| name | compliance-audit |
| description | This skill should be used when performing legal and regulatory compliance audits on software projects. It covers GDPR, CCPA/CPRA, ePrivacy Directive, HIPAA, PCI DSS, SOC 2, and WCAG 2.2 accessibility. The skill generates a full compliance package: audit report with severity ratings, automatic code fixes, legal document templates (Privacy Policy, Cookie Policy, DPA, DPIA), and data flow diagrams. This skill should be triggered when the user asks to check compliance, audit privacy, generate legal documents, review data handling, or ensure regulatory readiness for any project type (web, mobile, API, desktop). |
Compliance Audit Skill
Note on references/, scripts/, assets/: this skill demonstrates the progressive-disclosure layout from guide.md — the SKILL.md holds the workflow, while per-regulation checklists, the scan script, and legal templates live in companion files you author for your own jurisdiction set. The workflow below is complete without them; the companion files add depth.
Purpose
Perform comprehensive legal and regulatory compliance audits on software projects.
Generate actionable reports, apply automatic code fixes, and produce required legal documentation.
When to Use
- User requests a compliance audit, GDPR check, or privacy review
- User asks to generate Privacy Policy, Cookie Policy, DPA, or DPIA
- User wants to verify data handling practices in code
- Before launching a product or feature that handles personal data
- When preparing for a compliance certification (SOC 2, PCI DSS, HIPAA)
- When adding consent management, cookie banners, or data deletion features
Supported Regulations
| Regulation | Scope | Reference File |
|---|
| GDPR | EU personal data protection | references/gdpr.md |
| CCPA/CPRA | California consumer privacy | references/ccpa.md |
| ePrivacy | EU cookies, tracking, electronic communications | references/eprivacy.md |
| HIPAA | US health information protection | references/hipaa.md |
| PCI DSS | Payment card data security | references/pci-dss.md |
| SOC 2 | Service organization controls | references/soc2.md |
| WCAG 2.2 | Web accessibility | references/wcag.md |
Audit Workflow
Phase 1: Project Discovery
- Identify project type (web, mobile, API, desktop) and tech stack
- Scan directory structure for relevant files:
- Configuration files (
.env, config/, settings/)
- Database schemas/migrations
- Authentication and user management code
- Forms and data collection points
- Third-party integrations and SDKs
- Cookie/tracking implementations
- Logging and monitoring setup
- API endpoints handling personal data
- Determine applicable regulations based on:
- Geographic scope (EU users → GDPR, California → CCPA)
- Data types (health data → HIPAA, payment → PCI DSS)
- Service type (B2B SaaS → SOC 2)
- Web presence (any web UI → WCAG)
Phase 2: Code Analysis
Perform automated detection of:
- Hardcoded secrets and credentials
- Unencrypted personal data storage
- Missing input validation/sanitization
- Logging of sensitive data (passwords, tokens, PII)
- Missing HTTPS enforcement
- Cookie usage without consent
- Third-party tracking scripts
- Data retention without expiry
- Missing access controls on personal data endpoints
Then perform manual analysis using the regulation-specific checklists from references/.
Phase 3: Severity Classification
Classify each finding using this scale:
| Severity | Description | Action Required |
|---|
| CRITICAL | Active data breach risk, legal violation | Immediate fix required |
| HIGH | Missing required compliance mechanism | Fix before launch/next release |
| MEDIUM | Incomplete implementation, partial compliance | Fix within 30 days |
| LOW | Best practice recommendation, improvement opportunity | Plan for future sprint |
| INFO | Informational, documentation suggestion | Optional |
Phase 4: Report Generation
Generate a compliance audit report in markdown format at compliance-report.md in the project root. The report structure:
# Compliance Audit Report
**Project:** [name]
**Date:** [date]
**Auditor:** Claude Code Compliance Audit
**Applicable Regulations:** [list]
## Executive Summary
[2-3 paragraph overview with overall compliance score]
## Findings by Regulation
### [Regulation Name]
#### [Finding Title] — [SEVERITY]
- **Location:** `file:line`
- **Issue:** [description]
- **Requirement:** [specific article/section]
- **Recommendation:** [fix description]
- **Auto-fix available:** Yes/No
## Data Flow Diagram
[Mermaid diagram showing personal data flows]
## Compliance Score
| Regulation | Score | Status |
|-----------|-------|--------|
| GDPR | X/100 | Pass/Partial/Fail |
## Required Legal Documents
[List of documents that need to be generated]
## Action Plan
[Prioritized list of fixes with effort estimates]
Phase 5: Automatic Code Fixes
For findings marked as auto-fixable, apply fixes directly:
- Add CSRF protection middleware
- Add encryption to sensitive database columns
- Remove PII from log statements
- Add HTTPS redirect middleware
- Add secure cookie flags (HttpOnly, Secure, SameSite)
- Add Content-Security-Policy headers
- Add data retention/purge mechanisms
- Add consent checks before tracking
Always create a backup or work on a branch. Present each fix for user approval before applying.
Phase 6: Legal Document Generation
Based on findings, generate required documents from templates in assets/:
| Template | When to Generate |
|---|
assets/privacy-policy-template.md | Always (any personal data handling) |
assets/cookie-policy-template.md | When cookies or tracking detected |
assets/dpa-template.md | When processing data for third parties |
assets/dpia-template.md | When high-risk processing identified |
Customize templates with project-specific:
- Company/organization name
- Types of data collected
- Processing purposes
- Third-party processors
- Data retention periods
- Contact information (request from user)
Phase 7: Data Flow Diagram
Generate a Mermaid data flow diagram showing:
- Data collection points (forms, APIs, SDKs)
- Storage locations (databases, caches, files, third parties)
- Processing activities (analytics, ML, notifications)
- Data transfers (cross-border, third-party)
- Deletion/retention paths
Code Pattern Detection
To identify compliance issues, search for these patterns:
Universal Patterns (any language)
grep -ri "password\|secret\|api.key\|token" --include="*.log" — secrets in logsgrep -ri "console\.log\|print\|logger" | grep -i "email\|phone\|ssn\|password" — PII logginggrep -ri "http://" --include="*.{js,ts,py,rb,php}" — insecure HTTPgrep -ri "eval\|exec\|system\|passthru" — injection risks
Framework-Specific
Maintain detection patterns per stack in references/code-patterns.md:
- Laravel/PHP
- React/Next.js
- Python/Django/Flask
- Ruby on Rails
- Node.js/Express
- iOS/Swift
- Android/Kotlin
Output Files
After a full audit, the following files should be generated in the project:
compliance-report.md — Full audit report with findings
docs/legal/privacy-policy.md — Customized Privacy Policy
docs/legal/cookie-policy.md — Customized Cookie Policy (if applicable)
docs/legal/dpa.md — Data Processing Agreement (if applicable)
docs/legal/dpia.md — Data Protection Impact Assessment (if high-risk)
Important Notes
- This skill provides technical compliance analysis, not legal advice
- Always recommend the user consult with a qualified legal professional
- Legal document templates are starting points that require legal review
- Compliance is ongoing — recommend periodic re-audits
- Different jurisdictions may have additional requirements
- When unsure about applicability, flag it and ask the user
