vm-data-protection-reviewer

# Data Protection Reviewer Skill

Assesses encryption, key management, secret storage, and PII handling practices.

## Brownfield Context

This skill assesses **existing data protection practices** in inherited or in-production code. It does not assume a modern encryption baseline — it identifies whatever is currently in place and flags deviations from secure practice. Particularly valuable for brownfield systems where encryption or secret management may have evolved inconsistently over time.

## When to Use This Skill

- Reviewing cryptographic implementations in existing code (at rest and in transit)
- Checking key management practices in inherited systems
- Validating secret storage — hardcoded credentials, environment variable usage
- Assessing PII/sensitive data handling in brownfield applications
- Verifying cryptographic algorithm currency (deprecated algorithms detection)
- Checking for data exposure risks in configuration files or source code

## Unitary Function

**ONE RESPONSIBILITY:** Assess data protection mechanisms (encryption, keys, secrets, PII)

**NOT RESPONSIBLE FOR:**
- Authentication review (see vm-auth-auditor)
- General vulnerability scanning (see vm-vulnerability-scanner)
- Compliance mapping (see vm-compliance-checker)
- Fixing data protection issues (read-only skill)

## Input

```json
{
  "source_path": "Path to source code directory",
  "config_path": "Optional path to configuration files",
  "scope": "full|file_list",
  "files": ["optional explicit file list for change-scoped review"],
  "data_classification": "public|internal|confidential|restricted"
}
```

## Output

```json
{
  "audit_id": "uuid",
  "generated_by": {
    "skill": "vm-data-protection-reviewer",
    "version": "1.0.0"
  },
  "timestamp": "ISO-8601",
  "source_path": "string",
  "risk_score": "Critical|High|Medium|Low",
  "findings": {
    "encryption_at_rest": [
      {
        "severity": "Critical",
        "issue": "Database passwords stored in plaintext config file",
        "location": "config/database.yml:12",
        "remediation": "Use environment variables with a secrets manager (e.g., Azure Key Vault, AWS Secrets Manager)"
      }
    ],
    "encryption_in_transit": [
      {
        "severity": "High",
        "issue": "HTTP connection to payment API (not HTTPS)",
        "location": "services/payment.py:67",
        "remediation": "Use HTTPS with certificate validation enforced"
      }
    ],
    "key_management": [],
    "secret_storage": [],
    "pii_handling": [],
    "cryptographic_algorithms": []
  },
  "recommendations": []
}
```

## Protection Areas Reviewed

- **Encryption at Rest**: Database encryption, file encryption, disk encryption indicators
- **Encryption in Transit**: TLS/SSL usage, certificate validation, deprecated protocol versions (TLS 1.0/1.1)
- **Key Management**: Key generation practices, storage location, rotation indicators, access control
- **Secret Storage**: Hardcoded credentials, API keys, tokens, certifica