{"id":77126,"plugin_id":"plugins_6ab424ad5b448191b8fede2ebf569333","kind":"skill","collection_source":"plugin_package","comparison_source":null,"observed_at":"2026-11-03T00:12:27.503Z","digest":"c5dfeed67fc44d21166bd44a80095948dd563d91316cf3e8c005072d40b2296a","against":null,"payload":{"description":"Review data-pipeline permissions, secrets, PII, tenant isolation, lineage, retention and audit boundaries.","included_files":[],"name":"secure-data-platform","skill_md_contents":"---\nname: secure-data-platform\ndescription: Review data-pipeline permissions, secrets, PII, tenant isolation, lineage, retention and audit boundaries.\n---\n\n\n# Security and governance\n**Trigger:** Sensitive data, cross-tenant risk, permissions, credentials, governance, audit, retention, regulated data or shared datasets.\n\n1. Identify assets and data classifications, trust boundaries, account identity, storage paths, catalog permissions and external sink destinations.\n2. Check least-privilege roles, secrets storage, identity propagation to downstream jobs, encryption, logs/lineage and accidental PII in samples/tests.\n3. Examine row/column access, masking, tenant filters, dataset sharing, retention and deletion propagation throughout derived tables.\n4. Account for external shortcuts and linked resources, cross-workspace service identities, exports and staging buckets.\n5. Review credential rotation, incident response, audited writes and break-glass flows; don't ask users to paste credentials in chat.\n6. Recommend concrete threat tests, permission checks and a rollout that cannot silently broaden access.\n\nUse `../../references/security-governance.md` and `../../references/core-invariants.md`.\n"},"changes":[],"summary":"First saved snapshot. No earlier version is available for comparison.","summary_kind":"deterministic","summary_metadata":{}}