gdpr-ccpa-privacy-auditor

securityjorgealves

Audits web applications to ensure declared privacy policies match actual technical data collection practices. Use to identify discrepancies in cookie usage, tracking scripts, and user data handling.

Install

npx skills add https://github.com/jorgealves/agent_skills --skill gdpr-ccpa-privacy-auditor

SKILL.md

---name: gdpr-ccpa-privacy-auditordescription: Audits web applications to ensure declared privacy policies match actual technical data collection practices. Use to identify discrepancies in cookie usage, tracking scripts, and user data handling.---

GDPR/CCPA Privacy Auditor

Purpose and Intent

The gdpr-ccpa-privacy-auditor is a transparency tool. It helps companies ensure that their public-facing privacy policies actually match their technical implementations, preventing "Privacy Washing" and reducing the risk of regulatory fines.

When to Use

Privacy Impact Assessments (PIA): Run as part of a recurring privacy review.
Marketing Launches: Check new landing pages to ensure new trackers haven't been added without updating the policy.
Due Diligence: Audit a target company's website during a merger or acquisition.

When NOT to Use

Internal Only Apps: Not designed for apps behind a firewall or VPN without public endpoints.
Comprehensive Legal Audit: Only focuses on technical indicators (cookies, scripts, data models); does not audit physical security or organizational policies.

Error Conditions and Edge Cases

Server-Side Tracking: Trackers that run purely on the server (no client-side script) cannot be detected via URL scanning.
Dynamic Content: Some trackers may only load for specific regions or after specific user interactions (like clicking a button).

Security and Data-Handling Considerations

Passive Scanning: When scanning URLs, it acts like a standard browser.
Source Code Privacy: If providing source_code_path, ensure the environment is secure and the code is not transmitted externally.

Related skills

azure-compliancemicrosoft606KRun Azure compliance and security audits with azqr plus Key Vault expiration checks. Covers best-practice assessment, resource review, policy/compliance validation, and security posture checks. WHEN: compliance scan, security audit, BEFORE running azqr (compliance cli tool), Azure best practices, Key Vault expiration check, expired certificates, expiring secrets, orphaned resources, compliance assessment.firebase-security-rules-auditorfirebase124KAudits Firebase (Firestore, Cloud Storage) security rules for vulnerabilities, privilege escalation, role bypasses, create vs update inconsistencies, resource exhaustion, type safety, size limits, and hasOnly ownership checks. Use when auditing/reviewing rules, running red-team rule assessments, or scoring against auditor checklists. Don't use for Firebase CLI (login, deploy), Auth, Crashlytics, Remote Config, or database queries.browser-fingerprint-auditliarjsdev69KAudit a browser fingerprint for internal contradictions with the liarjs CLI - canvas, WebGL, WebGL2, WebGPU, audio, 220 fonts, WebRTC and timezone probes, scored against the TLS/HTTP/ASN view of the same request. Use when asked to run a browser fingerprint test, see what a fingerprint looks like, check canvas or WebGL fingerprint stability, compare a spoofed profile against a real browser, or find out whether a browser profile is self-consistent.cloudflare-onecloudflare66KDesign, configure, troubleshoot, or review Cloudflare One Zero Trust and SASE deployments. Use cloudflare-one-migrations for migration planning from other vendors.