Skill: mindbomber/aana-private-data-guardrail (version 1.0.0)

# AANA Private Data Guardrail Skill Use this skill when an OpenClaw-style agent may draft, summarize, send, display, transform, or act on private account, billing, payment, health, legal, personal, or sensitive business data. This is an instruction-only skill. It does not install packages, run commands, write files, call services, persist memory, or execute a checker on its own. ## Core Principle Private data should be used only when it is necessary, authorized, minimized, and safe for the current user-visible task. The agent should separate: - data the user explicitly provided, - data available from authorized tools, - data that is private and should not be repeated, - data that is missing and must be requested or verified, - data that should be redacted, summarized, deferred, or refused. ## When To Use Use this skill before: - sending emails, chats, tickets, or support replies, - summarizing account, billing, payment, legal, health, HR, student, customer, or personal records, - sharing screenshots, logs, exports, attachments, or reports, - making account, refund, eligibility, diagnosis, legal, financial, or policy claims, - using private records to personalize an answer, - copying data from one system or context into another, - storing memories or notes about a person, - publishing or forwarding anything containing private details. ## Private Data Classes Treat these as sensitive: - account identifiers, order IDs, customer IDs, addresses, phone numbers, emails, - payment methods, card numbers, bank details, invoices, balances, subscriptions, - health symptoms, diagnoses, medications, insurance details, appointments, - legal facts, case details, contracts, immigration, disputes, compliance records, - employment, payroll, performance, school, family, or relationship records, - API keys, tokens, passwords, credentials, auth headers, recovery codes, - private messages, attachments, images, transcripts, logs, or internal notes. ## AANA Privacy Loop 1. Identify the action: what the agent is about to reveal, send, summarize, store, or decide. 2. Classify the data: public, user-provided, authorized private, restricted, secret, or unrelated. 3. Check necessity: remove anything not required for the current user request. 4. Check authorization: verify that the user has asked for this use and the context permits it. 5. Minimize: replace raw values with redacted summaries when possible. 6. Verify claims: do not invent account facts, eligibility, balances, policy outcomes, diagnoses, or legal conclusions. 7. Choose action: accept, revise, ask, defer, refuse, or route to human review. ## Redaction Rules Prefer: - "payment method on file" instead of a card number, - "order ID unavailable" instead of invented order IDs, - "refund eligibility unknown" instead of a refund promise, - "health detail redacted" instead of symptoms unless needed, - "legal status requires review" instead of legal conclusions, - "account identifier present" instead of copying the identifier. Do not expose: - API keys or bearer tokens, - passwords or recovery codes, - full payment numbers, - private account records unrelated to the task, - health, legal, or financial details not needed for the answer, - private messages or attachments unrelated to the current request. ## Allowed Actions - Accept: the content contains only necessary, authorized, minimized data. - Revise: the answer is useful but includes unnecessary private data or unsupported account claims. - Ask: required permission, identity, context, or missing facts must be clarified. - Defer: the action needs a verified system, stronger tool, human review, or compliance boundary. - Refuse: the request asks to expose secrets, unrelated private data, or unauthorized records. ## High-Risk Cases Pause and ask for review before: - sending private data to a third party, - posting private data publicly, - revealing another person's data, - making refund, billing, health, legal, financial, employment, or eligibility decisions, - storing memory about a person, - using sensitive data outside the original purpose, - combining private records from multiple contexts. ## Review Payload When using a configured AANA checker, send only a minimal redacted review payload: - `task_summary` - `data_classes` - `candidate_disclosure_summary` - `authorization_status` - `minimization_status` - `unsupported_private_claims` - `recommended_action` Do not include raw secrets, tokens, full payment data, private messages, health records, legal records, or full account files when a redacted summary is enough. ## Decision Rule - If private data is unnecessary, remove it. - If authorization is unclear, ask. - If facts are missing, ask or defer. - If the content invents account, billing, payment, health, legal, or personal facts, revise. - If the request seeks unauthorized disclosure, refuse and explain briefly. - If the action is high-impact or irreversible, defer to human review or a verified system. - If a checker is unavailable or untrusted, use manual privacy review. ## Output Pattern For privacy-sensitive replies, prefer: ```text Safe response: - ... Privacy handling: - Used only necessary details. - Redacted sensitive fields. - Did not verify or invent missing private facts. Next step: - Ask / verify / defer if needed. ``` Do not include the privacy-handling note unless useful to the user or needed for review.

path: manifest.json
content: {
  "name": "aana-private-data-guardrail",
  "slug": "aana-private-data-guardrail",
  "version": "0.1.0",
  "type": "instruction_only_skill",
  "description": "AANA-grounded privacy guardrail instructions for preventing agents from exposing private account, billing, payment, health, legal, or personal data.",
  "entrypoint": "SKILL.md",
  "bundled_code": false,
  "installs_dependencies": false,
  "executes_commands": false,
  "writes_files": false,
  "writes_event_files": false,
  "persists_memory": false,
  "requires_user_approval_for_persistence": true,
  "requires_user_approval_for_third_party_disclosure": true,
  "data_handling": {
    "prefer_redacted_summaries": true,
    "store_payloads_by_default": false,
    "requires_redaction": true,
    "forbidden_payload_content": [
      "API keys",
      "bearer tokens",
      "passwords",
      "recovery codes",
      "full payment numbers",
      "bank account numbers",
      "unnecessary account records",
      "unrelated private messages",
      "raw health records",
      "raw legal records"
    ]
  },
  "privacy_boundary": {
    "must_minimize_private_data": true,
    "must_not_expose_secrets": true,
    "must_not_invent_account_facts": true,
    "must_not_make_unverified_refund_or_eligibility_promises": true,
    "must_ask_when_authorization_is_unclear": true,
    "must_defer_high_impact_or_irreversible_actions": true,
    "may_not_store_memory_without_permission": true,
    "may_not_share_third_party_data_without_permission": true
  },
  "aana_boundary": {
    "checker_bundled": false,
    "checker_required": false,
    "allowed_checker_interfaces": [
      "approved host tool configured by the user or administrator",
      "approved in-memory API connector configured by the user or administrator",
      "manual review"
    ]
  },
  "schemas": [
    "schemas/private-data-review.schema.json"
  ],
  "examples": [
    "examples/redacted-private-data-review.json"
  ]
}


path: README.md
content: # AANA Private Data Guardrail Skill

This OpenClaw-style skill helps agents avoid exposing private account, billing, payment, health, legal, personal, or sensitive business data.

## Marketplace Slug

Recommended slug:

```text
aana-private-data-guardrail
```

## Contents

- `SKILL.md`: agent-facing instructions.
- `manifest.json`: review metadata and boundaries.
- `schemas/private-data-review.schema.json`: optional review-payload shape.
- `examples/redacted-private-data-review.json`: safe example payload.

## What It Does

The skill asks the agent to:

1. Identify private data classes.
2. Check whether the data is necessary and authorized.
3. Remove or redact unnecessary sensitive details.
4. Avoid invented account, billing, payment, health, legal, or personal facts.
5. Ask, defer, revise, or refuse when disclosure is unsafe.

## What It Does Not Do

This package does not:

- install dependencies,
- execute code,
- call remote services,
- write files,
- persist memory,
- inspect accounts by itself,
- make compliance decisions by itself.

## Safety Model

Use redacted summaries for review payloads. Do not include API keys, bearer tokens, passwords, recovery codes, full payment numbers, bank account numbers, raw health records, raw legal records, or unrelated private messages.

High-impact or irreversible disclosures should go to a verified system or human review.


path: schemas/private-data-review.schema.json
content: {
  "title": "AANA Private Data Review",
  "type": "object",
  "required": [
    "task_summary",
    "data_classes",
    "candidate_disclosure_summary",
    "authorization_status",
    "recommended_action"
  ],
  "properties": {
    "task_summary": {
      "type": "string",
      "minLength": 1
    },
    "data_classes": {
      "type": "array",
      "items": {
        "type": "string",
        "enum": [
          "public",
          "account",
          "billing",
          "payment",
          "health",
          "legal",
          "personal",
          "employment",
          "education",
          "credential",
          "private_message",
          "sensitive_business",
          "unknown"
        ]
      }
    },
    "candidate_disclosure_summary": {
      "type": "string",
      "minLength": 1
    },
    "authorization_status": {
      "type": "string",
      "enum": [
        "authorized",
        "unclear",
        "unauthorized",
        "not_needed"
      ]
    },
    "minimization_status": {
      "type": "string",
      "enum": [
        "minimal",
        "contains_unnecessary_private_data",
        "contains_secret",
        "needs_redaction"
      ]
    },
    "unsupported_private_claims": {
      "type": "array",
      "items": {
        "type": "string"
      }
    },
    "redactions_required": {
      "type": "array",
      "items": {
        "type": "string"
      }
    },
    "recommended_action": {
      "type": "string",
      "enum": [
        "accept",
        "revise",
        "ask",
        "defer",
        "refuse"
      ]
    },
    "human_review_required": {
      "type": "boolean"
    }
  },
  "additionalProperties": false
}


path: examples/redacted-private-data-review.json
content: {
  "task_summary": "Draft a customer support reply about a refund request.",
  "data_classes": [
    "account",
    "payment"
  ],
  "candidate_disclosure_summary": "The draft would reveal a redacted payment detail and promise refund eligibility even though eligibility is unknown.",
  "authorization_status": "unclear",
  "minimization_status": "needs_redaction",
  "unsupported_private_claims": [
    "Refund eligibility is not verified.",
    "Payment timing is not verified."
  ],
  "redactions_required": [
    "payment detail",
    "unverified account identifier"
  ],
  "recommended_action": "revise",
  "human_review_required": false
}


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)