| name | audit-compliance |
| title | Audit Compliance |
| description | Check that your legal compliance is still in good shape. Pick what to check: your privacy policy, your privacy vendor list, or your contract templates. I surface what's drifted or out of date and what to fix. I never change anything on my own. |
| author | gethouston |
| author_url | https://github.com/gethouston/houston/tree/main/store/agents/legal/.agents/skills/audit-compliance |
| license | MIT |
| version | 0.1.0 |
| execution_mode | open |
| jurisdiction | general |
| practice | data-protection |
| language | en |
Audit Compliance
One skill for all standing-state compliance checks. scope param picks inventory to walk. "Diffs not fixes" + "every finding cite authority" discipline shared.
Parameter: scope
privacy-posture - scrape landing + product via Firecrawl, cross-check deployed Privacy Policy, flag drift (new analytics tool undisclosed, subprocessor added no policy update, new cookie, purpose drift) with severity + recommended update. Writes privacy-audits/{YYYY-MM-DD}.md.subprocessors - walk connected integrations + inferred vendors from landing-page scrape, capture role + data categories + transfer mechanism + DPA status + public DPA URL. Read-merge-write subprocessor-inventory.json at agent root + one-page delta report at subprocessor-reviews/{YYYY-MM-DD}.md.template-library - read domains.contracts.templateLibrary, flag templates > 12 months old, check each vs current law refs (AI-training disclosure, SCC versions, 2026 DPA standards, CA/EU rights expansions). Writes refresh plan template-reviews/{YYYY-MM-DD}.md. Never auto-rewrites - founder approves each, kicks draft-a-legal-document for rewrite.
User name scope plain English ("audit my privacy", "refresh templates", "update subprocessor list") → infer. Ambiguous → ask ONE question naming 3 options.
When to use
- Explicit: "audit my privacy posture", "update my subprocessor list", "refresh my template library", "what's drifted", "what's stale".
- Plain-English asks map to a
scope: "is my privacy policy still current" / "does my privacy policy match what we actually do" → privacy-posture; "refresh my privacy vendor list" / "have we added new tools that touch customer data" → subprocessors; "are my contract templates still current" / "any template older than a year I should refresh" → template-library.
- Implicit: scheduled monthly cadence (privacy-posture, subprocessors); new vendor added (subprocessors); new landing-page surface ships (privacy-posture); template library referenced older than 12 months in any other skill (template-library).
Ledger fields I read
Read config/context-ledger.json first.
universal.legalContext + context/legal-context.md - required. Provides entity snapshot, risk posture, existing template stack (anchor for template-library scope). Missing → run skill first (or ask ONE targeted question to skip ahead).
