Legal, Security & Compliance Auditor

Ship to production with confidence. This skill runs a deep privacy and security audit of your codebase and produces a single, prioritized report — like having a junior data-protection engineer on call.

What it audits

• GDPR + UK GDPR — 23 checks: lawful basis, consent, all data-subject rights (Art. 15–22), data protection by design, security, breach notification, international transfers
• CCPA / CPRA — 17 checks: notice at collection, sale/share opt-out, Global Privacy Control, minor opt-in, sensitive PI, request response SLA
• Data security — 20 checks: password hashing, encryption at rest and in transit, secrets in code, PII in logs, JWT and session security, SQL injection, security headers, CORS
• LLM disclosure & AI compliance — 16 checks: AI labeling, inaccuracy warnings, data sent to providers, EU AI Act Art. 50, prompt injection, vector store privacy, automated decisions
• LGPD (Brazil), PIPL (China), DPDPA (India) — 24 conditional checks loaded only when the skill detects you target those markets

How it works

1. Detects target markets from i18n files, currencies, domains, languages, framework signals. Asks if signals are ambiguous.
2. Maps your PII surface — database models, API endpoints, forms, logs, third parties, LLM integrations, cookies, auth flows.
3. Runs applicable checklists against the map.
4. Writes COMPLIANCE_AUDIT.md with Critical / High / Medium / Low findings. Every finding has the exact file:line, the article cited (e.g. "GDPR Art. 17(1)(a)"), what's wrong, why it matters, and a concrete fix.

Why this skill stands out

• Adaptive scope — auto-detects target jurisdictions, so you get only the checks that apply
• Concrete fixes, not vague advice — "Replace SHA-256 with argon2id (m=19456 KB, t=2, p=1), migrate on next login" beats "use stronger hashing"
• Honest boundaries — produces an engineering audit, not legal advice; report ends with disclaimer recommending qualified counsel
• Agent-agnostic — Claude Code, Cursor, Codex CLI, VS Code Copilot, Gemini CLI, Windsurf
• Stack-aware — recognizes Prisma, Drizzle, TypeORM, SQLAlchemy, Django ORM, Active Record, Mongoose, plus Next.js, FastAPI, Express, NestJS, Rails routing

Who it's for

• Founders preparing for production launch in EU / UK / US
• Engineers preparing for a SOC 2 / ISO 27001 / DPIA review
• Teams adding AI features who need to disclose properly
• Anyone shipping a product that touches user data

Trigger phrases

The skill auto-loads when you naturally ask things like:

• "Check my app for GDPR compliance"
• "Do a privacy audit before launch"
• "Find data protection issues"
• "Audit my codebase for personal data handling"
• "Review my app before launching in the EU"

Limitations

Static review only. Does not write fixes (you decide what to change), does not generate Privacy Policy / Terms text, does not certify compliance. Consult a qualified data protection lawyer for binding decisions.