菜单
Check that your legal compliance is still in good shape. Pick what to check: your privacy policy, your privacy vendor list, or your contract templates. I surface what's drifted or out of date and what to fix. I never change anything on my own.
默认使用会先检查来源的 Prompt；你也可以切换为直接命令，或下载本地副本。
决定是否安装前，请先阅读 SKILL.md，以及 SkillsMP 当前展示的配套文件。
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
直接命令不会经过审查 Prompt；运行前请先检查来源。
npx skills add https://github.com/ThomasMoreAI/legal-skills-open --skill audit-compliance命令会保持在同一行。复制前请横向滚动并检查完整内容。
想先保存到本地？可下载 SkillsMP 当前能够提供的文件。
基于 SOC 职业分类
正在显示 SKILL.md
| name | audit-compliance |
| title | Audit Compliance |
| description | Check that your legal compliance is still in good shape. Pick what to check: your privacy policy, your privacy vendor list, or your contract templates. I surface what's drifted or out of date and what to fix. I never change anything on my own. |
| author | gethouston |
| author_url | https://github.com/gethouston/houston/tree/main/store/agents/legal/.agents/skills/audit-compliance |
| license | MIT |
| version | 0.1.0 |
| execution_mode | open |
| jurisdiction | general |
| practice | data-protection |
| language | en |
One skill for all standing-state compliance checks. scope param picks inventory to walk. "Diffs not fixes" + "every finding cite authority" discipline shared.
scopeprivacy-posture - scrape landing + product via Firecrawl, cross-check deployed Privacy Policy, flag drift (new analytics tool undisclosed, subprocessor added no policy update, new cookie, purpose drift) with severity + recommended update. Writes privacy-audits/{YYYY-MM-DD}.md.subprocessors - walk connected integrations + inferred vendors from landing-page scrape, capture role + data categories + transfer mechanism + DPA status + public DPA URL. Read-merge-write subprocessor-inventory.json at agent root + one-page delta report at subprocessor-reviews/{YYYY-MM-DD}.md.template-library - read domains.contracts.templateLibrary, flag templates > 12 months old, check each vs current law refs (AI-training disclosure, SCC versions, 2026 DPA standards, CA/EU rights expansions). Writes refresh plan template-reviews/{YYYY-MM-DD}.md. Never auto-rewrites - founder approves each, kicks draft-a-legal-document for rewrite.User name scope plain English ("audit my privacy", "refresh templates", "update subprocessor list") → infer. Ambiguous → ask ONE question naming 3 options.
scope: "is my privacy policy still current" / "does my privacy policy match what we actually do" → privacy-posture; "refresh my privacy vendor list" / "have we added new tools that touch customer data" → subprocessors; "are my contract templates still current" / "any template older than a year I should refresh" → template-library.Read config/context-ledger.json first.
universal.legalContext + context/legal-context.md - required. Provides entity snapshot, risk posture, existing template stack (anchor for template-library scope). Missing → run skill first (or ask ONE targeted question to skip ahead).set-up-my-legal-infouniversal.company.website - required for privacy-posture + subprocessors (landing-page URL for Firecrawl).domains.compliance.landingPageUrl - more specific than universal.company.website if differ; falls back to website.domains.compliance.deployedPolicies.privacyPolicyUrl - required for privacy-posture (doc to diff against).domains.compliance.dataGeography - gates whether EU-specific subprocessor controls (SCCs, transfer mechanism) apply.domains.contracts.templateLibrary - required for template-library.subprocessor-inventory.json - required for subprocessors (prior inventory = baseline for delta).Required field missing → ask ONE targeted question with modality hint (connect Google Drive / paste landing URL / connect Firecrawl), write, continue.
composio search web-scrape (privacy-posture, subprocessors) or composio search document-storage (template-library) per scope. No tool connected → name category to link, stop.scope.
privacy-posture:
critical - regulatory exposure; high - customer trust risk; medium - housekeeping; low - FYI). Cite authority for every critical finding (GDPR Art. 13/14, CCPA §1798.100, 16 CFR Part 314 where applicable).privacy-audits/{YYYY-MM-DD}.md: Executive summary → Diffs by severity → Recommended next step per finding (most often: chain to draft-a-legal-document type=privacy-policy).subprocessors:
subprocessor-inventory.json.role (payment / email / analytics / support / hosting / AI / CRM / other), dataCategories (identifiers / usage / content / payment / sensitive), transferMechanism (SCCs / UK IDTA / DPF / intra-EU / intra-US-only / unknown), dpaStatus (signed standard / signed negotiated / public-posted / missing / unknown), publicDpaUrl.subprocessor-inventory.json. Delta vs prior = added / removed / changed / unchanged.subprocessor-reviews/{YYYY-MM-DD}.md - one-page delta, "new vendors needing policy update" at top + link to audit-compliance scope=privacy-posture as follow-up.template-library:
domains.contracts.templateLibrary. Per template, check lastUpdatedAt (or file metadata); flag anything > 12 months.template-reviews/{YYYY-MM-DD}.md - refresh plan: (a) templates to refresh now, (b) review next quarter, (c) still current. Never auto-rewrites; recommends chaining draft-a-legal-document per template.outputs.json - read-merge-write atomically: { id, type: "privacy-audit" | "subprocessor-review" | "template-review", title, summary, path, status: "ready", domain: "compliance", createdAt, updatedAt, attorneyReviewRequired? }. Set attorneyReviewRequired: true when critical finding implicates regulatory exposure.subprocessor-inventory.json - read-merge-write.critical privacy-posture finding.privacy-audits/{YYYY-MM-DD}.md (scope=privacy-posture).subprocessor-reviews/{YYYY-MM-DD}.md + updates subprocessor-inventory.json (scope=subprocessors).template-reviews/{YYYY-MM-DD}.md (scope=template-library).outputs.json.