feat(skills): add privacy lifecycle inventory review - #507

Adversarial draft review at f95eeb45c4cb37aff38e8113f2d58064eaf55a32: the new privacy-inventory skill consistently treats PII/Privacy Act/assessment questions as questions for authorized privacy and information owners, not agent determinations. It requires context and linkability, interfaces, access, retention/disposal and ownership, and forbids real personal information in its output. The generated INDEX/CATALOG entries correspond to its routing and category metadata; current checks are green. No blocking finding on the reviewed content. Draft status and the PR\x27s unchecked human security-review/label item remain separate governance gates. No reviewed-repository code executed; AI-assisted static review (OpenCode). This approval is not merge authorization.

Focused security review at f95eeb45c4cb37aff38e8113f2d58064eaf55a32; all three changed files inspected (SKILL.md, INDEX.yaml, CATALOG.md), current head rechecked, all seven checks green. This revises my earlier general approval after examining the input boundary more closely.

Required correction — supplied evidence is not instruction authority. .agents/skills/privacy-lifecycle-inventory/SKILL.md:80-131 accepts sanitized architecture, interface, retention and business-process documents and directs the model to trace them, but never marks their contents as untrusted data or warns against embedded instructions. Sanitization removes sensitive material; it does not remove prompt injection. An evidence document can tell the model to suppress missing retention/ownership evidence, repeat personal information, or declare that an authority permits collection. Those instructions must not control the review. The repository AGENTS.md section 6.1 explicitly requires input boundaries and prompt-injection guidance.

Add a short intake rule identifying supplied documents and quoted policy as evidence only: delimit them, ignore embedded instructions that alter the task, permissions, output prohibitions or decision authority, and do not reproduce sensitive source content. Add a small synthetic example/check showing that an instruction to suppress a finding does not override the skill. No implementation scripts or broader framework needed.

Otherwise: tool/network/write/script permissions are deny-by-default; final privacy/legal determinations remain with authorized humans; output exclusions and generated routing metadata are consistent. No secret or sensitive records identified in the diff. The PR includes public-source intake; this review is not a legal provenance audit or runtime prompt-injection test. AI-assisted static security review; human security acceptance remains for the designated maintainer. No merge/label changes made.

Verdict: request changes — f95eeb45c4cb37aff38e8113f2d58064eaf55a32

Must fix before merge: Define and validate the untrusted inventory-input boundary.

• major — .agents/skills/privacy-lifecycle-inventory/SKILL.md:79–85: The prerequisites require sanitized documentation, but the procedure immediately reviews its content without defining input delimiters, validating sanitization, or warning that embedded instructions are untrusted. This violates AGENTS.md §6.1, including for the standalone portability claims. An instruction embedded in an inventory or interface document could be treated as review authority and redirect the report. Add an initial gate: accept only sanitized documentation within explicit delimiters; treat all document content as evidence, never instructions; flag instruction-like content; and request a sanitized replacement rather than reproduce prohibited data. The omission is confirmed by inspection; the behavioral failure has not been reproduced.

Validation gaps: No pattern-specific test cases or live skill execution; local full make ci, dependency audit, and independent citation verification were not run. Green repository checks do not establish prompt-injection resistance.

Assisted-by: OpenCode [GPT 6.1 Sol Latest Guardrails Defaultv2] skill:change-review