qa-test-data-privacy

PII detection, masking, and synthetic data generation for test environments: 8 skills (data-masking-techniques-reference, faker-synthetic-data, k-anonymity-verifier, pii-categories-reference, pii-masking-pipeline-builder, presidio-pii-detection, synthea-healthcare-data, test-data-governance-reference) and 1 agent (pii-leak-critic).

Install this plugin

/plugin install qa-test-data-privacy@testland-qa

View source

Part of role bundle: qa-role-security

qa-test-data-privacy

PII detection, masking, and synthetic data generation for test environments: 4 skills - the pii-masking-pipeline-builder centerpiece (detect → mask → verify, with the PII-category, masking-technique, and Faker-substitution catalogs in its references/) plus presidio-pii-detection, synthea-healthcare-data, and k-anonymity-verifier.

Components

Type	Name	Description
Skill	pii-masking-pipeline-builder	The full detect → mask → verify pipeline: field classification (references/pii-categories.md), operator selection (references/masking-techniques.md), Faker substitution (references/faker-masking-operators.md), deployable YAML spec, adversarial leak-audit verification pass
Skill	presidio-pii-detection	Microsoft Presidio analyzer + anonymizer for PII scanning + masking
Skill	synthea-healthcare-data	MITRE Synthea synthetic-patient simulator (FHIR / C-CDA / CSV output)
Skill	k-anonymity-verifier	Verify k-anonymity / l-diversity / t-closeness on masked datasets (ARX, pycanon).

Differentiation

This plugin scopes detection + masking + synthetic-substitution of existing data. Sibling neighbours:

qa-test-data - fixture construction (Test Data Builder, Factory, Object Mother, etc.). Its faker-data owns fixture-style fake data built from nothing, and its synthetic-pii-generator generates fresh fake PII; this plugin detects + masks existing PII.
qa-compliance - regulatory feature testing (does GDPR Art. 17 erasure work? does CCPA delete-on-request work?). This plugin engineers the data those tests run against.
qa-security-scanning - credentials / API keys via its secrets-scanning skills (different scope from personal data).

Install

/plugin marketplace add testland/qa
/plugin install qa-test-data-privacy@testland-qa

Skills

k-anonymity-verifier

Verifies that a masked dataset satisfies k-anonymity, l-diversity, and t-closeness by computing equivalence classes over chosen quasi-identifiers and reporting re-identification risk. Covers quasi-identifier selection heuristics, threshold guidance, pycanon API (k_anonymity / l_diversity / t_closeness / report), ARX Java API and GUI workflow, SmartNoise for differential-privacy comparison, and CI-gate integration. Distinct from pii-masking-pipeline-builder's masking-techniques catalog (which lists masking operators but defers k-anonymity measurement to dedicated tooling) and from presidio-pii-detection (which detects PII spans but offers no equivalence-class analysis). Use when you need to confirm whether a masked dataset meets a stated k, l, or t threshold before promoting it to a non-production environment.

pii-masking-pipeline-builder

Build-an-X workflow that owns the full detect → mask → verify pipeline for PII in test data. Walks the author through (1) classifying each field against the cross-regime PII catalog (GDPR / CCPA-CPRA / NIST SP 800-122 / HIPAA, in references/pii-categories.md), (2) picking a masking operator from the techniques catalog (seven canonical operators + Presidio operators + privacy models, in references/masking-techniques.md), (3) deciding pseudonymisation (reversible, in GDPR scope) vs anonymisation (irreversible, out of scope), (4) ordering the pipeline (detect → operator → audit) and emitting a deployable YAML config for Presidio + Faker + Synthea wrappers (Faker-as-masking-operator detail in references/faker-masking-operators.md), and (5) running the adversarial verification pass that re-detects PII in the masked output and blocks promotion on a leak. Use when non-production environments need masked production data - from field classification through runnable masking config to the leak audit.

presidio-pii-detection

Author and run Microsoft Presidio PII detection - wraps presidio-analyzer (PII detector) + presidio-anonymizer (replace/redact/mask/hash/encrypt operators) for scanning datasets, log streams, and free-text fields. Covers AnalyzerEngine + AnonymizerEngine setup, built-in recognizers (PERSON, EMAIL_ADDRESS, CREDIT_CARD, US_SSN, IBAN_CODE, country-specific IDs across US/UK/Spain/Italy/Poland/Singapore/Australia/India and more), custom PatternRecognizer authoring, score thresholds, and CI gating. Use when scanning *existing* data for PII (vs synthesising fresh fixtures with synthetic-pii-generator).

synthea-healthcare-data

Author and run Synthea (MITRE's open-source synthetic patient population simulator) to produce HIPAA-safe synthetic medical records for testing health IT systems. Covers Gradle build, population-size and state-specific generation, FHIR R4 / STU3 / DSTU2 / C-CDA / CSV / CPCDS output formats, disease-module customisation, and the lifecycle-simulation approach (birth-through-death patient journeys with realistic demographics). Use when testing FHIR servers, EHR integrations, claims processing, or any health IT system that needs realistic patient records without HIPAA exposure (distinct from the generic Faker family - qa-test-data faker-data for fixtures, the pii-masking-pipeline-builder faker-masking-operators reference for masking substitution; this is health-domain-specific).