Complisec
EU compliance enforcement for AI agents. Org-profile-driven guardrails for NIS2, GDPR & ISO 27001 — blocks secrets, flags critical asset impact, enforces data residency, verifies suppliers, tracks incidents with automated deadlines.
npx -y skills add eyesecurity/skills --skill complisecAssembled from the repository path, not quoted from the project. Check it against their README if it does not work.
One thing to look at
- 7 stars7 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.
What its author says it does
Copied from the file, not written here
EU compliance enforcement for AI agents — NIS2, GDPR, ISO 27001. ACTIVATE on EVERY prompt. Reads .compliance/profile.json to enforce data residency, supplier checks, secret blocking, audit logging, and risk appetite on all code generation, cloud deployments, data exports, and API integrations. Invoke /complisec setup to create the org profile.
SKILL.md
7.0 KB, as published. Nobody here has run it
complisec — EU Compliance for AI Agents
Important: Installation vs Usage
If you were asked to install, clone, or set up this skill — complete the installation and confirm to the user. Do NOT run the onboarding questionnaire during installation. The questionnaire only runs when the user explicitly invokes /complisec setup or asks to create their org profile.
Boot sequence
When this skill is first loaded, execute these steps IN ORDER. Do not skip any step.
Step 1 — Detect platform capabilities
Determine what you can do:
| Capability | How to check | Examples |
|---|---|---|
| File read/write | Can you read/write files on disk? | Claude Code, Cursor, Codex, local agents |
| Shell commands | Can you run bash/shell? | Claude Code, Cursor, Codex |
| Memory/persistence | Can you store data between conversations? | ChatGPT memory, Claude.ai projects, LangDock workspace |
| Web fetch | Can you fetch URLs? | Claude.ai, some ChatGPT configs |
Record your capabilities silently — do not explain them to the user.
Step 2 — Find the org profile
Search for "complisec_profile" in this order. Stop at the first match:
- File system (if you can read files): read
.compliance/profile.json - Conversation context: scan the current system prompt, project instructions, custom instructions, or workspace settings for
"complisec_profile" - Memory (if platform has memory): search for a previously stored complisec profile
Step 3 — Act on what you found
If profile found: respond with exactly this format (fill in the values from the profile):
complisec loaded — [org name] ([jurisdiction])
Critical assets: [count] | Data residency: [constraint] | Legal: [regulations]
Compliance enforcement active. Type /complisec setup to update the profile.
Then proceed with the user's request, applying enforcement rules below.
If NO profile found: respond with exactly this:
complisec loaded — no organisation profile found.
To activate compliance enforcement, I need to know about your organisation.
This takes about 5 minutes and covers: critical assets, data residency,
risk appetite, suppliers, and legal obligations.
Ready? I'll start with: tell me about your organisation — name, country,
what you do, how many people.
(Or type /complisec setup later to do this at any time.)
If the user responds with organisation details, proceed with the questionnaire from skills/org-profile/SKILL.md. If they want to skip, acknowledge and proceed without profile-specific enforcement.
Step 4 — After profile creation, deploy it
The profile must persist between conversations. How depends on the platform:
| Platform | How to persist |
|---|---|
| Claude Code / Cursor / Codex | Save to .compliance/profile.json — the skill reads it automatically |
| ChatGPT | Save to memory. Also tell user: "Go to Settings → Personalization → Custom Instructions and paste the profile JSON so it loads in every conversation." |
| Claude.ai (Projects) | Tell user: "Open your project → Project Instructions. Paste the profile JSON at the top." |
| LangDock | Tell user: "Go to workspace settings → find complisec → paste the profile JSON in the system prompt." |
| Other / unknown | Output the profile as a copyable code block and say: "Paste this into your platform's system prompt, custom instructions, or memory so it persists across conversations." |
Enforcement rules
If $ARGUMENTS equals "setup", read skills/org-profile/SKILL.md and run the onboarding questionnaire.
Otherwise, once the profile is loaded, apply these rules when relevant:
1. Secrets
Scan for credentials, API keys, tokens, passwords, private keys, connection strings, national IDs. If found: block, never echo the value in your response, warn, guide to rotate. See skills/data-sensitivity/SKILL.md.
2. Critical assets
Does the conversation touch a critical asset from complisec_profile.critical_assets? If yes:
- What's the CIA impact?
- Is it within
risk_appetite? - Does a new data flow or supplier touch it?
- Are there regulatory implications from
legal?
3. Data residency
Does the action involve cloud services, hosting, external APIs, or SaaS? Check data_residency. Flag violations: "Your profile restricts data to [regions]. This action sends data to [violating region]."
4. Risk appetite
Architectural decisions, trade-offs, cost vs security? Cross-reference the proposed risk against risk_appetite per CIA dimension. If risk exceeds appetite for an affected critical asset: warn. If within appetite: proceed.
5. Suppliers
New service or integration? Check complisec_profile.suppliers. Unknown supplier = flag: DPA needed, hosting location check. See skills/vendor-risk/SKILL.md.
6. Code generation
Never hardcode secrets. Include structured audit logging for data access. Respect data residency. See skills/audit-logging/SKILL.md.
7. Changes to critical assets
Modification to a critical asset? Impact assessment + rollback plan before proceeding. See skills/change-management/SKILL.md.
8. Incidents
Security incident, breach, or outage reported? Start the incident lifecycle immediately. Calculate notification deadlines using incident_reporting. See skills/incident-management/SKILL.md.
9. Skill vetting
Before installing a new skill: does it access critical assets? Send data outside allowed regions? Request credentials? Flag against the profile.
Sub-skills
Read when needed — don't load everything at once. If you have file access, read from the skills/ directory. If not, these are included in the ZIP that was uploaded.
| Sub-skill | When to read |
|---|---|
skills/org-profile/SKILL.md | Create or update the org profile |
skills/nis2-gap-analysis/SKILL.md | NIS2 gap analysis |
skills/data-sensitivity/SKILL.md | Data classification, secret blocking |
skills/audit-logging/SKILL.md | Audit logging for agent actions and code |
skills/incident-management/SKILL.md | Incident lifecycle + notification deadlines |
skills/vendor-risk/SKILL.md | Vendor assessment + supply chain risk |
skills/change-management/SKILL.md | Change records for critical assets |
skills/compliance-hub/SKILL.md | Central log collection + observability |
skills/security-compliance-tools/SKILL.md | Critical asset methodology, CISO workflow |
skills/eu-compliance-directives/SKILL.md | EU regulation source index |
skills/risk-assessment-writer/SKILL.md | Write, draft, or generate risk assessments, risk entries, or threat/vulnerability descriptions |