@raishin/vanguard-frontier-agentic 2.0.0 → 2.1.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@raishin/vanguard-frontier-agentic",
-  "version": "2.0.0",
+  "version": "2.1.0",
   "description": "Cloud and zero-trust agentic workflow marketplace for skills, agents, rules, MCP references, and compliance-aware architecture.",
   "license": "Apache-2.0",
   "repository": {
@@ -56,6 +56,9 @@
     "validate:multi-harness-marketplace": "python3 tests/validate-multi-harness-marketplace.py",
     "validate:codex-marketplace": "python3 tests/validate-codex-marketplace.py",
     "validate:finops-fixtures": "python3 tests/validate-finops-price-fixtures.py",
+    "validate:readme-counts": "node tests/validate-readme-counts.mjs",
+    "validate:qa-cluster": "node tests/eval-qa-cluster.mjs",
+    "readme-counts:write": "node scripts/generate-readme-counts.mjs",
     "test:marketplace-validators": "python3 tests/test-marketplace-validators.py",
     "maestro-routing:write": "python3 tests/_generate_maestro_routing_fixtures.py",
     "plugin-manifest:write": "node scripts/generate-plugin-manifest.mjs",
@@ -66,7 +69,7 @@
     "test:gemini-bundling": "python3 tests/test-gemini-skill-bundling.py",
     "test:cursor-kiro-notices": "node tests/export-cursor-kiro-skill-notice.test.mjs",
     "test:fuzz": "node tests/fuzz-properties.test.mjs",
-    "validate": "npm run validate:catalog && npm run validate:aws && npm run manifest:check && npm run validate:allowed-tools && npm run validate:skill-schema && npm run validate:agent-schema && npm run validate:links && npm run validate:asset-integrity && npm run validate:mcp-trust-matrix && npm run validate:no-lifecycle-scripts && npm run validate:promotion-gatekeeper && npm run validate:install-coverage && npm run validate:maestro-routing && npm run validate:plugin-manifest && npm run validate:kiro-powers && npm run validate:multi-harness-marketplace && npm run validate:codex-marketplace && npm run validate:finops-fixtures",
+    "validate": "npm run validate:catalog && npm run validate:aws && npm run manifest:check && npm run validate:allowed-tools && npm run validate:skill-schema && npm run validate:agent-schema && npm run validate:links && npm run validate:asset-integrity && npm run validate:mcp-trust-matrix && npm run validate:no-lifecycle-scripts && npm run validate:promotion-gatekeeper && npm run validate:install-coverage && npm run validate:maestro-routing && npm run validate:plugin-manifest && npm run validate:kiro-powers && npm run validate:multi-harness-marketplace && npm run validate:codex-marketplace && npm run validate:finops-fixtures && npm run validate:readme-counts && npm run validate:qa-cluster",
     "release:sbom": "command -v syft >/dev/null 2>&1 && syft scan dir:. -o spdx-json=sbom.spdx.json || echo 'syft not installed; SBOM is generated in CI by anchore/sbom-action'",
     "lint:md": "npx --yes markdownlint-cli2 \"**/*.md\" \"#node_modules\" \"#.git\" \"#.code-review-graph\" \"#CHANGELOG.md\"",
     "lint:spell": "codespell",

package/plugins/vanguard-frontier-agentic/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "vanguard-frontier-agentic",
-  "version": "2.0.0",
+  "version": "2.1.0",
   "description": "Curated marketplace for cloud and zero-trust AI workflows. 331 agents, 286 skills, and rules across AWS, Azure, OCI, GCP, Alibaba Cloud, Huawei Cloud, Kubernetes, and Terraform.",
   "author": {
     "name": "Raishin",

package/scripts/generate-readme-counts.mjs

@@ -0,0 +1,162 @@
+#!/usr/bin/env node
+/**
+ * Generate catalog counts and inject them into README.md.
+ *
+ * Counts:
+ *   skills    = SKILL.md files under skills/ (recursive)
+ *   agents    = metadata.json files under agents/ (recursive)
+ *   providers = distinct `provider` values across agents metadata files
+ *   roles     = keys under `.roles` in catalog/install-roles.json
+ *   rules     = length of JSON array in catalog/rules.json
+ *   mcp       = length of JSON array in catalog/mcp-references.json
+ *
+ * Mode:
+ *   (default)  overwrite README.md in place
+ *   --check    compare expected vs actual, exit 1 if stale, 0 if current
+ *
+ * Run: npm run readme-counts:write
+ */
+
+import fs from "node:fs";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+
+const repoRoot = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
+const readmePath = path.join(repoRoot, "README.md");
+const check = process.argv.includes("--check");
+
+// ---------------------------------------------------------------------------
+// Helpers
+// ---------------------------------------------------------------------------
+
+/** Recursively list all files under `dir`. Returns relative paths from `dir`. */
+function listFiles(dir) {
+  return fs.readdirSync(dir, { recursive: true }).map(String);
+}
+
+// ---------------------------------------------------------------------------
+// Compute counts
+// ---------------------------------------------------------------------------
+
+const skillFiles = listFiles(path.join(repoRoot, "skills"));
+const skillCount = skillFiles.filter((f) => f.endsWith("SKILL.md")).length;
+
+const agentFiles = listFiles(path.join(repoRoot, "agents"));
+const agentMetaFiles = agentFiles.filter((f) => f.endsWith("metadata.json"));
+const agentCount = agentMetaFiles.length;
+
+const allProviders = new Set();
+for (const f of agentMetaFiles) {
+  const fullPath = path.join(repoRoot, "agents", f);
+  const m = JSON.parse(fs.readFileSync(fullPath, "utf8"));
+  if (m.provider) allProviders.add(m.provider);
+}
+const providerCount = allProviders.size;
+
+const rolesData = JSON.parse(
+  fs.readFileSync(path.join(repoRoot, "catalog", "install-roles.json"), "utf8"),
+);
+const roleCount = Object.keys(rolesData.roles).length;
+
+const rulesData = JSON.parse(
+  fs.readFileSync(path.join(repoRoot, "catalog", "rules.json"), "utf8"),
+);
+const ruleCount = Array.isArray(rulesData) ? rulesData.length : 0;
+
+const mcpData = JSON.parse(
+  fs.readFileSync(path.join(repoRoot, "catalog", "mcp-references.json"), "utf8"),
+);
+const mcpCount = Array.isArray(mcpData) ? mcpData.length : 0;
+
+const counts = {
+  skills: skillCount,
+  agents: agentCount,
+  providers: providerCount,
+  roles: roleCount,
+  rules: ruleCount,
+  mcp: mcpCount,
+};
+
+// ---------------------------------------------------------------------------
+// Build the marker block
+// ---------------------------------------------------------------------------
+
+const markerBlock =
+  `<!-- readme-counts:start -->\n` +
+  `<!-- Generated by scripts/generate-readme-counts.mjs — do not edit by hand. Run: npm run readme-counts:write -->\n` +
+  `| Catalog | Count |\n` +
+  `| --- | --- |\n` +
+  `| Skills | ${skillCount} |\n` +
+  `| Agents | ${agentCount} |\n` +
+  `| Providers | ${providerCount} |\n` +
+  `| Install roles | ${roleCount} |\n` +
+  `| Rules | ${ruleCount} |\n` +
+  `| MCP references | ${mcpCount} |\n` +
+  `<!-- readme-counts:end -->`;
+
+// ---------------------------------------------------------------------------
+// Transform README content
+// ---------------------------------------------------------------------------
+
+function buildExpectedContent(original) {
+  let content = original;
+
+  // 1. Replace the marker block (markers preserved, inner content replaced)
+  const markerStartRe = /<!-- readme-counts:start -->[\s\S]*?<!-- readme-counts:end -->/;
+  if (markerStartRe.test(content)) {
+    content = content.replace(markerStartRe, markerBlock);
+  }
+
+  // 2. Replace inline count spans <!-- count:KEY -->OLDNUMBER<!-- /count -->
+  const inlineRe = /<!-- count:(skills|agents|providers|roles|rules|mcp) -->\d+<!-- \/count -->/g;
+  content = content.replace(inlineRe, (_, key) => {
+    return `<!-- count:${key} -->${counts[key]}<!-- /count -->`;
+  });
+
+  return content;
+}
+
+// ---------------------------------------------------------------------------
+// Main
+// ---------------------------------------------------------------------------
+
+const original = fs.readFileSync(readmePath, "utf8");
+const expected = buildExpectedContent(original);
+
+if (check) {
+  if (original === expected) {
+    console.log("OK: README counts current");
+    process.exit(0);
+  }
+
+  // Print a basic diff-style report to stderr
+  const origLines = original.split("\n");
+  const expLines = expected.split("\n");
+  const maxLen = Math.max(origLines.length, expLines.length);
+  const diffLines = [];
+  for (let i = 0; i < maxLen; i++) {
+    const o = origLines[i];
+    const e = expLines[i];
+    if (o !== e) {
+      diffLines.push(`Line ${i + 1}:`);
+      if (o !== undefined) diffLines.push(`  - ${o}`);
+      if (e !== undefined) diffLines.push(`  + ${e}`);
+    }
+  }
+  process.stderr.write(
+    `ERROR: README.md counts are stale. Run: npm run readme-counts:write\n\n` +
+      diffLines.join("\n") +
+      "\n",
+  );
+  process.exit(1);
+} else {
+  if (original === expected) {
+    console.log("OK: README.md already up to date — no changes written.");
+  } else {
+    fs.writeFileSync(readmePath, expected, "utf8");
+    console.log(
+      `OK: README.md updated (skills=${skillCount}, agents=${agentCount}, ` +
+        `providers=${providerCount}, roles=${roleCount}, rules=${ruleCount}, mcp=${mcpCount})`,
+    );
+  }
+}

package/skills/marketing/ai-advertising-targeting-fairness-review/SKILL.md

@@ -0,0 +1,43 @@
+---
+name: ai-advertising-targeting-fairness-review
+description: Use this skill when reviewing ad-platform audience targeting configurations and declared AI feature usage for protected-class discrimination risk. Trigger when a user provides a Meta Ads Manager audience definition, Google Ads targeting layer export, DSP deal config, or any ad platform audience spec annotated with AI features enabled (Advantage+ Audience, broad match, automated bidding, lookalike seeds). Use when a campaign is in housing, credit, employment, or insurance verticals, or when automated bidding or AI audience expansion is active on any campaign reaching the US or EU and the user needs to assess Fair Housing Act, ECOA, or EU AI Act Article 5 exposure.
+allowed-tools: Read Grep Glob
+metadata:
+  author: "github: Raishin"
+  version: "0.1.0"
+  updated: "2026-05-17"
+  category: ai
+  lifecycle: experimental
+---
+
+# AI Advertising Targeting Fairness Review
+
+## Purpose
+This skill reviews ad-platform audience targeting configurations and declared AI feature usage for protected-class discrimination risk under the Fair Housing Act (42 U.S.C. §3604), the Equal Credit Opportunity Act (ECOA), and EU AI Act Article 5. Ad platforms increasingly offer AI-driven audience expansion features — Meta Advantage+ Audience, Google broad match and Performance Max, DSP algorithmic deal targeting — that optimize delivery based on historical conversion patterns. When historical converters skew along protected-class lines (race, sex, age, national origin, familial status, disability, religion), algorithmic optimization propagates that skew without explicit intent. The review examines declared AI feature usage, audience seed composition, interest-segment proxy risk, and the absence of protected-category exclusion declarations on special-category campaigns before the configuration ships.
+
+## Lean operating rules
+- Treat Meta Advantage+ Audience enabled on a housing, credit, employment, or insurance campaign with no declared protected-category exclusions as HIGH — the system expands targeting beyond the declared audience using engagement signals that may correlate with race, sex, or national origin.
+- Treat interest-based segments that function as proxies for health conditions, religion, national origin, or familial status used on an insurance or financial-services campaign as HIGH — proxy targeting on protected classes is substantively equivalent to explicit targeting under FHA and ECOA case law.
+- Treat automated bidding (Target CPA, Target ROAS, Smart Bidding) optimizing a credit-offer, rental, or employment campaign on lookalike audiences seeded from historical converters as HIGH — disparate impact is propagated algorithmically when the seed population reflects historical discriminatory patterns.
+- Treat any AI-generated audience expansion (broad match, Performance Max audience signals, DSP algorithmic reach extension) active on a special-category campaign (housing, credit, employment, insurance) with no fairness audit trail as HIGH — the optimization objective does not include disparate-impact minimization.
+- Treat geofencing or geographic exclusion zones that closely follow racially or ethnically concentrated neighborhood boundaries on a housing or credit campaign as HIGH — geographic redlining is prohibited under FHA regardless of whether intent is declared.
+- Treat the absence of a Special Ad Category declaration on a Meta campaign reasonably classifiable as housing, employment, or credit as HIGH — the declaration unlocks mandatory fairness restrictions; omitting it circumvents them.
+- Flag automated bidding that optimizes on a conversion event defined as a past purchase or application when the historical converter population is not documented for demographic representativeness as MEDIUM — undocumented seed bias is a disparate-impact risk even when not yet proven.
+- Flag interest segments that include health-condition or medication-related categories on campaigns not in the healthcare vertical as MEDIUM — health proxies reach users based on inferred sensitive characteristics.
+- Flag AI feature disclosures that are absent or vague (e.g., "algorithmic optimization enabled" with no named feature, no version, no opt-out path) as MEDIUM — EU AI Act Article 13 and FTC guidance require meaningful transparency.
+- Do not recommend disabling AI features without naming the performance impact and the manual alternative that preserves reach.
+- Label every finding with evidence basis: audience spec provided, AI feature declaration provided, documentation-based, or inference from missing config.
+
+## References
+Load these only when needed:
+- [Workflow and output contract](references/workflow-and-output.md) — use when executing the full review or formatting the final answer.
+
+## Response minimum
+Return, at minimum:
+- AI feature inventory (named features enabled per campaign, evidence basis)
+- Special-category campaign detection (housing, credit, employment, insurance)
+- Protected-class proxy segment assessment (interest segments, lookalike seeds)
+- Algorithmic disparate-impact assessment (bidding, audience expansion)
+- Special Ad Category declaration check (Meta) or equivalent platform declaration
+- Severity-labelled finding list (critical / high / medium / low)
+- Safe next actions

package/skills/marketing/ai-advertising-targeting-fairness-review/metadata.json

@@ -0,0 +1,21 @@
+{
+  "id": "ai-advertising-targeting-fairness-review",
+  "name": "AI Advertising Targeting Fairness Review",
+  "type": "skill",
+  "provider": "marketing",
+  "harnesses": ["codex", "claude-code", "cursor", "gemini", "kiro", "other"],
+  "summary": "Review ad-platform audience targeting configurations and AI feature usage for protected-class discrimination risk under Fair Housing Act, ECOA, and EU AI Act Article 5 — proxy segments, algorithmic disparate impact, and missing Special Ad Category declarations.",
+  "source_type": "original",
+  "official_docs": [
+    "https://www.ftc.gov/business-guidance/blog/2023/02/ftcs-ai-related-enforcement-actions",
+    "https://www.hud.gov/program_offices/fair_housing_equal_opp/fair_housing_act_overview",
+    "https://www.consumerfinance.gov/about-us/blog/cfpb-issues-guidance-on-credit-denials-by-lenders-using-artificial-intelligence/",
+    "https://digital-strategy.ec.europa.eu/en/policies/regulatory-framework-ai",
+    "https://www.federalregister.gov/documents/2023/07/13/2023-14625/civil-rights-principles-for-the-use-of-artificial-intelligence"
+  ],
+  "security_notes": "Ad-platform AI features that optimize on historical converter populations can propagate protected-class disparate impact without explicit discriminatory intent. Review works from sanitized audience spec exports and declared AI feature annotations only; never request live campaign credentials, ad-account access tokens, or real user audience data.",
+  "last_verified": "2026-05-17",
+  "path": "skills/marketing/ai-advertising-targeting-fairness-review",
+  "author": "github: Raishin",
+  "version": "0.1.0"
+}

package/skills/marketing/ai-advertising-targeting-fairness-review/references/workflow-and-output.md

@@ -0,0 +1,150 @@
+# Workflow and Output Contract
+
+## Workflow
+
+### Step 1 — Collect inputs
+
+Ask the user to provide one or more of the following as sanitized exports (replace real values with placeholders; no real user PII, no ad-account credentials, no live audience membership data):
+- Ad platform audience definition export (Meta Ads Manager audience spec, Google Ads targeting layer export, DSP deal config)
+- Declared AI features enabled per campaign (e.g., Advantage+ Audience, broad match, Performance Max, Target CPA, automated bidding strategy)
+- Campaign vertical and ad category (housing, credit, employment, insurance, or other)
+- Seed-list demographics summary if a lookalike audience is in scope (aggregate only — no individual-level data)
+- Interest segment names or IDs included in the targeting stack
+- Platform Special Ad Category or equivalent fairness-restriction declaration, if any
+
+If the user provides only a partial set, note which sections are absent and scope findings accordingly.
+
+### Step 2 — Campaign vertical classification
+
+Classify the campaign into a fairness-risk tier before inspecting AI features:
+
+- **Tier 1 — Special category** (highest risk): housing/rental, mortgage/credit, employment/hiring, insurance underwriting or pricing. FHA, ECOA, and analogous EU AI Act provisions impose the strictest obligations.
+- **Tier 2 — Sensitive adjacent**: health products, financial services (non-credit), legal services, political advertising. Protected-class proxies and automated decisions warrant careful scrutiny.
+- **Tier 3 — General commercial**: e-commerce, SaaS, entertainment. Standard fairness hygiene applies but special-category rules do not.
+
+Any Tier 1 campaign with AI-driven audience expansion enabled is HIGH by classification — proceed to Step 4 immediately.
+
+### Step 3 — AI feature inventory
+
+Enumerate every declared AI feature active on the campaign:
+
+```text
+# Example inventory table
+| Feature                  | Platform | Campaign     | Opt-out available? |
+|--------------------------|----------|--------------|-------------------|
+| Advantage+ Audience      | Meta     | Housing_Q2   | Partial           |
+| Target CPA bidding       | Google   | Credit_Lead  | Yes               |
+| Broad match keywords     | Google   | Credit_Lead  | Yes               |
+| Lookalike expansion L1   | Meta     | Housing_Q2   | No                |
+```
+
+For each feature, note: whether it expands beyond declared audience, what optimization signal it uses, and whether a fairness constraint or protected-category exclusion is declared.
+
+### Step 4 — Protected-class proxy segment audit
+
+Inspect interest and behavioral segments for protected-class proxy risk:
+
+```text
+# HIGH — health-condition proxy on insurance campaign
+Interest segment: "Diabetes management apps" → infers health condition → protected under ADA, ECOA
+
+# HIGH — national-origin proxy via language and cultural affinity targeting
+Interest segment: "Spanish-language content" + "Latin music" → national origin proxy on housing campaign
+
+# MEDIUM — general health interest segment on non-healthcare campaign
+Interest segment: "Fitness & wellness" → weaker proxy; flag for review but lower confidence
+```
+
+Flag segments that reliably infer race, sex, age, national origin, familial status, disability, or religion — even when those characteristics are not named explicitly.
+
+### Step 5 — Algorithmic disparate-impact assessment
+
+Assess whether automated bidding or audience expansion propagates historical bias:
+
+```text
+# HIGH — lookalike seeded from historical converters, no demographic audit
+Seed list: "past_mortgage_applicants_2019_2023"
+Lookalike: L1% similarity expansion
+Risk: If historical applicants skew by race or national origin, the lookalike inherits that skew.
+Mitigation: Demographic representativeness audit of seed list required.
+
+# HIGH — Target CPA on credit-offer campaign, conversion event = "application_submitted"
+Risk: CPA optimization deprioritizes delivery to audiences with lower historical application rates,
+      which may correlate with protected-class membership.
+```
+
+### Step 6 — Platform fairness-declaration check
+
+For Meta campaigns: confirm whether a Special Ad Category (Housing, Employment, Credit) is declared. Absence on a Tier 1 campaign is HIGH — it circumvents mandatory targeting restrictions.
+
+For Google: confirm whether Limited Ad Serving policies are acknowledged and whether sensitive-category restrictions are applied.
+
+For DSPs: confirm whether deal-level fairness constraints (e.g., no health-condition targeting, no age exclusions) are documented.
+
+### Step 7 — Geographic redlining check
+
+Inspect geofencing and location exclusions for patterns that trace protected-class neighborhood boundaries:
+
+```text
+# HIGH — exclusion zone matches historic redlining district boundaries
+Excluded ZIP codes: [10031, 10037, 10039] on NYC housing campaign
+These ZIPs are majority-minority neighborhoods; exclusion on a housing campaign = FHA §3604 risk.
+```
+
+Compare exclusion zones against publicly available fair-lending geography if the artifact suggests geographic selectivity.
+
+### Step 8 — Produce the output
+
+Format findings using the Output section below.
+
+---
+
+## Output
+
+Return findings in this structure:
+
+```
+## Verdict
+<one sentence: pass / needs work / critical issues found>
+
+## Evidence level
+<audience spec provided | AI feature declaration provided | documentation-based | inference>
+
+## Campaign tier
+<Tier 1 special-category | Tier 2 sensitive adjacent | Tier 3 general commercial>
+
+## AI feature inventory
+<table of features, platform, campaign, opt-out status>
+
+## Findings
+
+### CRITICAL
+- [C1] <finding title>: <description> — <remediation>
+
+### HIGH
+- [H1] <finding title>: <description> — <remediation>
+
+### MEDIUM
+- [M1] <finding title>: <description> — <remediation>
+
+### LOW
+- [L1] <finding title>: <description> — <remediation>
+
+## Safe next actions
+1. <action>
+2. <action>
+
+## Open questions
+- <question requiring user clarification>
+```
+
+---
+
+## Security and scope notes
+
+- This is a static review. Never request live campaign credentials, ad-account access tokens, real audience membership lists, or individual-level conversion data.
+- A finding here may constitute a fair lending, fair housing, or EU AI Act compliance violation — flag that possibility and route legal determination to qualified counsel and compliance teams. Do not make the legal determination yourself.
+- Algorithmic disparate impact is a legal theory that can apply even when no protected characteristic is named — proxy targeting and optimized delivery on skewed seed populations are within scope.
+- Hashing or pseudonymizing a seed list does not eliminate the disparate-impact risk from a demographically unrepresentative seed population.
+- When evidence is partial, scope each finding to what was provided and state the assumption explicitly.
+- Do not recommend disabling AI features without naming the performance impact and a manual targeting alternative.

package/skills/marketing/analytics-data-minimization-review/SKILL.md

@@ -0,0 +1,44 @@
+---
+name: analytics-data-minimization-review
+description: Use this skill when reviewing analytics platform configuration — GA4 property settings, BigQuery export schema, custom event-parameter definitions, and user-property declarations — for data-minimization violations, excessive collection, and storage-period over-retention. Trigger when a user provides a GA4 property configuration export, a BigQuery raw-event export schema, a custom event or user-property inventory, data-retention settings, or asks whether their analytics setup collects more personal data than necessary, retains data longer than required, or converts an analytics platform into a personal-data processor. Distinct from marketing-pixel-data-leakage-review: this skill reviews what analytics platforms collect and retain internally, not outbound pixel payloads to ad networks.
+allowed-tools: Read Grep Glob
+metadata:
+  author: "github: Raishin"
+  version: "0.1.0"
+  updated: "2026-05-17"
+  category: data
+  lifecycle: experimental
+---
+
+# Analytics Data-Minimization Review
+
+## Purpose
+This skill reviews analytics platform configuration — GA4 property settings, BigQuery export schema, custom event-parameter definitions, and user-property declarations — for data-minimization violations, excessive collection, and storage-period over-retention. Analytics platforms are a primary regulatory surface for GDPR enforcement: European DPAs (Austrian DSB, French CNIL, Italian Garante) have found that user_pseudo_id, IP address, and precise geo combined with a BigQuery export constitute transfers of personal data requiring a lawful basis, a valid transfer mechanism, and compliance with the storage-limitation principle under GDPR Article 5(1)(e). This skill is distinct from `marketing-pixel-data-leakage-review` — it reviews what analytics platforms collect and retain internally (schema, user properties, retention periods), not outbound pixel payloads transmitted to ad networks. The review works from sanitized configuration exports only; never request live analytics data or real user identifiers.
+
+## Lean operating rules
+- Treat a GA4 user-scoped custom dimension populated with a persistent first-party user ID linked to a CRM contact record as HIGH — it converts GA4 into a personal-data processor for identified individuals, triggering DPA obligations and requiring a separate documented lawful basis beyond the analytics purpose.
+- Treat a BigQuery raw-event export retaining user_pseudo_id and geo.city at full precision with no anonymization transform or partitioned deletion job as HIGH — the combination of fields constitutes personal data under GDPR, and uncontrolled raw export creates an unmanaged data store with no retention ceiling.
+- Treat a data-retention period set to the maximum (14 months in GA4) with no documented justification tied to a specific, time-bound analytical purpose as HIGH — GDPR Article 5(1)(e) requires retention only as long as necessary; the maximum is not a default entitlement.
+- Treat user properties collecting device fingerprint components, precise IP, or persistent advertising identifiers (GCLID, FBCLID passed as user properties) in a property lacking a valid transfer mechanism for non-EEA exports as HIGH — these fields individually or in combination constitute personal data with cross-border transfer obligations.
+- Treat event parameters collecting free-text field values from search queries, form inputs, or support chats as HIGH — free-text fields frequently contain names, emails, or health information that exceed the analytics collection purpose.
+- Treat session-scoped custom dimensions collecting full URL paths that include query parameters with PII (e.g., `/reset?email=user@example.com`) as HIGH — URL-embedded PII is personal data regardless of whether it was intentionally collected.
+- Flag custom event schemas that duplicate standard GA4 automatically collected events with additional parameters adding no documented analytical value as MEDIUM — redundant collection without justification violates data minimization under GDPR Article 5(1)(c).
+- Flag BigQuery export schemas that retain raw event data beyond the property's configured retention period because no partition-expiry or scheduled query enforces deletion as MEDIUM — the property setting does not automatically govern the export.
+- Flag user-property schemas with no documented owner, purpose, or review date as MEDIUM — absence of governance documentation is a proxy indicator of speculative or abandoned collection.
+- Do not recommend disabling an event or parameter without naming the analytical purpose it serves and the impact of its removal on measurement continuity.
+- Label every finding with evidence basis: configuration export provided, schema provided, documentation-based, or inference from missing element.
+
+## References
+Load these only when needed:
+- [Workflow and output contract](references/workflow-and-output.md) — use when executing the full review or formatting the final answer.
+
+## Response minimum
+Return, at minimum:
+- User-scoped custom dimension assessment (CRM linkage, persistent identifiers)
+- BigQuery export schema assessment (field precision, anonymization, partitioned deletion)
+- Data-retention period assessment (documented justification vs. maximum default)
+- User-property and event-parameter PII assessment (free-text, URL-embedded PII, fingerprint components)
+- Cross-border transfer assessment (user_pseudo_id + geo fields in non-EEA export)
+- Schema governance assessment (owner, purpose, review date)
+- Severity-labelled finding list (critical / high / medium / low)
+- Safe next actions

package/skills/marketing/analytics-data-minimization-review/metadata.json

@@ -0,0 +1,22 @@
+{
+  "id": "analytics-data-minimization-review",
+  "name": "Analytics Data-Minimization Review",
+  "type": "skill",
+  "provider": "marketing",
+  "harnesses": ["codex", "claude-code", "cursor", "gemini", "kiro", "other"],
+  "summary": "Review analytics platform configuration — GA4 property settings, BigQuery export schema, custom event-parameter definitions, and user-property declarations — for data-minimization violations, excessive collection, and storage-period over-retention under GDPR Article 5(1)(c) and 5(1)(e) and EU DPA enforcement on GA4.",
+  "source_type": "original",
+  "official_docs": [
+    "https://gdpr-info.eu/art-5-gdpr/",
+    "https://www.cnil.fr/en/use-google-analytics-and-data-transfers-united-states-cnil-orders-website-manageroperator-comply/",
+    "https://www.cnil.fr/en/google-analytics-and-data-transfers-how-make-your-analytics-tool-compliant-gdpr",
+    "https://www.garanteprivacy.it/home/docweb/-/docweb-display/docweb/9782874",
+    "https://support.google.com/analytics/answer/9019185"
+  ],
+  "security_notes": "Read-only static review of sanitized analytics configuration exports and schema definitions only. Never request live analytics data, raw event exports containing real user identifiers, GA4 admin credentials, or BigQuery service-account keys. Findings may indicate cross-border data transfer violations requiring DPA notification — route remediation and legal assessment to qualified privacy counsel before acting on findings.",
+  "last_verified": "2026-05-17",
+  "path": "skills/marketing/analytics-data-minimization-review",
+  "author": "github: Raishin",
+  "version": "0.1.0",
+  "lifecycle": "experimental"
+}