What does this skill do, and when should you use it?
One of 14 skills in the AI Legal Assistant collection, triggered by `/legal compliance <url>`. It uses WebFetch to retrieve a site's homepage, privacy policy, terms of service, cookie policy, trust pages and footer, first detecting what the site does to determine which frameworks apply, then walking a per-framework checklist (cookie consent banners, "Do Not Sell" links, HTTPS, accessibility markup, etc.). It computes a weighted compliance score, classifies every failed check by priority, and writes a Markdown audit report with a scorecard, fix recommendations, and a week/month/quarter remediation roadmap. The report carries a legal disclaimer stating it is a surface-level automated scan and not legal advice.
1) Takes a website URL as input; 2) fetches the homepage, privacy policy, terms of service, cookie policy, security/trust pages and footer via WebFetch; 3) determines which of GDPR, CCPA/CPRA, ADA/WCAG, PCI-DSS, CAN-SPAM, COPPA and SOC 2 apply based on site characteristics (personal data collection, cookies, payments, child-directed content, etc.); 4) evaluates each applicable framework's checklist items with Pass/Fail/Warning/N/A statuses; 5) computes scores and A-F grades using weights (GDPR 25%, CCPA 20%, PCI-DSS 20%, ADA 15%, CAN-SPAM 10%, COPPA 10%, SOC 2 as bonus); 6) assigns each failed check a Critical/High/Medium/Low priority with concrete fix steps; 7) writes a COMPLIANCE-AUDIT-[company]-[date].md report file and presents the scorecard and top issues in the conversation.
- An indie developer or small-business owner self-checking public compliance signals (cookie consent, privacy policy, accessibility) after launching or redesigning a website
- An e-commerce or SaaS operator serving California or EU users, verifying hard requirements like the "Do Not Sell or Share" footer link or GDPR data-subject-rights disclosures
- An agency running first-pass website compliance triage for clients, delivering the scorecard and remediation roadmap as an initial diagnostic report
- A B2B SaaS team preparing for enterprise procurement, checking trust-page, subprocessor-list and DPA signals buyers commonly look for under SOC 2
- A marketing team collecting email signups, confirming CAN-SPAM unsubscribe mechanisms and physical-address disclosures are in place
How do you install this skill?
- This is a static source-only review; nothing was executed and confidence is low.
- Checks rely solely on publicly visible page signals; the output explicitly is not legal advice and must not be used as proof of compliance.
- Regulatory coverage is US/EU only (GDPR, CCPA, ADA, PCI-DSS, CAN-SPAM, COPPA, SOC 2); Chinese frameworks such as PIPL are not covered and there is no Chinese-language support.
- Several check items (cookie firing order, keyboard navigation, color contrast) cannot be reliably judged from text fetching, so scores may be inaccurate.
- Repository license metadata is unknown; the skill has no versioning or maintenance commitment. README contains unsourced marketing figures — verify independently before citing.
- The skill fetches arbitrary URLs without a confirmation mechanism; avoid pointing it at sensitive or internal sites.
- Network access
- Local filesystem
This skill is part of the zubair-trabzada/ai-legal-claude collection. Install the whole collection: curl -fsSL https://raw.githubusercontent.com/zubair-trabzada/ai-legal-claude/main/install.sh | bash. That command installs all 14 skills, 5 agents, and the PDF generation scripts. The skill file lives at skills/legal-compliance/SKILL.md in the repo. The source does not document a way to install this single skill alone.
tmp="$(mktemp -d)"
git clone --depth 1 https://github.com/zubair-trabzada/ai-legal-claude.git "$tmp"
mkdir -p ~/.claude/skills
cp -R "$tmp/skills/legal-compliance" ~/.claude/skills/
rm -rf "$tmp"Generated from the source repository and skill path; it copies only this skill's folder. If the author's install steps above differ, follow those first. To scope it to one project, replace ~/.claude/skills with that project's .claude/skills.
How do you use this skill?
In Claude Code, run /legal compliance <url> where <url> is the target website, e.g. /legal compliance https://example.com. The skill scans the site's public pages, audits each framework, then displays the compliance scorecard and top three critical issues, offering follow-ups: generate a privacy policy (/legal privacy [url]) or review terms of service (/legal terms-review [url]). Note the report explicitly states it is a surface-level scan that does not detect backend data handling and is not a legal audit.
What are this skill's strengths and limitations?
- Covers seven common compliance frameworks with concrete, checkable items (14 GDPR checks, 10 CCPA checks, 10 ADA/WCAG checks, etc.) rather than vague advice
- Produces a structured scorecard, letter grades, prioritized issue lists, and a dated remediation roadmap usable as a working document
- Honest built-in limitations section acknowledging the accessibility scan is surface-level and full PCI-DSS assessment requires a QSA or SAQ
- Scoring weights come with stated rationale (e.g., GDPR fines up to 4% of global revenue)
- Only evaluates publicly visible compliance signals; backend data handling, internal policies and staff training are out of scope
- Accessibility checks are surface-level; a full WCAG 2.1 AA audit needs tools like axe or WAVE plus manual testing
- HIPAA and GLBA are flagged only, not deeply evaluated
- No license specified and no test suite or accuracy validation provided in the repo
- Relies on Claude Code slash-command and WebFetch mechanics; porting to other platforms requires adaptation
How does this skill compare with similar options?
Side by side with related skills; every score comes from the same FSRS standard.
| Skill | FS score | Stars | Last updated | License |
|---|---|---|---|---|
| Compliance Gap Analysis this page | 46 · Use with care | ★ 1.8k | 7mo ago | — |
| Terms of Service Generator (AI Legal Assistant) | 50 · Use with care | ★ 1.8k | 7mo ago | — |
| Master Claude for Legal | 54 · Use with care | ★ 71 | 5mo ago | NOASSERTION |
| Missing Protections Finder (AI Legal Assistant) | 45 · Not recommended | ★ 1.8k | 7mo ago | — |
| AI Legal Assistant (legal/SKILL.md Orchestrator) | 43 · Not recommended | ★ 1.8k | 7mo ago | — |
How did FollowSkills review this skill?
The skill only reads public web pages via WebFetch and writes a Markdown report — no credentials, no destructive operations, no effects outside its output file, so the permission surface is narrow; it includes explicit legal disclaimers and limitation statements. Deducted for: no confirmation or allowlist mechanism for scanned URLs (arbitrary fetches), implicit-only data-flow disclosure, dependence on external site reachability with no recovery concept, and unverified publisher identity. No red-line issue found.
Instructions are self-consistent and well structured (five phases, scoring rubric, complete report template), making the happy path plausible. Deducted for: no tests or committed execution evidence; many check items (color contrast, keyboard navigation, whether cookies fire before consent) exceed what text fetching can verify with no stated failure feedback; no error-handling path for unreachable or bot-blocked sites.
Trigger condition is explicit (/legal compliance <url>), the framework-applicability detection table and N/A status are well defined, and the audience (website compliance self-check) is clear. Deducted for: frameworks are exclusively US/EU — no Chinese jurisdiction (e.g. PIPL) coverage and no Chinese-language support; success partly depends on WebFetch reachability of target sites and Anthropic API availability, unassessed from mainland-China networks.
Documentation is well layered (invocation, checklists, scoring, report template, limitations) and matches the repository structure. Deducted for: unknown license metadata; no version number, changelog, or maintenance responsibility in the skill file itself; hidden assumptions (e.g. WebFetch detecting cookie load order); missing FAQ/troubleshooting.
Output is a complete structured Markdown report (scorecard, prioritized issues, remediation roadmap) that is directly usable, with honest limitations labeling. Deducted for: static review cannot verify output quality; several checks are inherently unverifiable from visible page signals (backend data handling, cookie firing order), risking systematically skewed scores; no representative output samples or user validation.
The mapping of check items to regulatory requirements is auditable and the report template makes the structure reproducible. Deducted for: no test suite, no CI execution evidence, no third-party validation or real output examples; README contains many unsourced marketing figures ($300-500/hour, 82%, etc.) that are promotional claims only. High scores are unreachable in a static read.
Open a dimension to read why it scored that way
Evidence confidence：Low — Mostly static review, author material or a limited demo; useful for discovery, not high-risk decisions.
See the full review method →