data-governance-privacy
Activate when classifying data (PII, sensitive, internal, public), running a Privacy Impact Assessment (PIA/DPIA), defining retention or deletion policies, designing GDPR/CCPA compliance workflows, handling subject access requests (SAR) or right-to-erasure, evaluating cross-border data transfers (EU SCCs, adequacy decisions), scoping data minimisation, reviewing new third-party data sharing, or assessing EU AI Act Article 10/13 data transparency obligations for an ML/LLM feature that trains on user data. Use before a feature that collects, stores, shares, or trains on user data is shipped.
Repository SourceNeeds Review
prd-creator
Activate when the user wants to create a Product Requirements Document (PRD) from scratch, convert rough ideas or bullet points into a structured PRD, validate or improve an existing PRD, facilitate discovery sessions to extract requirements, review a PRD for completeness before it enters the development workflow, or prepare a PRD that will feed into the SDLC pipeline (requirements-tracer, specification-driven-development, design-doc-generator). Also trigger for: "write a PRD", "define the product", "what are we building", "capture requirements", "product spec", "feature definition", "we have an idea", "turn this into requirements", "requirements document", "product brief".
Repository SourceNeeds Review
specification-driven-development
Governs contract-first and specification-driven development — defining interfaces, schemas, and workflows before implementation begins. Use this skill whenever the user wants to: write an OpenAPI 3.x specification, author a Protobuf or gRPC schema, define an AsyncAPI spec for event-driven interfaces, write a GraphQL schema, write a JSON Schema, review an API contract for completeness or correctness, detect breaking vs non-breaking changes, design a workflow or sequence before coding it, or validate that an implementation matches its contract. Also trigger for: "define the interface before coding", "API spec", "contract-first", "freeze the contract", "service contract", "define the schema", "sequence diagram", "API design", "contract review", "Protobuf", "AsyncAPI", "OpenAPI", "gRPC schema", "GraphQL schema", "schema-first GraphQL", "write the schema before resolvers", "GraphQL API design".
Repository SourceNeeds Review
technical-risk-management
Identifies, rates, owns, and tracks technical and project risks. Use this skill whenever the user wants to: create or update a risk register, identify risks in a new design or delivery plan, rate a risk using probability and impact, design a mitigation strategy, track risk status, or define early warning indicators for specific risks. Also trigger when the user describes risk situations without naming them: "what could go wrong", "I'm worried about the timeline", "this dependency is outside our control", "technical risks", "delivery risk", "risk assessment", "risk mitigation", "risk tracking", "early warning".
Repository SourceNeeds Review