Agent skill · data analytics · onewave-ai
compliance-checker
Audits a codebase or business process for regulatory compliance across GDPR, HIPAA, SOC2, CCPA, and PCI-DSS. Scans for PII handling, data retention, encryption, access controls, audit logging, consent management, and data transfer issues. Generates a structured compliance report with findings, gap analysis, remediation steps, and evidence requirements.
Why this skill is useful
Adds a comprehensive compliance auditing workflow with executable scripts for scanning and reporting that are not commonly available.
What it needs
Requires bash installed locally. About 3k tokens when loaded. Last updated 2026-07-15. 242 stars on the source repository.
What this skill does
Compliance Checker Perform thorough regulatory compliance audits against one or more frameworks, identify gaps, and produce actionable remediation guidance with evidence requirements suitable for certification preparation. Contents references/frameworks.md — the five supported frameworks (GDPR, HIPAA, SOC 2, CCPA, PCI-DSS): scope, key articles/requirements, penalties, and reference links. references/scan-patterns.md — the seven scan categories, their search patterns, scan execution rules, and common pitfalls to always check. references/classification.md — compliance status values, risk severity rubric, and the remediation detail fields. references/cross-framework-mapping.md — control-area-to-framework mapping and the glossary. references/output-template.md — the full compliance-report.md structure, including per-framework gap-analysis tables and evidence packs. Workflow Run the full methodology for every audit. Do not skip steps. Phase 1: Discovery and Scoping 1. Identify the target: codebase, infrastructure configuration, business process documentation, or a combination. 2. Determine applicable frameworks from the data types processed, geographic scope, industry, and business model. See references/frameworks.md. When none are specified, assess all five and note applicability. 3. Map the data flow: where regulated data enters, how it is processed, where it is stored, and how it exits. 4. Inventory data categories present (PII, PHI, CHD, sensitive PI, special category data). Phase 2: Scanning and Evidence Collection 5. Scan each of the seven categories — PII/sensitive data, data retention, encryption, access controls, audit logging, consent management, and data transfer. Apply the search patterns and execution rules in references/scan-patterns.md. Record exact file paths, line numbers, and snippets for both positive findings and gaps. Phase 3: Gap Analysis 6. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills onewave-ai/compliance-checker