| name | compliance-audit |
| description | Performs regulatory gap analysis across 7 compliance frameworks with a scored
report card and prioritized remediation roadmap. Use when assessing a website
or application for GDPR, CCPA, ADA, PCI-DSS, CAN-SPAM, COPPA, or SOC 2 compliance.
Trigger with "/compliance-audit" or "audit my website for regulatory compliance".
|
| allowed-tools | Read, Glob, Grep, WebFetch |
| version | 1.1.0 |
| author | Intent Solutions <jeremy@intentsolutions.io> |
| license | MIT |
| tags | ["legal","compliance","gdpr","ccpa","ada","pci-dss","audit","regulatory"] |
| compatibility | Designed for Claude Code |
Regulatory Compliance Audit
Overview
Executes a two-phase compliance analysis — detection scan followed by framework-by-framework
evaluation — across 7 regulatory frameworks. Produces a compliance scorecard with letter
grades (A-F) per framework, identifies specific gaps, and generates a prioritized
remediation roadmap with effort estimates and timelines.
This skill reads and analyzes existing assets. It does not generate legal documents or
modify any files. The output is an audit report documenting findings and recommendations.
Legal Disclaimer: This skill generates AI-assisted compliance analysis for
informational purposes only. It does not constitute legal advice, certification, or
attestation of compliance. Regulatory requirements are complex and jurisdiction-specific.
All findings should be reviewed by qualified legal counsel and/or certified compliance
professionals. No attorney-client relationship is created by using this tool.
Prerequisites
- A live website URL or local codebase to analyze
- Access to any existing privacy policy, terms of service, or compliance documentation
- Knowledge of the business type, target audience, and geographic reach
Instructions
Phase 1: Detection Scan
-
Scan the website. Use WebFetch on the target URL to collect:
- HTML source (meta tags, structured data, accessibility attributes)
- Cookie and tracking behavior (Set-Cookie headers, JavaScript trackers)
- Form elements (input types, required fields, consent checkboxes)
- Payment indicators (payment form fields, processor scripts)
- Third-party scripts and embeds (analytics, advertising, social)
- SSL/TLS certificate presence
- Content targeting indicators (age-related content, children's themes)
-
Scan the codebase (if available). Use Glob and Grep to find:
- Privacy policy and terms of service files
- Cookie consent implementation code
- Authentication and access control patterns
- Data encryption at rest and in transit
- Logging and audit trail implementations
- Age verification or gate mechanisms
- Email sending code and unsubscribe handling
- Payment processing integrations
- Accessibility attributes (aria-*, alt text, semantic HTML)
-
Build the detection inventory. Create a structured map of findings:
