oliwoodman

Compliance Audit Skill — Security skill for Claude Code

Security community

A Claude skill that audits your codebase for GDPR and EU AI Act compliance and returns a ranked list of fixes.

How to install Compliance Audit Skill

This entry records only its repository, not the path inside it, so there is no exact command to give. Open oliwoodman/compliance-audit-skill and copy the folder into ~/.claude/skills/, or the file into ~/.claude/agents/.

What Compliance Audit Skill does

A Claude skill that audits your codebase for GDPR and EU AI Act compliance and returns a ranked list of fixes. Inspired by Flagged.

Alternatives in Security

Data Viz Audit — Audit a data visualization for chart type selection, accessible color palette, annotations, and anti-patterns 309 ★
List All Global Skills Sorted By Provider Location — asm list --scope global --sort location asm search "code review" --json asm inspect my-skill asm audit --yes a 185 ★
Gdpr Review — Audit the codebase (or a given path/feature) for GDPR compliance and produce a prioritized findings report 172 ★

README

Compliance Audit

A Claude skill that audits your website, app, or product's codebase for **GDPR** and the **EU AI Act**, then hands back a ranked, plain-English list of exactly what to fix.

Works in **Claude Code** and **Claude on the web** (claude.ai).

**Indicative guidance, not legal advice.** This is an automated read of your code, not a lawyer, and it will not replace one for anything high-stakes. What it does is catch the obvious, expensive gaps fast. Inspired by [Flagged](https://flagged.org.uk/), a compliance scanner for UK and EU websites.

What's a skill?

A skill is a small set of instructions you hand to Claude. Think of it as a job description for one specific task. You install it once, then trigger it with a phrase, and Claude knows exactly how to handle that job from then on.

This skill teaches Claude how to audit a codebase for compliance. Point it at your repo and it asks you the few things the code cannot tell it, reads what your product actually does with personal data, checks both against what the law requires, and tells you where the gaps are.

What it does

Most vibe-coded products are quietly breaking the law. Not on purpose. You pasted in a privacy-policy template, wired up an AI API, dropped in analytics, and shipped. But if anyone in the EU or UK can use it, GDPR applies, and since **2 August 2026** the EU AI Act's transparency rules do too.

If you heard the AI Act was delayed, that is half true. The 2026 amendment pushed the rules for high-risk systems (hiring, credit, medical) to December 2027 and August 2028. The duty to tell people they are talking to an AI was not delayed, and it applies to a side project.

The skill starts with ten questions, asked in one go, about who is behind the product, who uses it, what people give you, which outside services it relies on, whether anyone reads users' data, and how long you keep it. "Don't know" is a fine answer. Then it reads your actual code, forms, API routes, dependenc