I just added a compliance category to my open-source agents-skills repo: 18 Agent Skills that let a coding agent (Claude Code, Codex, Cursor and friends) review your code, data flows and documents against a regulation, and write a findings report you can actually act on.
What a review looks like
You point the agent at a repo, a diff, an architecture description or a document (privacy notice, cookie banner text, DPA, DPIA...) and ask something like:
Check this signup flow and privacy notice for GDPR compliance.
The skill makes the agent:
- Scope the review – what the artifact is, your role (controller or processor), and whether the law even applies. If it doesn't, the report says so and stops.
- Walk a checklist grounded in the official text and the regulator's guidance.
- Write findings – each one with the article it comes from, the evidence (file and line, or the paragraph in a document), the issue and a concrete fix.
The bar: a review a developer can act on and a privacy lawyer can verify quickly.
The skills
| Skill | Covers |
|---|---|
world-wide-compliance |
Screens one product against every regime below, runs each review that applies and merges one world-wide report |
gdpr-compliance |
EU GDPR |
uk-gdpr-compliance |
UK GDPR, Data Protection Act 2018 and PECR |
ccpa-cpra-compliance |
California CCPA as amended by the CPRA |
us-state-privacy-compliance |
Comprehensive US state privacy laws (Virginia, Colorado, Connecticut...) |
lgpd-compliance |
Brazil's LGPD |
pipeda-law25-compliance |
Canada's PIPEDA and Quebec's Law 25 |
dpdp-compliance |
India's DPDP Act and Rules |
pipl-csl-compliance |
China's PIPL, Cybersecurity Law and cross-border data rules |
coppa-compliance |
US COPPA (children under 13) |
aadc-compliance |
Age-appropriate design codes (UK, California, EU) |
hipaa-hds-compliance |
US HIPAA and French HDS health-data hosting |
pci-dss-compliance |
PCI DSS for cardholder data |
psd2-sca-compliance |
EU PSD2 strong customer authentication and open banking |
eprivacy-compliance |
EU ePrivacy Directive: cookies, tracking, e-marketing |
eu-dsa-compliance |
EU Digital Services Act |
eu-ai-act-compliance |
EU AI Act |
app-store-compliance |
Apple App Store and Google Play privacy and review policies |
The orchestrator: world-wide-compliance
The one I'm most excited about is world-wide-compliance. Launching in new markets? It screens your product against every regime above, runs the full review for each one that applies, and merges the results into a single report:
- an applicability table (which laws apply and why),
- a status per regime,
- cross-regime findings – where one fix closes requirements in several laws at once (e.g. one retention policy that satisfies GDPR, LGPD and DPDP).
Install
With the Skills CLI:
# One regime
npx skills add cookieMonsterDev/agents-skills@gdpr-compliance -g -y
# Everything (the orchestrator needs all compliance skills installed side by side)
npx skills add cookieMonsterDev/agents-skills --all -g -y
Then just ask your agent: "Is this app ready to launch in the EU, UK and Brazil?"
Ground rules
- Not legal advice. These are technical and documentary reviews. Decisions on lawful basis, risk acceptance or threshold calls are routed to your DPO, compliance officer or counsel.
- Citations or it didn't happen. Every requirement cites the article, recital or clause and links the authoritative source.
- No real personal data in reports. Personal data is described by category and location; examples use synthetic values only.
Feedback welcome
The repo is MIT-licensed: github.com/cookieMonsterDev/agents-skills. Issues and PRs welcome – especially from people who live with these regulations day to day. Which regime should I add next?
Top comments (0)