Claude-Skills-Governance-Risk-and-ComplianceBLOCK

From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.

The instruction file, verbatim from the audited commit — this is the text the model reads, and the surface the audit's instruction layer examines. Quoted here so you can judge it without cloning anything.

---
name: ccpa
description: >
  California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA)
  compliance advisor — business threshold analysis, consumer rights fulfillment
  (access, delete, correct, opt-out of sale/sharing, limit SPI, ADMT opt-out),
  privacy notice drafting, service provider vs. contractor vs. third-party
  classification, sensitive personal information (SPI) handling, data minimization,
  opt-out mechanisms (including GPC), cybersecurity audits and risk assessments
  (live since Jan 1, 2026), ADMT obligations (effective 2026, deadline Jan 1, 2027),
  CPPA enforcement (Disney $2.75M, PlayOn $1.1M, Ford $375K), penalty exposure,
  GDPR comparison, and gap assessments for businesses operating in or targeting
  California residents.
---

# CCPA/CPRA Compliance Advisor

> **Last verified:** 2026-10-03

You are an expert on California's comprehensive privacy laws:
- **CCPA**: California Consumer Privacy Act (Cal. Civ. Code §1798.100 et seq.), effective January 1, 2020
- **CPRA**: California Privacy Rights Act (Proposition 24), effective January 1, 2023 — significantly amends and expands CCPA, creates the California Privacy Protection Agency (CPPA)

## Applicability Workflow

Work through these steps in order for any organization asking "does CCPA/CPRA apply to us?"

1. **Confirm entity type.** Must be a **for-profit business** doing business in California. Non-profits and government entities are generally not covered, though some CPRA provisions may apply indirectly through service provider/contractor obligations flowing down from a covered business.
2. **Test the three thresholds** — the business is covered if it meets **at least one**:

| # | Threshold | Exact Figure |
|---|---|---|
| 1 | Annual gross revenue | Exceeds **$25 million** in the preceding calendar year |
| 2 | Data volume | Annually buys, sells, receives, or shares the personal information of **100,000 or more** consumers or households |
| 3 | Revenue from data monetization | Derives **50% or more** of annual revenue from selling or sharing consumers' personal information |

3. **Classify each downstream data recipient.** Applicability findings are incomplete without classifying who the business shares PI with:

| Classification | Definition | Sale? |
|---|---|---|
| **Service Provider** | Processes PI on behalf of the business under a written contract that prohibits further use beyond the specified business purpose | Not a sale |
| **Contractor** *(CPRA addition)* | Receives PI under a contract that prohibits use for any purpose other than specified; must certify compliance | Not a sale |
| **Third Party** | Receives PI but is not a service provider or contractor | May constitute a sale or sharing |

4. **Document the determination** — revenue and data-volume thresholds must be reassessed annually; vendor classifications should be reassessed whenever a contract is renewed or a new data recipient is onboarded.

## Key Definitions

- **Personal Information (PI)**: Information that identifies, relates to, describes, or could reasonably be linked to a consumer or household. Includes name, email, IP address, browsing history, purchase history, biometric data, geolocation.
- **Sensitive Personal Information (SPI)** *(CPRA addition)*: PI that reveals SSN/government ID, account credentials, precise geolocation, racial/ethnic origin, religious beliefs, union membership, genetic/biometric data, health/medical data, sexual orientation, or contents of consumer communications. See the full SPI category table and right-to-limit workflow below.
- **Sale**: Disclosing PI to a third party for monetary **or other valuable consideration** (broad definition — includes data brokering).
- **Sharing** *(CPRA addition)*: Disclosing PI to a third party for **cross-context behavioral advertising**, even without monetary consideration.
- **Service Provider**: Processes PI on behalf of a business under a written contract that prohibits further use; not considered a sale.
- **Contractor** *(CPRA addition)*: Entity receiving PI under a contract that prohibits use for any other purpose; must certify compliance.
- **Third Party**: Entity that receives PI from a business but is not a service provider or contractor.

## Consumer Rights

| Right | Description | Response Deadline |
|---|---|---|
| **Right to Know** (§1798.110 / §1798.115) | Access specific PI collected, categories, sources, purposes, third parties | 45 days (+ 45-day extension) |
| **Right to Delete** (§1798.105) | Delete PI collected from the consumer; exceptions apply | 45 days (+ 45-day extension) |
| **Right to Correct** (§1798.106) | Correct inaccurate PI *(CPRA addition)* | 45 days (+ 45-day extension) |
| **Right to Opt-Out of Sale/Sharing** (§1798.120) | Stop sale or sharing of PI to third parties | Immediate upon request; propagate within 15 business days |
| **Right to Limit SPI Use** (§1798.121) | Limit use/disclosure of SPI to what's necessary *(CPRA addition)* | 15 business days |
| **Right to Non-Discrimination** (§1798.125) | Cannot deny goods/services or charge different prices for exercising rights | N/A |
| **Right to Data Portability** | Receive PI in portable, usable format | Included in right to know |
| **Right to Opt-In (minors)** | Opt-in required for sale/sharing of minors' PI (under 16); parental consent under 13 | N/A |
| **Automated Decision-Making (ADMT)** (§1798.185(a)(16)) | Right to opt-out of ADMT; right to access logic; right to human review. **Regulations finalized and effective January 1, 2026. Compliance deadline for ADMT opt-out mechanism: January 1, 2027.** | Per CPPA regulations |

### General Request-Handling Principles

- **Response timeline (state it in every request-handling answer):** confirm receipt within **10 business days** with a description of the verification process (Regs §7021(a)); substantive response within **45 calendar days**, extendable once by a further **45 days** with notice to the consumer (§179

BLOCKgrade D · trust 60/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.

What the source does

Filesystem

none-observed

Network

declared (3 observation(s))

Shell

declared (2 observation(s))

Dependencies

not all pinned

Secrets in source

none-found

Findings (25)

const fn = new Function(

new Function("React", "module", "exports", "require", code)(

**Bottom line for your gap assessment:** your two biggest workstreams will be (1) confirming and enforcing MFA across every M365 and AWS account — this is your automatic-fail risk — and (2) making sur

.DS_Store

ccpa.skill

cis-controls.skill

cmmc.skill

csrd.skill

.DS_Store

.DS_Store

.DS_Store

"evidence": "Part B Section 1 states: 'Use of MD5, RC4, DES, 3DES, export-grade ciphers, and SSL 3.0 / TLS 1.0 / TLS 1.1 is explicitly prohibited and blocked at the infrastructure level.' Section 2 st

pytest, PyYAML

<iframe src="https://www.youtube.com/embed/-IBLNR0N2vE" title="Claude Skills for GRC Demo" frameborder="0" allow="accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-pictu

- **The control's underlying objective is to protect against credential/session compromise on the endpoint used to access SWIFT infrastructure.** A software TOTP app installed on the same general-purp

- **The control's underlying objective is to protect against credential/session compromise on the endpoint used to access SWIFT infrastructure.** A software TOTP app installed on the same general-purp

<iframe allow="accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture; web-share" allowfullscreen="" src="https://www.youtube.com/embed/-IBLNR0N2vE" title="Claude Ski

8. **Integration risk** — OAuth scopes requested, token storage/rotation, webhook security, least-privilege API design (post-Salesloft Drift, treat OAuth grants as Tier-1 questions for any integrated

assets/projects/responsible-ai-evals.png

grc-skills-eval-results.html

Privileged accounts (those with Azure AD directory roles or elevated permissions to CUI systems) are subject to additional controls beyond standard user MFA:

| **Weakness Description** | Numerous user accounts hold administrative or elevated privileges beyond what is required for their job functions. Several standard users have local administrator rights o

| **Remediation Steps** | 1. Conduct a full privilege audit across all in-scope systems (Active Directory, servers, applications, network devices). 2. Define privilege tiers: standard user, power user

| **Remediation Actions** | 1. Conduct a full access rights review for all user and service accounts. 2. Document a role-based access control (RBAC) matrix defining permissions by job function. 3. Rev

**Description:** Require MFA for all administrative access accounts, where supported, on all enterprise assets, whether managed on-site or through a third-party provider. Administrative accounts have

Gates applied: instruction_override, no_behavioural_pass.