Compliance Gap Analysis
Scans any website and audits it against GDPR, CCPA, ADA/WCAG, PCI-DSS, CAN-SPAM, COPPA and SOC 2, producing a scored gap report with a remediation roadmap.
The skill only reads public web pages via WebFetch and writes a Markdown report — no credentials, no destructive operations, no effects outside its output file, so the permission surface is narrow; it includes explicit legal disclaimers and limitation statements. Deducted for: no confirmation or allowlist mechanism for scanned URLs (arbitrary fetches), implicit-only data-flow disclosure, dependence on external site reachability with no recovery concept, and unverified publisher identity. No red-line issue found.
Instructions are self-consistent and well structured (five phases, scoring rubric, complete report template), making the happy path plausible. Deducted for: no tests or committed execution evidence; many check items (color contrast, keyboard navigation, whether cookies fire before consent) exceed what text fetching can verify with no stated failure feedback; no error-handling path for unreachable or bot-blocked sites.
Trigger condition is explicit (/legal compliance <url>), the framework-applicability detection table and N/A status are well defined, and the audience (website compliance self-check) is clear. Deducted for: frameworks are exclusively US/EU — no Chinese jurisdiction (e.g. PIPL) coverage and no Chinese-language support; success partly depends on WebFetch reachability of target sites and Anthropic API availability, unassessed from mainland-China networks.
Documentation is well layered (invocation, checklists, scoring, report template, limitations) and matches the repository structure. Deducted for: unknown license metadata; no version number, changelog, or maintenance responsibility in the skill file itself; hidden assumptions (e.g. WebFetch detecting cookie load order); missing FAQ/troubleshooting.
Output is a complete structured Markdown report (scorecard, prioritized issues, remediation roadmap) that is directly usable, with honest limitations labeling. Deducted for: static review cannot verify output quality; several checks are inherently unverifiable from visible page signals (backend data handling, cookie firing order), risking systematically skewed scores; no representative output samples or user validation.
The mapping of check items to regulatory requirements is auditable and the report template makes the structure reproducible. Deducted for: no test suite, no CI execution evidence, no third-party validation or real output examples; README contains many unsourced marketing figures ($300-500/hour, 82%, etc.) that are promotional claims only. High scores are unreachable in a static read.
- This is a static source-only review; nothing was executed and confidence is low.
- Checks rely solely on publicly visible page signals; the output explicitly is not legal advice and must not be used as proof of compliance.
- Regulatory coverage is US/EU only (GDPR, CCPA, ADA, PCI-DSS, CAN-SPAM, COPPA, SOC 2); Chinese frameworks such as PIPL are not covered and there is no Chinese-language support.
- Several check items (cookie firing order, keyboard navigation, color contrast) cannot be reliably judged from text fetching, so scores may be inaccurate.
- Repository license metadata is unknown; the skill has no versioning or maintenance commitment. README contains unsourced marketing figures — verify independently before citing.
- The skill fetches arbitrary URLs without a confirmation mechanism; avoid pointing it at sensitive or internal sites.
What does this skill do, and when should you use it?
One of 14 skills in the AI Legal Assistant collection, triggered by `/legal compliance <url>`. It uses WebFetch to retrieve a site's homepage, privacy policy, terms of service, cookie policy, trust pages and footer, first detecting what the site does to determine which frameworks apply, then walking a per-framework checklist (cookie consent banners, "Do Not Sell" links, HTTPS, accessibility markup, etc.). It computes a weighted compliance score, classifies every failed check by priority, and writes a Markdown audit report with a scorecard, fix recommendations, and a week/month/quarter remediation roadmap. The report carries a legal disclaimer stating it is a surface-level automated scan and not legal advice.
1) Takes a website URL as input; 2) fetches the homepage, privacy policy, terms of service, cookie policy, security/trust pages and footer via WebFetch; 3) determines which of GDPR, CCPA/CPRA, ADA/WCAG, PCI-DSS, CAN-SPAM, COPPA and SOC 2 apply based on site characteristics (personal data collection, cookies, payments, child-directed content, etc.); 4) evaluates each applicable framework's checklist items with Pass/Fail/Warning/N/A statuses; 5) computes scores and A-F grades using weights (GDPR 25%, CCPA 20%, PCI-DSS 20%, ADA 15%, CAN-SPAM 10%, COPPA 10%, SOC 2 as bonus); 6) assigns each failed check a Critical/High/Medium/Low priority with concrete fix steps; 7) writes a COMPLIANCE-AUDIT-[company]-[date].md report file and presents the scorecard and top issues in the conversation.
- An indie developer or small-business owner self-checking public compliance signals (cookie consent, privacy policy, accessibility) after launching or redesigning a website
- An e-commerce or SaaS operator serving California or EU users, verifying hard requirements like the "Do Not Sell or Share" footer link or GDPR data-subject-rights disclosures
- An agency running first-pass website compliance triage for clients, delivering the scorecard and remediation roadmap as an initial diagnostic report
- A B2B SaaS team preparing for enterprise procurement, checking trust-page, subprocessor-list and DPA signals buyers commonly look for under SOC 2
- A marketing team collecting email signups, confirming CAN-SPAM unsubscribe mechanisms and physical-address disclosures are in place
What are this skill's strengths and limitations?
- Covers seven common compliance frameworks with concrete, checkable items (14 GDPR checks, 10 CCPA checks, 10 ADA/WCAG checks, etc.) rather than vague advice
- Produces a structured scorecard, letter grades, prioritized issue lists, and a dated remediation roadmap usable as a working document
- Honest built-in limitations section acknowledging the accessibility scan is surface-level and full PCI-DSS assessment requires a QSA or SAQ
- Scoring weights come with stated rationale (e.g., GDPR fines up to 4% of global revenue)
- Only evaluates publicly visible compliance signals; backend data handling, internal policies and staff training are out of scope
- Accessibility checks are surface-level; a full WCAG 2.1 AA audit needs tools like axe or WAVE plus manual testing
- HIPAA and GLBA are flagged only, not deeply evaluated
- No license specified and no test suite or accuracy validation provided in the repo
- Relies on Claude Code slash-command and WebFetch mechanics; porting to other platforms requires adaptation
How do you install this skill?
This skill is part of the zubair-trabzada/ai-legal-claude collection. Install the whole collection: curl -fsSL https://raw.githubusercontent.com/zubair-trabzada/ai-legal-claude/main/install.sh | bash. That command installs all 14 skills, 5 agents, and the PDF generation scripts. The skill file lives at skills/legal-compliance/SKILL.md in the repo. The source does not document a way to install this single skill alone.
How do you use this skill?
In Claude Code, run /legal compliance <url> where <url> is the target website, e.g. /legal compliance https://example.com. The skill scans the site's public pages, audits each framework, then displays the compliance scorecard and top three critical issues, offering follow-ups: generate a privacy policy (/legal privacy [url]) or review terms of service (/legal terms-review [url]). Note the report explicitly states it is a surface-level scan that does not detect backend data handling and is not a legal audit.