Regulatory risk scan
Skill eltntawy/idea-discovery-playbook/skills/regulatory-risk-scan
16 agent skills to validate software ideas before you build — Mom Test interviews, JTBD, market research, pretotype tests, unit economics, and go/no-go scorecards. For Cursor, Claude Code & skills.sh.
npx -y skills add eltntawy/idea-discovery-playbook --skill regulatory-risk-scanAssembled from the repository path, not quoted from the project. Check it against their README if it does not work.
One thing to look at
- 0 stars0 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.
What its author says it does
Copied from the file, not written here
Screens software ideas for regulatory, compliance, and platform-policy risks before scaling validation or build. Use for regulated markets, compliance risk, HIPAA, fintech, legal tech, health AI, or privacy-heavy products.
SKILL.md
2.3 KB, as published. Nobody here has run it
Regulatory Risk Scan
Lightweight desk scan — not legal advice. Flag risks so validation and build plans include compliance work.
When to run
- Health, medical, mental health, children
- Money movement, lending, insurance, crypto
- Legal advice, immigration, employment law automation
- Biometrics, surveillance, scraping at scale
- EU/UK users (GDPR), US state privacy laws, sector rules (HIPAA, PCI, etc.)
Run early in discovery-playbook phase 1–2 if any trigger applies.
Checklist
| Area | Questions |
|---|---|
| Activity regulation | Is the activity regulated even if software is not? |
| Data | PII, PHI, financial data, minors — storage and processing? |
| Claims | Does marketing imply licensed outcome (medical, legal, financial)? |
| Third parties | API ToS, app store rules, ad platform policies |
| Geography | Which countries/states from day one? |
| AI-specific | Automated decisions, disclosure, training data rights |
Risk levels
| Level | Action |
|---|---|
| Low | Document assumptions; proceed with standard privacy |
| Medium | Add compliance tasks to v1 scope; consult professional before launch |
| High | Pause scale tests; narrow wedge or pivot; expert review required |
Output
Save to discovery/<topic-slug>/research/YYYY-MM-DD-<slug>-regulatory.md.
Sections: Facts, Assumptions, Risk table (area | level | mitigation | owner), Decision (proceed / narrow / pause), Next step.
Link from discovery-synthesis and cap Strong go if High risks lack mitigation plan.
Gives 0 of the 12 instructions most regulatory compliance skills give
Counted across 187 of the 188 authors here whose files we hold, read 2026-08-06
- retain audit logs for at least 6 yearsin 10 of 187, across 8 files
- remove or alter HIPAA identifiersin 9 of 187, across 4 files
- document patient consent for publicationin 9 of 187, across 4 files
- stamp files after creating or modifying themin 8 of 187, across 2 files
- inspect detailed trust scores before modifying filesin 8 of 187, across 2 files
- check root account mfa statusin 8 of 187, across 2 files
- check for unused credentials over ninety days oldin 8 of 187, across 2 files
- check iam users for mfa enforcementin 8 of 187, across 2 files
- verify cloudtrail is enabled and loggingin 8 of 187, across 2 files
- check s3 bucket access logging configurationin 8 of 187, across 2 files
- read existing metadata before modifying filesin 8 of 187, across 2 files
- run compliance audits using the specified regulationsin 8 of 187, across 2 files
Said here and by no other author read
- run early in discovery phase if triggers apply
- check if the activity is regulated
- identify data categories like PII or PHI
- review marketing claims for licensed outcomes
- check API terms and platform policies
- determine user geography from day one
Grouped from the skills themselves: near-identical wordings counted once, and counted by distinct author, so one author publishing three of these counts once.