data-flow-mapping

Every privacy statement, deletion promise, and vendor list rests on one question: what data enters, where does it go, and where is it stored? This skill answers it from code and traffic.

Activate when

• Before drafting or checking a privacy notice, a deletion/export flow, or a vendor list.
• The product has forms, accounts, checkout, uploads, or server routes that receive user data.
• Not to assign legal bases or conclude what is lawful.

Working alone

This skill is self-contained. Its companions (declared in its metadata) are skills whose method it may need to do its own promised work. Use of a companion can be conditional: declaring one does not mean running it. When a companion's lane applies, use the skill if it is installed; if not, follow its short entry in references/companion-methods.md and say in your report which lanes ran inline at reduced depth. Never skip an applicable lane silently. Skills mentioned here only for escalation, referral, documentation, or optional deeper follow-up are not dependencies: report the hand-off and finish honestly.

Companions: cookie-and-storage-audit.

Inspect