaviddias-data-minimisation/SKILL.md| Test case | Without → With | Effect | Δ tokens | Δ turns |
|---|---|---|---|---|
| case-05 | ✗→✓ | ▲ Improved | -5% | 0% |
| case-15 | ✗→✓ | ▲ Improved | -2% | 0% |
| case-24 | ✗→✓ | ▲ Improved | -1% | 0% |
| case-01 | ✓→✓ | ＝ Same ✓ | 14% | 0% |
| case-02 | ✓→✓ | ＝ Same ✓ | -14% | 0% |
Collecting more data than necessary increases the blast radius of a breach, exposes your organisation to regulatory fines, and erodes user trust. GDPR Article 5(1)(c) makes data minimisation a legal obligation for any controller processing EU residents' data — but it is also sound engineering practice regardless of jurisdiction.
Audit the form fields, API request bodies, and client-side storage keys in this codebase to identify any personal data collected beyond what the stated feature requires. Also inspect analytics and logging payloads for raw email addresses, names, phone numbers, or full query strings that leak PII.
Remove or anonymise form fields, storage keys, and API parameters that collect personal data not consumed by a specific, documented feature purpose. Replace raw personal identifiers in analytics and logs with pseudonymous IDs and define a retention window for each stored value.
Explain the GDPR data minimisation principle and how over-collection of personal data increases breach impact and regulatory risk.
Review form components, fetch/axios calls, and storage utilities for personal data fields. Flag any field or key that is collected but not read by an active feature, and suggest anonymisation or removal. Flag analytics and monitoring payloads that include raw PII or have no stated retention.
For full implementation details, code examples, and framework-specific guidance, see references/rule.md.
Rule page: https://frontendchecklist.io/en/rules/privacy/data-minimisation
| Case | Status | Duration (ms) | Turns | Tokens | Tool calls | ||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Without | With | Δ | Without | With | Δ | Without | With | Δ | Without | With | Δ | ||
case-01 | pass→pass | 13,503 | 10,946 | -19% | 1 | 1 | 0% | 2,552 | 2,900 | +14% | 0 | 0 | — |
case-02 | pass→pass | 10,911 | 7,921 | -27% | 1 | 1 | 0% | 2,316 | 1,989 | -14% | 0 | 0 | — |
case-03 | pass→pass | 14,537 | 12,324 | -15% | 1 | 1 | 0% | 2,894 | 2,740 | -5% | 0 | 0 | — |
case-04 | pass→pass | 11,016 | 9,296 | -16% | 1 | 1 | 0% | 2,234 | 2,092 | -6% | 0 | 0 | — |
case-05 | fail→pass | 11,039 | 10,945 | -1% | 1 | 1 | 0% | 2,125 | 2,025 | -5% | 0 | 0 | — |
case-06 | fail→fail | 11,545 | 7,563 | -34% | 1 | 1 | 0% | 1,962 | 1,925 | -2% | 0 | 0 | — |
case-07 | pass→pass | 14,460 | 10,270 | -29% | 1 | 1 | 0% | 3,095 | 2,616 | -15% | 0 | 0 | — |
case-08 | pass→pass | 13,318 | 11,843 | -11% | 1 | 1 | 0% | 2,522 | 2,613 | +4% | 0 | 0 | — |
case-09 | pass→pass | 12,932 | 11,779 | -9% | 1 | 1 | 0% | 2,262 | 2,508 | +11% | 0 | 0 | — |
case-10 | pass→pass | 5,333 | 3,124 | -41% | 1 | 1 | 0% | 982 | 990 | +1% | 0 | 0 | — |
case-11 | pass→pass | 13,682 | 9,718 | -29% | 1 | 1 | 0% | 2,557 | 2,484 | -3% | 0 | 0 | — |
case-12 | pass→pass | 11,101 | 8,090 | -27% | 1 | 1 | 0% | 2,079 | 2,002 | -4% | 0 | 0 | — |
case-13 | pass→pass | 13,705 | 10,033 | -27% | 1 | 1 | 0% | 2,607 | 2,169 | -17% | 0 | 0 | — |
case-14 | pass→pass | 13,597 | 11,332 | -17% | 1 | 1 | 0% | 2,184 | 2,203 | +1% | 0 | 0 | — |
case-15 | fail→pass | 7,911 | 6,100 | -23% | 1 | 1 | 0% | 1,485 | 1,461 | -2% | 0 | 0 | — |
case-16 | pass→pass | 14,484 | 9,679 | -33% | 1 | 1 | 0% | 3,069 | 2,598 | -15% | 0 | 0 | — |
case-17 | pass→pass | 8,480 | 6,438 | -24% | 1 | 1 | 0% | 1,758 | 1,698 | -3% | 0 | 0 | — |
case-18 | pass→pass | 10,222 | 7,299 | -29% | 1 | 1 | 0% | 1,951 | 1,817 | -7% | 0 | 0 | — |
case-19 | pass→pass | 15,830 | 12,265 | -23% | 1 | 1 | 0% | 2,331 | 2,509 | +8% | 0 | 0 | — |
case-20 | fail→fail | 12,629 | 8,603 | -32% | 1 | 1 | 0% | 2,135 | 2,095 | -2% | 0 | 0 | — |
case-21 | pass→pass | 13,206 | 9,960 | -25% | 1 | 1 | 0% | 2,537 | 2,302 | -9% | 0 | 0 | — |
case-22 | pass→pass | 12,550 | 11,161 | -11% | 1 | 1 | 0% | 2,278 | 2,509 | +10% | 0 | 0 | — |
case-23 | fail→fail | 9,063 | 11,810 | +30% | 1 | 1 | 0% | 1,575 | 2,533 | +61% | 0 | 0 | — |
case-24 | fail→pass | 13,720 | 10,024 | -27% | 1 | 1 | 0% | 2,922 | 2,882 | -1% | 0 | 0 | — |
DecimalAI ran this skill against gemini-3.6-flash twice over the same eval suite — once with the skill loaded and once without — and compared the two runs case by case. 24 cases were attempted. The headline lift of +13 percentage points is the difference between those two pass rates over the 24 comparable cases.
Without the skill loaded, the model failed this case. With it loaded, the same prompt on the same model passed. This is one improved case from the latest verified run; every case, including any that regressed, is in the table above.
Other measured skills in the registry, with their headline benchmark lift.