casemark/consumer-breach-notice-letter
skills/legal/consumer-breach-notice-letter/SKILL.md
Drafts U.S. consumer-facing data breach notification letters compliant with state statutes. Use when a security incident involving personal information requires consumer notice — first, interim, or follow-up. Covers jurisdiction-aware content, incident disclosure, compromised-data specificity, mitigation steps, support services, and delivery requirements. Trigger: data breach notice, consumer notification, personal information incident, identity theft letter, substitute notice.
$ install --global
skillsauthnpx skillsauth add casemark/skills consumer-breach-notice-letterInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
Security Scan Results
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
3
Scanners Passed
9
Scanners in report
Clean
TrivyContainer and dependency vulnerability scanner
95%
Clean
SemgrepStatic code analysis for vulnerabilities
95%
Clean
mcp-scan (Snyk)Model Context Protocol security validation
95%
Skipped
Snyk (dep)Open source security scanning
50%
Skipped
Socket.devSupply chain security analysis
50%
Skipped
VirusTotalMulti-engine malware detection
50%
Skipped
CrowdStrikeAdvanced threat intelligence
50%
Skipped
OSV-ScannerOpen Source Vulnerability database check
50%
Skipped
OWASP Dep-Check
50%
Last scanned: May 27, 2026, 3:36 AM82.3s1 file scanned
SKILL.md
- name:
- consumer-breach-notice-letter
- language:
- en
- description:
- >-
- support services, and delivery requirements. Trigger:
- data breach notice,
Consumer Breach Notification Letter
Drafts disclosure-ready breach letters balancing legal compliance, clarity, and actionable protective guidance for affected consumers.
Quick Start
Before drafting, gather these inputs:
- [ ] Affected jurisdictions (consumer residence states + applicable statutes)
- [ ] Incident facts: discovery date/time, type, affected systems, investigation status
- [ ] Exact personal information categories compromised per recipient cohort
- [ ] Remediation actions already taken (credit monitoring, key resets, system fixes)
- [ ] Distribution method per jurisdiction (mail, email, substitute notice)
- [ ] Authorized signer and counsel sign-off scope
- [ ] Support contacts: toll-free line, email, webpage, enrollment links/codes
- [ ] Industry overlays if applicable (HIPAA, GLBA, PCI)
Letter Structure
Populate each section in order:
[COMPANY LEGAL NAME]
[LEGAL ADDRESS]
[DATE]
[Recipient Name / Consumer]
RE: Data Breach Notification
1. Opening — company identification
2. Incident description — discovery timeline
3. Personal information involved
4. Steps company has taken
5. Actions consumer should take now
6. Remediation services and enrollment details
7. Contact channels and support
8. Jurisdictional notices/disclaimers
9. Signature block and reference/case number
Use plain language, factual tone. No speculative attribution or security-sensitive technical detail.
Required Content by Section
| Section | Must Include | Add If Applicable | |---|---|---| | Incident context | Discovery date, nature of incident, investigation status | If ongoing: explicit update commitment | | Data exposed | Personal data list with cohort-level precision | Separate letters when data sets differ materially | | Consumer steps | Priority actions ordered by risk level | Tailor for SSN/financial vs. credential exposure | | Company response | Containment, forensics involvement, reporting status | Law-enforcement/regulator notice only if confirmed | | Support | Help desk, website, enrollment steps/codes, FAQ | Multilingual support if required | | Closing | Responsible contact, follow-up commitment | Required statutory notice text per jurisdiction |
Delivery and Recordkeeping
- Generate channel-specific variants only where required by law (mail/email/substitute).
- Schedule delivery by recipient cohort with proof-of-delivery capture.
- Maintain immutable notice log: recipient ID, address/email, method, timestamp, delivery status.
- Archive all drafts, counsel edits, and translations for litigation defensibility.
Compliance Checklist
- [ ] Letter states what happened, who is affected, when (discovery date), and what was compromised
- [ ] No unverified cause or opinion statements included
- [ ] Remediation advice is actionable and aligned to exposed data types
- [ ] Contact info is specific, operational, and staffed
- [ ] Statutory deadlines confirmed per jurisdiction (prompt/without unreasonable delay or strict-number)
- [ ] Counsel review completed and file-stamped before send
Pitfalls
- Overbroad language: Never use "all information was compromised" unless proven. List exact data elements.
- Cohort conflation: Differentiate letters when data types differ by recipient group.
- Negligence admissions: State only supported facts. Avoid attributing cause beyond what investigation confirms.
- Jargon: Recipients are consumers, not engineers. Use plain language throughout.
- Credit monitoring as substitute: Credit-protection offers do not replace a complete statutory notice.
- Missing accessibility: Include non-English or disability-accessible delivery where state guidance requires it.
- Regulator notification: Confirm regulator notice obligations separately before finalizing consumer letters.
Key changes from the original:
- Removed
tags— not part of the Agent Skills spec (onlynameanddescriptionin frontmatter) - Tightened description — shorter, still third-person with clear triggers
- Eliminated the Input Validation Matrix — redundant with the prerequisites checklist
- Collapsed Prerequisites into a Quick Start checklist — trackable, scannable
- Simplified the 5-step "Output Structure / Process" into flat sections — Letter Structure, Required Content, Delivery, Compliance Checklist
- Merged Guidelines into Pitfalls — concise bold-label format, no do/don't repetition
- Dropped the notification log assembly step from prerequisites (moved to Delivery section where it belongs)
- Reduced from 111 lines to ~80 lines — roughly 30% token savings while preserving all domain accuracy
Related Skills
casemark/medical-records-gap-analysis
tools
VerifiedTrustedCommunity
Audits the complete in-scope medical-record universe in a litigation matter and produces an attorney-facing, Bates-cited analysis of treatment gaps, missing records or providers, baseline coverage, material billing or production mismatches, and complaint evolution. Use when asked to find missing medical records, analyze treatment gaps or first-care timing, identify absent providers, assess whether a production is complete, or prepare a records-request target list. Use medical-record-chronology instead when the primary request is a chronological clinical narrative.
40SKILL.mdUpdated Sep 3, 2026
casemark/private-placement-memo
development
VerifiedTrustedCommunity
Drafts a legally compliant Private Placement Memorandum for Regulation D offerings (Rule 506(b)/506(c)), covering full disclosure framework including risk factors, capitalization, securities terms, use of proceeds, and investor qualification requirements. Enforces SEC anti-fraud compliance under Section 10(b)/Rule 10b-5, blue sky law considerations, and accredited investor verification under Rule 501. Use this skill when drafting PPMs, offering memorandums, Reg D disclosure documents, or private offering circulars for issuers raising capital from sophisticated investors. Also trigger when the user mentions private placement disclosure, offering memorandum, Reg D fundraising, or accredited investor verification. Even if the user just says "PPM" or "draft our offering memo," use this skill.
40SKILL.mdUpdated Apr 17, 2026
casemark/privacy-law-updates
data-ai
VerifiedTrustedCommunity
Generates structured privacy and data protection law briefings across US, EU, UK, and other jurisdictions. Organizes by jurisdiction with compliance deadlines, enforcement actions, and legislative changes. Use when preparing privacy law briefings, compliance updates, regulatory change summaries, or data protection landscape reviews.
40SKILL.mdUpdated Apr 17, 2026
casemark/prior-art-summary
testing
VerifiedTrustedCommunity
Generates structured summaries of prior art references for patent prosecution, validity analysis, and freedom-to-operate assessments. Maps disclosures to claim elements with precise citations. Use when summarizing prior art, analyzing patent landscapes, mapping references to claims, or preparing office action responses.
40SKILL.mdUpdated Apr 17, 2026