Privacy Policy Generator
Scans a website's actual data collection practices and generates a GDPR/CCPA-compliant privacy policy tailored to what it really finds.
The skill fetches arbitrary user-supplied URLs via WebFetch and inspects page source — a read-only external call with a small attack surface; output includes an explicit AI disclaimer requiring attorney review, and data-flow disclosure is reasonably clear. Deducted for: no explicit user-confirmation step before external requests, no declared least-privilege boundary on scan scope (reads page scripts), file writes to the working directory without rollback notes, and unknown license/publisher attribution.
Instructions are internally consistent with a clear four-phase flow (scan → generate → banner → output) and a detailed detection checklist; no visible contradictions on the claimed path. Deducted for: no tests or reproducible examples, detection coverage depends on model inference (possible missed or false tracker detections), and no defined failure feedback for unreachable URLs or JS-rendered pages.
Trigger condition is precise (/legal privacy <url>), the scenario (generate a privacy policy for an existing website) is clear, and capability boundaries are declared (only practices detectable on the public page). Deducted for: core function depends entirely on WebFetch reachability of overseas sites with no assessment for mainland-China networks; no Chinese-language support; SPA or login-gated pages are unfit but not disclosed.
SKILL.md is well-layered and readable with a structured template and [FILL IN] placeholders. Deducted for: unknown repository license metadata, no version or changelog, no FAQ or known-limitations doc, unclear maintenance ownership and update path, and unverifiable marketing statistics in the README ('60 seconds', '82%') plus Skool community promotion.
Generating the policy strictly from detected practices, with risk flags and action items, plausibly adds marginal value over generic templates; but per static calibration no execution evidence exists (cap 7). Deducted for: output still requires filling in contact email, retention periods, etc., and mandatory attorney review limits direct usability; GDPR/CCPA clause accuracy is unverified.
Limited auditable material: the full SKILL.md is inspectable and the checklist/template are cross-checkable. Deducted for: no tests, no sample outputs, no third-party execution evidence, unsourced marketing statistics in the README, and no separation of author claims from verifiable fact.
- This is a static source review only; no scanning or generation was executed, and real output quality is independently unverified.
- Generated privacy policies are AI-produced and not legal advice; a licensed attorney must review before publication.
- Automated scanning covers only what is visible on the public page — backend, internal, and mobile data practices cannot be detected, so the policy may not match reality.
- Core function depends on WebFetch reaching the target site; some overseas sites may be unreachable from mainland-China networks, and the skill has no Chinese-language support.
- The repository has no license metadata and no versioning or changelog; verify licensing and maintenance status before enterprise adoption.
- README marketing figures ('60 seconds', '82%', pricing stats) are unsourced and should not inform procurement decisions.
What does this skill do, and when should you use it?
This is the privacy-policy specialist within the AI Legal Assistant skill collection, triggered by /legal privacy <url>. It uses WebFetch to fetch the target site and runs a checklist for cookies, tracking scripts, form fields, payment processing, and third-party services. It then generates a complete privacy policy based only on what was actually detected, covering GDPR, CCPA/CPRA, and COPPA requirements, plus a recommended cookie consent banner. Output is saved as a Markdown file with compliance risk flags and a list of items the user must fill in. It explicitly states it is not legal advice.
1) Fetches the target site via WebFetch and detects data-collection signals: cookies, Google Analytics, Meta Pixel, form fields, Stripe/PayPal processing, chat widgets, social logins, ad scripts, and more; 2) classifies the site's collection intensity as Minimal/Moderate/Extensive/Heavy; 3) generates a 12-section privacy policy including data types collected, purposes with a GDPR legal-basis table, third-party sharing, retention, GDPR and CCPA user rights, children's privacy (COPPA), and international transfers; 4) outputs cookie consent banner text with compliance requirements; 5) saves the result as PRIVACY-POLICY-[company]-[date].md and presents a detection summary, compliance readiness assessment, action items, and risk flags.
- An indie developer or small business needs a privacy policy draft for a SaaS landing page before launch, matched to the trackers actually installed
- A freelancer generating a first-draft privacy policy for an e-commerce client, to be finalized by an attorney
- A site owner self-auditing for high-risk gaps, such as third-party tracking without a cookie consent banner
- A website with California traffic that needs CCPA 'Do Not Sell or Share' language and user rights sections added
- A compliance consultant doing a quick GDPR/CCPA gap pre-check of a client site before a formal audit
What are this skill's strengths and limitations?
- Policy content is generated from an actual scan of the site, not a one-size-fits-all template — it won't invent sections for data types it didn't detect
- Covers GDPR, CCPA/CPRA, COPPA, and ePrivacy core requirements, including a legal-basis mapping table
- Output includes severity-ranked risk flags (high/medium/low) and an explicit fill-in checklist for human follow-up
- Prominent legal disclaimers throughout, honestly framing the output as a draft requiring attorney review
- Scans only public-facing page signals; backend data practices, employee data handling, and internal processing are invisible, so the policy may mismatch reality
- License is unlisted, leaving usage and commercial terms unclear
- A single-page fetch may miss trackers loaded dynamically or on subpages
- Output is Markdown only, with no ready-to-embed HTML/JS; PDF export belongs to a sibling skill (/legal report-pdf), not this one
- No test suite or documented validation of generated policies against real compliance reviews
How do you install this skill?
Install the full collection with one command: curl -fsSL https://raw.githubusercontent.com/zubair-trabzada/ai-legal-claude/main/install.sh | bash — this installs all 14 skills and 5 agents. This skill lives in skills/legal-privacy/ in the repo. Uninstall via the provided uninstall.sh. Python 3.8+ and reportlab are only needed for PDF reports, not this skill.
How do you use this skill?
In Claude Code, run /legal privacy <url>, e.g. /legal privacy https://example.com. The skill scans the site and writes PRIVACY-POLICY-[company]-[date].md. Then manually complete all [FILL IN] placeholders (contact email, mailing address, DPO details, retention periods) and have a licensed attorney review before publishing.
How does this skill compare with similar options?
The repo positions this as one of fourteen skills in the AI Legal Assistant, with /legal terms (terms of service generation) as its sibling; the README benchmarks it against human attorney review ($300–$500/hour) but names no other competing tools.