SkillFoxx

lgpd-skills plugin

A bundle of 19 skills audits code for Brazil's LGPD data-protection law and keeps governance documents in the project folder.

  • 215 ★ on the repository
  • Last commit
  • MIT
Plugin

Extended access

Why this level

  • The skills read project schemas, routes and settings and write files with example code for personal data.
All reasons and checks

goul4rt/lgpd-skillsAuthor:goul4rt

Install

In your terminal, with SkillFoxx CLI

npx skillfoxx add plugins/lgpd-skills

Detects the agents on your machine, shows the access level and pins the version.

Other ways to install

Access and checks

How we review

Extended accessThe tool runs code or makes network calls and only reads external data.

  • The skills read project schemas, routes and settings and write files with example code for personal data.

This is third-party code. Review the repository files before installing.

What it does

The main `lgpd-audit` skill coordinates 18 narrow skills. They build a data map, choose a legal basis, prepare a record of processing (ROPA) and an impact report (RIPD), assemble a privacy policy and review vendor contracts. It also writes code: an event-sourced consent ledger, data-subject request routes, field encryption and an audit hash chain. Output lives in a versioned `.lgpd/` folder. When a breach is reported, `lgpd-audit` switches to emergency mode at once with a timestamp and containment steps, and pauses for legal review before key documents.

Who it is for. Teams building a product for Brazil that stores Brazilian personal data, together with their lawyer or data protection officer.

Good fit when

  • A project collects Brazilian users' data and needs a data-flow map built from schemas and routes.
  • A legacy service is checked for LGPD gaps and receives a P0, P1 and P2 priority table.
  • Data-subject access and erasure requests are added to a product with correct deadlines.
  • A breach is under way and the first step is containment, evidence preservation and a timestamp.

Not a fit when

  • You need a legal guarantee of compliance with no lawyer involved.
  • The product never touches data of Brazilian residents.
  • You must verify contracts, processes and cloud settings outside the repository.

Example request

Run a privacy and LGPD diagnosis for this project: data map, legal bases and a prioritized list of gaps.

Limitations

The skills inspect only code and versioned configuration and do not replace a lawyer: signed contracts and real production settings stay outside the audit. The legal basis and legitimate-interest balance must be approved with the data protection officer. Documentation and instructions are written in Portuguese, as are the templates. Legal coverage is stated for November 2026, so later rule changes will need skill updates.

How to disable. Remove the plugin with `/plugin uninstall lgpd-skills`, or the Gemini CLI extension and the `opencode.json` entry. The `.lgpd/` folder stays in the project; delete it by hand if the documents are not needed.

FAQ

Which agents are supported?

Claude Code, Codex, Gemini CLI, Cursor and OpenCode. Claude Code uses `/plugin marketplace add goul4rt/lgpd-skills`, Codex uses `codex plugin marketplace add goul4rt/lgpd-skills`.

What goes into `.lgpd/`?

`STATUS.md`, code findings, the data map, legal bases, legitimate-interest assessments and drafts of ROPA, RIPD and the policy. Files are versioned with the project.

What does the skill do on a breach?

It starts Pipeline D: records the moment of awareness, begins containment and evidence preservation and leads to notification under Resolução 15/2024, with no generic questions.

Does the bundle cover the ECA Digital children law?

Yes, the separate `lgpd-eca-digital-minors` skill works with Lei 15.211/2025 and Decreto 12.880/2026, depending on role and threat level.

Does the bundle replace a lawyer?

No. The skills check code and settings in the repository, while contracts, processes and the production environment still need human review.

Discussion

No questions or reviews yet.

Plugins
Russian stack

A skill that checks a website against Russian law: personal data, cookies and trackers, operator details, advertising and login methods

SkillExtended access1

152-FZ personal data audit

152fz-data-audit-skill

Russian stack

A 152-FZ personal data audit skill: where the database lives, what leaves Russia, who really has access and what never gets deleted

SkillBroad access2

An open library of 65 governance, risk and compliance skills: the agent drafts and gathers, while people make the calls.

PluginMinimal access58
Russian stack

A single-file Python script that finds personal data in text with regexes, anonymizes it and writes a report before a prompt goes to an AI

CLIExtended access1

Claude Skills for GRC

Claude Skills for Governance, Risk & Compliance (GRC)

A set of governance, risk and compliance skills: ISO 27001, SOC 2, GDPR, HIPAA, PCI DSS, NIST, the EU AI Act and other frameworks

SkillMinimal access1.1K

README in short

The repository follows the open Agent Skills standard and ships automated tests: regression checks on norms, schemas and template code. Work follows four pipelines: new project, legacy, hybrid and emergency.

README badge

Original SKILL.md

---
name: lgpd-audit
description: Maestro orchestrator for LGPD (Lei 13.709/2018) privacy engineering, code-level auditing, implementation, and governance in software projects. Use for "como estamos de LGPD", "audite LGPD", "privacy engineering LGPD", "gap analysis LGPD", "auditar privacidade", "tivemos um vazamento", or English phrasings like "audit our LGPD privacy controls" or "we collect personal data, what do we need". Immediately routes active breaches to emergency incident response, or chains 18 specialized sub-skills (data mapping, legal basis, DPO/ATPP channel, consent ledger, DSAR, security, ROPA, RIPD, vendors, international transfer, ECA Digital) producing versioned artifacts under .lgpd/.
---

# LGPD Audit — Maestro de Engenharia e Governança de Privacidade

Você é o orquestrador técnico de privacidade e proteção de dados (LGPD + normas da ANPD + ECA Digital) para o projeto atual. Esta skill coordena 18 sub-skills especializadas, mantém o **estado versionável** em `.lgpd/` e **pausa em checkpoints** antes de consolidar artefatos sensíveis.

> **Escopo real da auditoria de código:** esta skill inspeciona código, schemas, rotas, SDKs e configurações versionadas, implementa controles técnicos e estrutura artefatos de governança. Ela **não substitui revisão jurídica** nem comprova sozinha conformidade organizacional (contratos físicos externos ao repo, práticas operacionais humanas ou configurações de produção fora de IaC).

> **Multi-agente:** ao delegar, ative a sub-skill pelo nome. O mecanismo varia por agente (Claude/Codex/Gemini/Cursor disparam pela descrição; **OpenCode** exige chamar a ferramenta `skill` explicitamente). Veja [`references/skill-activation.md`](references/skill-activation.md).

## Princípios

1. **Fast-path para incidente ativo**: se o relato do usuário indicar vazamento, intrusão ou incidente de segurança em andamento, **não faça perguntas genéricas de discovery** — acione imediatamente o **Pipeline D** (`lgpd-incident-response` em modo emergencial), registre o timestamp de ciência (`T+0`) e inicie a contenção.
2. **Modo híbrido de execução**: autônomo em descoberta técnica e implementação guiada; **pausa obrigatória** para revisão humana/jurídica nos checkpoints (`ROPA`, `RIPD`, `Política de Privacidade`, `Comunicação à ANPD`).
3. **Living artifacts em `.lgpd/`**: tudo o que as skills produzem fica versionado em `.lgpd/` na raiz do projeto:
   ```text
   .lgpd/
   ├── STATUS.md              # estado atual, regime (ATPP/padrão) e limites da análise
   ├── discovery.md           # achados técnicos do repositório (legado/híbrido)
   ├── data-map.md            # inventário de atividades, cookies/SDKs e papéis dos agentes
   ├── legal-basis.md         # base legal por atividade + avaliação de melhor interesse (menores)
   ├── lia/                   # Legitimate Interest Assessments (Art. 7º, IX + Art. 10)
   ├── encarregado.md         # designação (Res. 18/2024) OU canal obrigatório ATPP (Res. 2/2022, Art. 11)
   ├── ROPA.md                # registro consolidado de operações (Art. 37)
   ├── RIPD/                  # relatórios de impacto (Art. 38 — alto risco ou preventivo)
   │   └── ripd-{slug}.md
   ├── consent/               # schema e especificação do ledger de eventos append-only
   ├── dsar/                  # workflow + endpoints (SLA padrão vs. ATPP)
   ├── security/              # controles de criptografia, chaves, anonimização e logs
   ├── retention.md           # matriz de retenção legal, bloqueio, backups e propagação
   ├── incidents/             # runbook + registro interno de 5 anos (Art. 10 Res. 15/2024)
   │   └── log.md
   ├── policies/              # política de privacidade versionada
   │   └── privacy-policy-v{N}.md
   ├── vendors/               # terceiros classificados por papel + DPAs (Art. 39)
   ├── transfers/             # transferências internacionais (Res. 32/2026 adequação / Res. 19/2024 SCCs)
   ├── eca-digital.md         # avaliação e controles da Lei 15.211/2025 + Decreto 12.880/2026
   └── gaps.md                # pendências técnicas e organizacionais priorizadas
   ```
4. **Precisão normativa**: cite sempre o dispositivo aplicável e **distinga exigência legal expressa de boa prática/controle técnico recomendado**. Consulte [`references/normative-reference.md`](references/normative-reference.md) antes de iniciar.

## Visão geral do fluxo de orquestração

Report a problem