Compliance AuditSAFE

Model-agnostic agent-skills platform with a harness-free canonical layer, verified adapters, and the ccpi package manager. Explore at tonsofskills.com.

The instruction file, verbatim from the audited commit — this is the text the model reads, and the surface the audit's instruction layer examines. Quoted here so you can judge it without cloning anything.

---
name: compliance-audit
description: 'Performs regulatory gap analysis across 7 compliance frameworks with
  a scored

  report card and prioritized remediation roadmap. Use when assessing a website

  or application for GDPR, CCPA, ADA, PCI-DSS, CAN-SPAM, COPPA, or SOC 2 compliance.

  Trigger with "/compliance-audit" or "audit my website for regulatory compliance".

  '
allowed-tools: Read, Glob, Grep, WebFetch
version: 1.1.0
author: Intent Solutions <[email protected]>
license: MIT
tags:
- legal
- compliance
- gdpr
- ccpa
- ada
- pci-dss
- audit
- regulatory
compatibility: Designed for Claude Code
---
# Regulatory Compliance Audit

## Overview

Executes a two-phase compliance analysis — detection scan followed by framework-by-framework
evaluation — across 7 regulatory frameworks. Produces a compliance scorecard with letter
grades (A-F) per framework, identifies specific gaps, and generates a prioritized
remediation roadmap with effort estimates and timelines.

This skill reads and analyzes existing assets. It does not generate legal documents or
modify any files. The output is an audit report documenting findings and recommendations.

> **Legal Disclaimer:** This skill generates AI-assisted compliance analysis for
> informational purposes only. It does not constitute legal advice, certification, or
> attestation of compliance. Regulatory requirements are complex and jurisdiction-specific.
> All findings should be reviewed by qualified legal counsel and/or certified compliance
> professionals. No attorney-client relationship is created by using this tool.

## Prerequisites

- A live website URL or local codebase to analyze
- Access to any existing privacy policy, terms of service, or compliance documentation
- Knowledge of the business type, target audience, and geographic reach

## Instructions

### Phase 1: Detection Scan

1. **Scan the website.** Use WebFetch on the target URL to collect:
   - HTML source (meta tags, structured data, accessibility attributes)
   - Cookie and tracking behavior (Set-Cookie headers, JavaScript trackers)
   - Form elements (input types, required fields, consent checkboxes)
   - Payment indicators (payment form fields, processor scripts)
   - Third-party scripts and embeds (analytics, advertising, social)
   - SSL/TLS certificate presence
   - Content targeting indicators (age-related content, children's themes)

2. **Scan the codebase (if available).** Use Glob and Grep to find:
   - Privacy policy and terms of service files
   - Cookie consent implementation code
   - Authentication and access control patterns
   - Data encryption at rest and in transit
   - Logging and audit trail implementations
   - Age verification or gate mechanisms
   - Email sending code and unsubscribe handling
   - Payment processing integrations
   - Accessibility attributes (aria-*, alt text, semantic HTML)

3. **Build the detection inventory.** Create a structured map of findings:

   | Category | Signals Found | Frameworks Triggered |
   |----------|---------------|---------------------|
   | Data Collection | Forms, cookies, analytics | GDPR, CCPA |
   | Payments | Stripe, PayPal, card fields | PCI-DSS |
   | Accessibility | Missing alt text, no skip nav | ADA/WCAG |
   | Email Marketing | Newsletter signup, email sends | CAN-SPAM |
   | User Demographics | Age gates, child-oriented content | COPPA |
   | Security Controls | Auth, encryption, logging | SOC 2 |

### Phase 2: Framework-by-Framework Evaluation

1. **Evaluate each applicable framework.** Score against these criteria:

   **GDPR (General Data Protection Regulation)**
   - [ ] Privacy policy published and accessible
   - [ ] Legal basis documented for each processing activity
   - [ ] Cookie consent with granular opt-in (not just notice)
   - [ ] Data subject rights mechanism (access, erasure, portability)
   - [ ] Data Processing Agreement with third-party processors
   - [ ] Data breach notification procedure documented
   - [ ] Data Protection Impact Assessment for high-risk processing
   - [ ] Records of processing activities maintained
   - [ ] International transfer safeguards (SCCs, adequacy decisions)
   - [ ] DPO appointed (if required by Article 37)

   **CCPA/CPRA (California Consumer Privacy Act)**
   - [ ] "Do Not Sell or Share My Personal Information" link visible
   - [ ] Privacy policy discloses categories of personal information collected
   - [ ] Consumer request mechanism (access, delete, correct, opt-out)
   - [ ] Service provider agreements with data sharing restrictions
   - [ ] Financial incentive disclosures (if offering loyalty programs)
   - [ ] Sensitive personal information opt-out mechanism
   - [ ] Annual privacy policy update
   - [ ] Employee/applicant privacy notices (if applicable)

   **ADA/WCAG 2.1 (Accessibility)**
   - [ ] Alt text on all images
   - [ ] Keyboard navigation support
   - [ ] Color contrast ratios (4.5:1 minimum for text)
   - [ ] Form labels and error messages
   - [ ] Skip navigation links
   - [ ] ARIA landmarks and roles
   - [ ] Video captions and audio descriptions
   - [ ] Responsive design / mobile accessibility

   **PCI-DSS (Payment Card Industry)**
   - [ ] No card data stored in plaintext
   - [ ] Payment processing via certified processor (Stripe, Braintree)
   - [ ] HTTPS enforced on all payment pages
   - [ ] No card numbers in URLs, logs, or error messages
   - [ ] SAQ (Self-Assessment Questionnaire) type determined
   - [ ] Quarterly vulnerability scans (if applicable)

   **CAN-SPAM (Commercial Email)**
   - [ ] Physical mailing address in marketing emails
   - [ ] Functional unsubscribe mechanism
   - [ ] Unsubscribe honored within 10 business days
   - [ ] Accurate "From" and "Subject" headers
   - [ ] Commercial content clearly identified
   - [ ] No harvested or purchased email lists

   **COPPA (Children's Online Privacy Protection)**
   - [ ] Age screening mechanism (if content may attract children under 13)
   - [ ] Verifia

SAFEgrade B · trust 89/100 Nothing in the source contradicts what it says it does. Grade A is reserved for packages that have also passed the behavioural sandbox.

What the source does

Filesystem

none-observed

Network

none-observed

Shell

none-observed

Dependencies

pinned

Secrets in source

none-found

Findings (0)

No findings outside the package's declared scope.

Gates applied: no_behavioural_pass.