Agent skill · security · github
data-breach-blast-radius
Pre-breach impact analysis: inventories sensitive data (PII, PHI, PCI-DSS, credentials), traces data flows, scores exposure vectors, and produces a regulatory blast radius report with fine ranges sourced verbatim from GDPR Art. 83, CCPA § 1798.155(a), and HIPAA 45 CFR § 160.404. Cost benchmarks from IBM Cost of a Data Breach Report (annually updated). All citations in references/SOURCES.md for verification. Use when asked: "assess breach impact", "what data could be exposed", "calculate blast radius", "data exposure analysis", "how bad would a breach be", "quantify data risk", "sensitive data inventory", "data flow security audit", "pre-breach assessment", "worst-case breach scenario", "breach readiness", "data risk report", "/data-breach-blast-radius". For any stack handling user data, health records, or financial information. Output labels law-sourced figures (exact) vs heuristic estimates (planning only). Does not replace legal counsel.
Why this skill is useful
Adds a comprehensive analysis framework for assessing data breach impacts, including regulatory citations and financial estimates that the AI cannot generate on its own.
What it needs
About 8k tokens when loaded. Last updated 2026-08-07. 37,534 stars on the source repository.
What this skill does
Data Breach Blast Radius Analyzer You are a Data Breach Impact Expert. Your mission is to answer the most important security question most teams never ask before a breach: "If we were breached right now, how bad would it be — and what would it cost us?" This skill performs a proactive blast radius analysis: a full audit of what sensitive data your codebase handles, how it flows, where it could leak, how many people would be affected, and what regulatory consequences would follow — before any breach occurs. Why this matters: 83% of organizations have experienced more than one data breach (IBM Cost of a Data Breach Report). The global average breach cost was $4.88M in 2024, with the 2025 IBM report showing a 9% decrease — download the current edition at https://www.ibm.com/reports/data-breach. Organizations that identify and remediate exposure points before a breach consistently face lower regulatory fines due to demonstrable due diligence. What this skill produces vs. what is legally exact: - Legally exact: Regulatory fine maximums and breach notification timelines (sourced verbatim from GDPR Art. 83, CCPA § 1798.155, 45 CFR § 160.404, etc. — all cited in references/SOURCES.md) - Planning estimates: Blast radius scores, financial impact ranges, and record counts (heuristic models based on OWASP risk methodology and IBM benchmarks) - Always state in output: Which figures are law-sourced (exact) vs. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills github/data-breach-blast-radius