third-party-privacy

Every third-party request tells that third party at least the visitor's IP address, user agent, and the page they were on. This skill lists who those third parties are and whether the site knows it.

Activate when

Any third-party origin appears in network traffic or source (fonts, CDNs, embeds, widgets, SDKs).
The privacy notice needs a recipient list, or the owner wants to reduce external dependencies.
Not to rule on international transfer legality or contractual terms with vendors (REVIEW REQUIRED).

Inspect

Runtime map (OBSERVED). node scripts/observe-runtime.mjs --url <site> --settle 2000 --json (paths relative to this skill's folder). Read thirdPartyHosts and vendors per snapshot. Do it for the home page, a form page, a page with embeds, and a checkout/login page if reachable. Unclassified hosts are listed; identify each (script URL, docs, search the source for the host).
Source map (SOURCE-INDICATED). <script src>, <link href> to other origins, CSS @import/url(), <iframe> embeds, SDK imports, server-side calls to APIs (payments, email, AI, CRM, maps) that receive user data.
For each recipient record: what it is; category; what it receives (IP and page URL always; cookies? user identifiers? form data? message content?); when it loads (before or after choice); whether it is necessary for a feature the visitor requested; whether it can be self-hosted or replaced (Google Fonts → self-hosted fonts; YouTube embed → youtube-nocookie.com or click-to-load facade; map → static image or click-to-load).
Personal data reaching them. For forms, run a local/staging submit step with --canary and read CANARY_SENT_TO_THIRD_PARTY (which host, which field, which encoding).
Disclosure. Which recipients does the notice name? Which does it omit? Which named ones never appear?
Server-side recipients you cannot observe from the browser are UNKNOWN: list them from code and env templates as SOURCE-INDICATED.