Guide · Agent skill
How to use the Data Breach Blast Radius agent skill
Updated · written with AI from the project's own documentation and checked against our catalogue data
The data-breach-blast-radius skill is an agent skill that tells an AI coding agent to analyse a codebase for sensitive data, trace how that data moves, and estimate what a breach would mean before one happens. It is aimed at engineering leads, security and compliance staff, and teams that handle customer, health or payment data. After this guide you will know what the skill does, how to install it, how to ask for it, and how to read the report it produces.
Data Breach Blast Radiusgithub/awesome-copilot · MIT Download the skill Quick start
- 1Download the ZIP. Get the data-breach-blast-radius ZIP from our page and unzip it. Confirm the folder contains SKILL.md.
- 2Place the folder. Move it into ~/.claude/skills/ for personal use or into the project's .claude/skills/ for a single repository. Alternatively, upload the ZIP under Settings → Capabilities → Skills in the Claude apps.
- 3Open your project. Start your agent in the repository you want to analyse, so it can read the schemas, configs and API files.
- 4Ask for the assessment. Use a natural request such as 'assess breach impact for this repo' or run /data-breach-blast-radius with a path.
- 5Review the classified inventory. Check the list of sensitive fields and their tiers. Correct any misclassifications before relying on the results.
- 6Read the labelled report. Separate law-sourced figures from estimates, and check the citations in references/SOURCES.md for any figure you plan to use.
- 7Work the hardening roadmap. Start with the highest-priority controls, such as fixing ownership checks and removing sensitive fields from API responses, then re-run the assessment.
What is an agent skill, and what does this one do?
An agent skill is a folder containing a SKILL.md file and optional reference files. When you install it in an agent runtime that reads SKILL.md, the agent loads the instructions when your request matches the skill's description. This skill is for Claude Code or a compatible SKILL.md runtime.
Once active, the agent scans your project's schemas, API contracts, configuration, logs and infrastructure files for sensitive personal, health, payment and credential data. It then traces how that data is ingested, processed, stored, transmitted and exposed, and writes a pre-breach report. The report estimates how many people could be affected, which regulations would apply, what penalties and costs might follow, and a prioritised list of hardening steps.
- Inventories fields such as PII, PHI, PCI-DSS data and credentials, grouped into sensitivity tiers
- Maps data flows from entry points to storage, outbound calls, exports and deletion
- Flags exposure points such as unauthenticated endpoints, missing ownership checks, over-broad API responses and publicly accessible storage
- Labels each figure as law-sourced (exact) or a heuristic planning estimate
Install the skill from the ZIP download
Download the ZIP for the data-breach-blast-radius skill from our page and unzip it. The skill folder should contain SKILL.md along with the references folder. You can install it in one of two places.
For a personal install, put the unzipped folder under your user skills directory, ~/.claude/skills/. For a project-only install, put it under the project's .claude/skills/ directory so it applies only to that codebase.
In the Claude apps, you can instead upload the ZIP under Settings → Capabilities → Skills.
- Personal: ~/.claude/skills/
- Project only: .claude/skills/ inside your repository
- Claude apps: Settings → Capabilities → Skills, then upload the ZIP
~/.claude/skills/data-breach-blast-radius/SKILL.mdHow do you trigger the skill with a natural request?
You can ask in plain language. The skill's description lists phrases it responds to, such as 'assess breach impact', 'what data could be exposed', 'calculate blast radius', 'sensitive data inventory', 'data flow security audit', 'pre-breach assessment' and 'worst-case breach scenario'. You can also invoke it directly with the slash command.
You can limit the scope by naming a path. If you give no path, the agent analyses the whole project. The skill is meant for any stack that handles user data, health records or financial information.
- 'Assess breach impact for this repo.'
- 'What data could be exposed through the orders API?'
- 'Run a pre-breach assessment on src/billing.'
- 'Build a data risk report for our leadership review.'
/data-breach-blast-radius src/What the report contains and how to read it
The report separates two kinds of figures. Regulatory fine maximums and breach notification timelines are taken from law text, including GDPR Article 83, CCPA § 1798.155 and 45 CFR § 160.404, and each citation is listed in references/SOURCES.md so you can check it. Blast radius scores, record counts and financial ranges are planning estimates from a model. The skill cites the IBM Cost of a Data Breach Report for cost benchmarks; that report is updated annually, so check the current edition at https://www.ibm.com/reports/data-breach.
Treat the scores as a way to rank problems, not as predictions. A score of 76 to 100 is labelled Critical and calls for immediate action. Use the hardening roadmap, which orders controls by impact relative to effort, to decide what to fix first.
- Law-sourced figures: exact, with citations in references/SOURCES.md
- Heuristic estimates: planning only
- Blast Radius Score bands: Low 0–25, Medium 26–50, High 51–75, Critical 76–100
Safety, network use and limits
The skill runs no scripts. It works by having the agent read files in your project. It uses the network only if you ask the agent to fetch the current IBM report, and it does not need an API key for that.
The skill is for proactive analysis. It is not an incident response tool and does not analyse a live breach. It does not replace legal counsel or a formal DPIA or risk assessment. Do not use its cost or record-count figures as precise numbers in a filing or board paper without checking them yourself.
- Runs scripts: no
- Uses network: yes, only when asked to fetch the IBM report
- Not for live incident response
- Not a substitute for legal advice or a formal DPIA
What people use it for
- Preparing an engineering team for a security review or penetration test by listing where personal data leaves the system
- Scoping a data processing impact assessment (DPIA) for a new feature that stores customer or health data
- Giving leadership a worst-case exposure summary with clearly labelled estimates for budgeting security work
- Finding logs, analytics events or caches that contain personal data before an audit
- Checking whether public storage buckets or unauthenticated endpoints would expose a large population
Frequently asked questions
How do I install the data-breach-blast-radius skill?
Download the ZIP from our page and unzip it. Put the folder in ~/.claude/skills/ for personal use or in a project's .claude/skills/ directory, or upload the ZIP under Settings → Capabilities → Skills in the Claude apps. The folder should contain SKILL.md.
Is the data-breach-blast-radius skill free?
The skill is published under the MIT licence, which is stated on the source listing. Check the licence file in the repository for the full terms before redistributing it. Pricing details are not given in the source.
What do I need to run it?
You need an AI agent that can read files in your project, such as Claude Code or a compatible SKILL.md runtime. Internet access is needed only if you ask the agent to fetch the current IBM Cost of a Data Breach report, and no key is required.
Does the skill run scripts or send my code anywhere?
The skill runs no scripts. It reads project files through the agent. The only network use described is fetching the IBM report when you ask for it.
Why doesn't the skill's output match my breach cost estimate exactly?
The record counts and financial ranges are heuristic planning estimates, and the cost benchmarks come from an IBM report that is updated each year. Only the regulatory figures are taken directly from law text. Use the output to rank risks, not as a precise forecast.
Can this replace a lawyer or a DPIA?
No. The skill states that it does not replace legal counsel or a formal DPIA or risk assessment. Use its output as preparation material for those processes.
New agent skills, repos and AI tools — every week
The best new skills and open-source projects, the fastest-growing repos, and one free prompt. Five minutes to read. Unsubscribe anytime.
Our verdict
Use this skill if you are an engineering lead or security or compliance staff preparing for a review, pentest or DPIA and you want a structured first pass over where sensitive data could leak. Pick something else if you need legal sign-off, precise cost forecasts, or help during a live incident.
Download the skill