A friend of mine runs a beauty brand on Shopify. Last month he called me, shaken.
An “ADA troll” had filed an $80,000 lawsuit against him — over a handful of technical things on his website. Missing alt text. A tracker firing before consent. Things you can fix in an hour.
For a business his size, fighting wasn’t an option. Defending costs more than settling, and these people know it — that’s the whole model. He settled for $45,000 and took out a loan to pay it.
A loan. To pay a troll. Over a checkbox and some missing alt text.
This isn’t 2022 anymore
Back then, these guys did it by hand — a person actually visiting sites, looking for violations. Slow, and limited by how many pages one human could open in a day.
Today they run automated scanners. Software crawls thousands of ecommerce sites, filters for the ones that (a) have a provable defect and (b) look like they can pay, and fires off demand letters at scale. It’s an industry now. Your store doesn’t get picked because someone had a grievance with you — it gets picked because a script flagged it and moved on to the next one.
If you sell online, you’re in the pile being scanned right now. You just don’t know it yet.
Who this is for
Online store owners — Shopify, WooCommerce, BigCommerce, Wix. If you take payments and ship to customers, you’re a target.
“Vibe coders” — anyone shipping sites fast with Lovable, Base44, Bolt, v0, Framer, or Cursor. These tools get you live in an afternoon and quietly skip consent banners, cookie policies, and accessibility basics. You already prompt AI tools to build — you can run this the exact same way.
Anyone with no legal background who has a nagging feeling they’ve missed something and no idea where to look.
You don’t need to understand the law. You need to know what’s flagged and what to fix.
I couldn’t help my friend. I can hopefully help you.
I’m an engineer. I couldn’t undo his letter, but I could build the thing that would’ve warned him and help other people.
How it works
- Trackers and session-recording firing before anyone consents (the “wiretapping” claims — the fastest-growing category)
- Missing privacy and cookie policies
- The accessibility gaps a machine can actually verify — missing alt text, unlabeled form fields, no page language
It reads your storefront to figure out which countries you sell to, then shows only the laws that apply — GDPR, California’s CCPA, Israel’s IS 5568, the ADA. And it tells you, in plain English, what to fix and roughly how long each takes.
How to run it
It’s a skill for AI coding agents — Claude Code, Codex, Gemini CLI.
*Claude Code (two commands — the first registers it, the second installs it):
*
claude plugin marketplace add kobimantzur/agent-skills
claude plugin install site-risk-check@kobimantzur
Or clone it directly:
git clone https://github.com/kobimantzur/agent-skills.git && cd agent-skills && ./install.sh
Then ask, in plain words: check if my site is legally covered — myshop.com
Free, open source (MIT), no signup, no paid tier. The scanner is a local Python script that reads a public web page — the same page any visitor sees. (One honest note: when you run it through an AI agent, that agent sees the page and the report. The script is local; the agent isn’t.)
Repo (free, open source): https://github.com/kobimantzur/agent-skills
The honest version
This won’t make you untouchable, and it isn’t legal advice. A determined human plaintiff can still dig into things software can’t see — real color contrast, keyboard navigation, whether your alt text is actually meaningful. The tool tells you plainly what it couldn’t check, every time.
But the overwhelming majority of these letters don’t come from determined humans. They come from automated scans hunting for easy, provable defects — and that’s exactly what this clears. Take the easy cards off the table, and you stop being the cheap target most of them are looking for.
My friend paid $45,000 to learn this. You can find out in two minutes.
Run it on your site today.
Top comments (0)