Legal Security Compliance Auditor

Legal Security Compliance Auditor is an agent skill that runs a structured, static audit of a codebase for privacy and security compliance, then writes a prioritized COMPLIANCE_AUDIT.md report. It covers four main audit domains: GDPR and UK GDPR (23 checks including lawful basis, consent, all data-subject rights under Art. 15–22, breach notification, and international transfers), CCPA/CPRA (17 checks including notice at collection, sale/share opt-out, Global Privacy Control, and SLA for data requests), data security (20 checks covering password hashing, encryption at rest and in transit, secrets in source code, PII in logs, JWT and session security, SQL injection, CORS, and security headers), and LLM/AI compliance (16 checks for AI labeling, inaccuracy warnings, EU AI Act Art. 50, prompt injection, and automated decisions). An additional 24 conditional checks for LGPD, PIPL, and DPDPA load automatically when the skill detects the codebase targets Brazil, China, or India. Market detection works by inspecting i18n files, currency references, domains, language settings, and framework signals. The skill maps the PII surface across database models, API endpoints, forms, logs, third-party integrations, cookies, and auth flows before running applicable checklists. Every finding in the output report includes the exact file and line number, the specific regulatory article cited, a description of what is wrong, why it matters, and a concrete remediation step. It recognizes common ORMs and frameworks including Prisma, Drizzle, SQLAlchemy, Django ORM, Next.js, FastAPI, Express, NestJS, and Rails. The report ends with a disclaimer that the output is an engineering audit, not legal advice.