skills/privacy-first-vcard-qr/SKILL.md

---
name: privacy-first-vcard-qr
description: Create a vCard QR code after minimizing and reviewing the personal information it will disclose. Use when the user wants a networking, business-card, conference, portfolio, or public contact QR and wants help deciding which contact fields are appropriate to share. Do not use to enrich contact data from external sources or publish private fields without clear user intent.
---

# Privacy-First vCard QR

## Gather the contact details

Use only details the user supplied or explicitly approved. The supported vCard fields are first name, last name, organization, title, phone numbers, email addresses, website, address, and note.

Classify proposed fields before encoding:

- **Clearly public:** details the user identifies as business, professional, event-facing, or already intended for publication.
- **Potentially sensitive:** personal mobile numbers, personal email addresses, street addresses, free-form notes, or mixed business and personal details.

When intent is unclear for a potentially sensitive field, omit it or ask whether it should be public. Do not add inferred social profiles, photographs, birthdays, identifiers, or addresses.

## Prepare the vCard

1. Normalize surrounding whitespace in names, phone numbers, emails, and the website without inventing missing values.
2. Keep multiple approved phone numbers and email addresses as separate entries.
3. Require the website to be supplied explicitly; do not search for one.
4. Use the address and note only when the user clearly wants them encoded.
5. Give the user a concise disclosure summary before or alongside creation when sensitive fields are included.

Call `qr-code` with only `qrCodeInformation` using:

- `kind: "vcard"`
- The approved fields, using empty strings or empty arrays for unused supported fields.
- `encodedText: ""` so the app performs canonical serialization.

Treat the normalized tool output as authoritative.

## Deliver the result

Provide:

- A field-by-field summary of what the QR shares.
- A separate note for any deliberately omitted sensitive information.
- The editable vCard QR widget and a reminder that the exported image contains all approved fields.

Avoid repeating sensitive field values more often than needed.

## Boundaries

Do not validate mailbox ownership, phone ownership, website availability, or the identity of the contact. Do not claim support for photos, social-profile fields, cryptographic signatures, or remote contact-book updates. The workflow creates a QR payload only.