Compliance Audit
Audit a website, app, or product's codebase for GDPR and EU AI Act compliance, then hand back a ranked list of plain-English fixes. Asks the owner the handful of questions the code cannot answer, reads the actual code (forms, API routes, dependencies, env vars, database schema, policy pages) to work out what personal data the product really collects and who it is shared with, then checks that against what the law requires. It exists to catch the gaps a pasted-in policy template hides. MANDATORY TRIGGERS: 'compliance audit', 'run compliance-audit', 'audit my compliance', 'audit this for GDPR',
Install
npx skills add oliwoodman/compliance-audit-skill --skill compliance-auditgit clone --depth 1 https://github.com/oliwoodman/compliance-audit-skill.git /tmp/compliance-audit-skill
mkdir -p ~/.claude/skills
cp -r /tmp/compliance-audit-skill/. ~/.claude/skills/compliance-auditPersonal skills live in ~/.claude/skills. Use .claude/skills in a project folder to share a skill with your team.
From the SKILL.md
# Compliance Audit Most vibe-coded products are quietly breaking the law. Not on purpose. The founder pasted in a privacy-policy template, wired up an AI API, dropped in Google Analytics, and shipped. But if anyone in the EU or UK can use the product, **GDPR applies**, and since **2 August 2026** the **EU AI Act**'s transparency rules apply too. A note on the AI Act delay, because the person you are helping may have heard about it. The 2026 amendment moved the **high-risk** obligations (hiring tools, credit scoring, medical, education, essential services) to 2 December 2027 and 2 August 2028. It did not move the duty to tell people they are talking to an AI. That has applied since 2 August 2026 and it applies to a side project. This skill works the way a careful reviewer would. It asks the owner the few things the code cannot tell it, reads what the product *actually* does, compares both to what the law requires, and comes back with a short, ranked list of things to fix. Each one is specific, evidence-backed, and paired with an offer to fix it. It does **not** give legal advice. It gets someone most of the way there and tells them where to get a human if the stakes are high. --- ## The one rule, evidence over assumptions
Details
- Skill name
compliance-audit- Repository
- oliwoodman/compliance-audit-skill
- Repo updated
- 27 August 2026
FAQ
What does the Compliance Audit skill do?
Audit a website, app, or product's codebase for GDPR and EU AI Act compliance, then hand back a ranked list of plain-English fixes. Asks the owner the handful of questions the code cannot answer, reads the actual code (forms, API routes, dependencies, env vars, database schema, policy pages) to work out what personal data the product really collects and who it is shared with, then checks that against what the law requires. It exists to catch the gaps a pasted-in policy template hides. MANDATORY TRIGGERS: 'compliance audit', 'run compliance-audit', 'audit my compliance', 'audit this for GDPR',
How do I install the Compliance Audit skill?
skills CLI (Claude Code, Cursor, Codex and more): npx skills add oliwoodman/compliance-audit-skill --skill compliance-audit. Skills go in ~/.claude/skills (personal) or .claude/skills (project), and Claude loads them automatically when a task matches the description.
Is Compliance Audit popular?
It lives in oliwoodman/compliance-audit-skill, which has 11 GitHub stars and 0 forks.
Related skills
Deconstruct Skill
11luoming-hu/deconstruct-skill
静态拆解本地文件、粘贴内容或代码仓库链接中的 Codex Skill,生成一份简洁、通俗、可下载的 Markdown 报告。报告只用六个章节直接说明最终交付、具体动作、步骤顺序、角色分工、规则所防的问题和可复用做法;不复制原文、不逐段批注、不列证据账本或源码引用,也不输出问题与改进建议。用户要求拆解、逆向分析、讲解或解释一个 Skill 为什么这样设计时使用。仅执行、安装或创建普通 Skill 时不要使用,除非用户同时要求先分析。
Saudi Regulatory Compliance
9ibnsawad/Saudi-Regulatory-Compliance-Claude-Skill
Senior cybersecurity, cloud, and data-protection compliance advisor for organisations in Saudi Arabia. Trigger for: NCA ECC-2:2024, CCC-2:2024, DCC-1:2022, CSCC-1:2019, OTCC-1:2022, TCC-1:2021, OSMACC-1:2021, CGEC-1:2019, CGESP-1:2019, NCS-1:2020; SAMA Cybersecurity/IT Governance/Business Continuity Frameworks; CST Cloud Computing Regulatory Framework, CST CRF RT08; PDPL and Implementing Regulations, Personal Data Transfer Regulation; NDMO Data Management Standards; SDAIA guidance including the AI Risk Management Framework (SDAIA-P145). Also trigger for gap assessments, audit readiness, breach
Framework Builder
11framework-creator/framework-builder
Build reusable agent-readable frameworks from any domain expertise. Use when someone says "systematize this," "turn this into a repeatable process," "build a framework for," "create a skill for," "I keep doing the same thing," or "make this predictable." Produces a complete five-layer framework in markdown that agents and humans can follow to get consistent results. Works across any industry or domain. Created by Mike Goetz at RageDesigner (ragedesigner.com) who has built 1,250+ frameworks across industries from federal contracting to medical advocacy to comedy development using this methodolo
Driving Seat
10Tanmay-Ts/driving-seat
Keeps the developer in control of every decision that matters while building or changing software. Turns vague goals into measurable intent, maps decisions up front, asks before any significant choice the spec doesn't cover, logs every choice made without asking, and checks that the developer understands decisions instead of delegating them. Use this skill whenever the user says "keep me in the driving seat", "ask before you decide", "don't make decisions for me", "I want to own the decisions", or invokes /driving-seat, and whenever they are building, changing, or fixing a production system an
Plugin Fast Adapt
11taxueseek/plugin-fast-adapt
DSH 插件升级适配的主入口。查 DeepSeek 官方最新版本,取该版本的官方升级指南,扫描本机插件代码,报出踩了哪些破坏性变更并给官方修法;seams 查某个包或 API 在指南与本机宿主里的双源结论;run.mjs 一键跑完环境→定版→指南→扫描→体检→冒烟→typecheck 并写本地运行日志。官方指南覆盖不到的老版本转迁移 SOP。造插件走 dsh-plugin-build,装了没生效或宿主起不来走 dsh-plugin-diagnose。触发词:适配 DSH 插件、升级插件、插件不兼容、dsh 升级后报错、插件用了废弃 API、接缝查询、这个 API 还在不在、老版本 DSH 适配、历史走廊迁移、一键编排、运行日志、插件性能架构体检、批量巡检。
Codemap
10beadnall/codemap
Turns a codebase into an explorable isometric architecture diagram — a self-contained HTML artifact with blocks on a grid, a component index, a what-it-does/how-it's-built panel, and real data snippets travelling along the edges that the reader can stop and inspect. Use this whenever someone asks for a codemap by name — "create a codemap", "codemap this repo", "make a codemap of github.com/owner/name" — and equally when they want to see, map, diagram or visually explain how a system fits together: "diagram this codebase", "show me the architecture", "map how this works", "visualise the data fl
Browse the most popular Claude skills, all software development skills, or write your own with the skills generator.