← 返回 Skills 市场

Data Governance Framework

Name: Data Governance Framework
Author: 1kalin

作者 1kalin · GitHub ↗ · v1.0.0

cross-platform ⚠ suspicious

641

总下载

当前安装

版本数

在 OpenClaw 中安装

/install afrexai-data-governance

功能描述

Evaluate and improve your organization's data governance across six domains by scoring controls, identifying risks, and prioritizing remediation actions.

使用说明 (SKILL.md)

Data Governance Framework

Assess, score, and remediate your organization's data governance posture across 6 domains.

What This Covers

Data Quality — Completeness, accuracy, consistency, timeliness scoring
Data Cataloging — Asset inventory, lineage tracking, metadata management
Access Control — Role-based permissions, least privilege, data classification (public/internal/confidential/restricted)
Compliance Mapping — GDPR, CCPA, SOX, HIPAA, PCI-DSS, industry-specific regulations
Retention & Lifecycle — Retention policies, archival schedules, deletion procedures, legal hold
AI/Agent Data Governance — Training data provenance, model input/output logging, bias detection, PII handling in agent workflows

How to Use

When asked to assess data governance:

Ask which domains are priority (or assess all 6)
For each domain, evaluate 8 controls on a 0-3 scale:
- 0 = Not implemented
- 1 = Ad hoc / informal
- 2 = Documented and partially enforced
- 3 = Automated and continuously monitored
Calculate domain score (sum / 24 × 100)
Calculate overall governance score (average of domains)
Generate remediation roadmap prioritized by risk

Scoring Interpretation

Score	Rating	Action
0-25%	Critical	Immediate remediation — regulatory risk
26-50%	Developing	90-day improvement plan required
51-75%	Managed	Optimize and automate weak areas
76-100%	Optimized	Maintain and benchmark against peers

Domain 1: Data Quality Controls

Data profiling automation (duplicate detection, format validation)
Quality dashboards with SLA thresholds
Root cause analysis for quality failures
Stewardship program (assigned data owners per domain)
Quality gates in data pipelines (reject bad data at ingestion)
Business rule validation (domain-specific logic checks)
Cross-system reconciliation (source vs target matching)
Quality trend tracking (month-over-month improvement metrics)

Domain 2: Data Cataloging Controls

Automated asset discovery (databases, APIs, files, SaaS)
Business glossary with agreed definitions
Data lineage tracking (source → transformation → consumption)
Search and discovery interface for business users
Metadata enrichment (tags, classifications, sensitivity labels)
Catalog coverage tracking (% of assets documented)
Usage analytics (who accesses what, how often)
Integration with BI/analytics tools (catalog-aware queries)

Domain 3: Access Control

Role-based access control (RBAC) with regular review
Data classification enforcement (labels drive permissions)
Least privilege principle (minimal default access)
Access request and approval workflows
Privileged access management (admin accounts monitored)
Access certification (quarterly re-certification of permissions)
Anomaly detection (unusual access patterns flagged)
De-provisioning automation (access removed on role change/exit)

Domain 4: Compliance Mapping

Regulation inventory (which laws apply, by geography and industry)
Control-to-regulation mapping (which controls satisfy which requirements)
Data processing records (Article 30 GDPR / equivalent)
Consent management (capture, storage, withdrawal tracking)
Data subject rights automation (access, deletion, portability)
Cross-border transfer compliance (SCCs, adequacy decisions)
Breach notification procedures (72-hour GDPR, state-specific)
Regular compliance audits (internal + third-party)

Domain 5: Retention & Lifecycle

Retention schedule by data type (contractual, regulatory, operational)
Automated archival pipelines (hot → warm → cold → delete)
Legal hold management (litigation preservation)
Deletion verification (confirmed purge with audit trail)
Storage cost optimization (tiered storage aligned to access patterns)
Backup and recovery testing (regular restore drills)
Data minimization enforcement (collect only what is needed)
End-of-life procedures for decommissioned systems

Domain 6: AI/Agent Data Governance

Training data provenance tracking (source, consent, bias review)
Model input/output logging (what went in, what came out)
PII detection and masking in agent workflows
Hallucination monitoring (output accuracy validation)
Agent decision audit trail (explainability for automated decisions)
Data feedback loops (human review of agent data modifications)
Vendor data sharing agreements (what third-party APIs see your data)
Synthetic data policies (when and how to use generated data)

Cost of Poor Governance

Risk	Average Cost	Prevention Cost
GDPR fine	$4.3M (average 2025)	$45K-$120K/year
Data breach	$4.88M (IBM 2025)	$60K-$200K/year
Failed audit	$150K-$500K remediation	$30K-$80K/year
Bad data decisions	15-25% revenue impact	$20K-$60K/year
AI bias incident	$2M-$50M (litigation + brand)	$25K-$75K/year

Remediation Priority Matrix

Always fix in this order:

Compliance gaps — regulatory fines are existential
Access control — breaches destroy trust overnight
AI governance — fastest-growing risk category
Data quality — garbage in = garbage out at scale
Cataloging — you cannot govern what you cannot find
Retention — storage costs compound, legal risk accumulates

Industry Benchmarks (2026)

Industry	Avg Governance Score	Top Quartile	Regulatory Pressure
Financial Services	68%	85%+	Extreme (SOX, PCI, GDPR)
Healthcare	62%	80%+	High (HIPAA, FDA, state)
SaaS/Tech	55%	78%+	Growing (SOC 2, GDPR, CCPA)
Manufacturing	45%	70%+	Moderate (ITAR, ISO)
Retail/Ecommerce	48%	72%+	Growing (PCI, CCPA, GDPR)

Next Steps

Need a complete data governance implementation tailored to your industry?

安全使用建议

This skill is a content/template-style governance framework and appears coherent with its description. Because it is instruction-only, it will not itself exfiltrate data or install code — however, be cautious about sharing actual organizational data or secrets when using it. If you plan to let an autonomous agent use this skill, restrict the agent's access to connectors that contain sensitive PII or credentials unless you explicitly approve that data be used. Also note README links to external AfrexAI pages (context packs, paid content) — those are optional resources outside the skill and should be reviewed separately before following or purchasing.

功能分析

Type: OpenClaw Skill Name: afrexai-data-governance Version: 1.0.0 The skill's primary purpose of assessing data governance is benign. However, the `SKILL.md` and `README.md` files contain external links to `afrexai-cto.github.io` for 'AI revenue calculator', 'context packs', and 'agent setup wizard'. While these links are presented as resources for the user, their presence introduces a potential risk. An AI agent, if susceptible to prompt injection, could be coerced into visiting these external URLs, which could lead to unintended network calls, exposure to malicious content, or execution of untrusted scripts if the agent's environment is not adequately sandboxed. This constitutes a risky capability without clear malicious intent within the skill's instructions, thus classifying it as suspicious.

能力评估

✓ Purpose & Capability

Name and description match the SKILL.md: a 6-domain governance assessment with scoring and remediation. There are no unrelated required env vars, binaries, or config paths that would be inconsistent with a governance framework.

✓ Instruction Scope

Runtime instructions are limited to asking the user which domains to assess, scoring 48 controls, computing metrics, and producing remediation roadmaps. The SKILL.md does not instruct reading system files, scanning environment variables, or sending data to external endpoints.

✓ Install Mechanism

No install spec and no code files — lowest-risk posture (instruction-only). Nothing is downloaded or written to disk by the skill itself.

✓ Credentials

The skill declares no required environment variables, credentials, or config paths. It does discuss handling sensitive data conceptually (PII, provenance) but does not request secrets or external tokens.

✓ Persistence & Privilege

Flags are default (always:false, user-invocable:true, model invocation allowed). The skill does not request permanent presence or attempt to modify other skills or system-wide settings.

如何使用

确保已安装 OpenClaw（本地或 Docker 部署）
在对话框中输入安装命令：/install afrexai-data-governance
安装完成后，直接呼叫该 Skill 的名称或使用 /afrexai-data-governance 触发
根据 Skill 的参数说明提供必要输入，即可获得结构化输出

版本历史

v1.0.0

Initial release of the afrexai-data-governance skill, providing a comprehensive framework to assess and improve organizational data governance across six key domains. - Covers Data Quality, Data Cataloging, Access Control, Compliance Mapping, Retention & Lifecycle, and AI/Agent Data Governance. - Includes a standardized controls-based assessment and scoring methodology (0–3 scale) for each domain. - Provides scoring interpretation guidelines, remediation roadmap generation, and industry benchmarks for context. - Offers a cost-risk matrix quantifying the impact of poor governance versus preventative investment. - Lists practical next steps and additional resources for deeper implementation.

元数据

Slug afrexai-data-governance

版本 1.0.0

许可证 —

累计安装 1

当前安装数 1

历史版本数 1

常见问题