agentsclimarketplace
Sign in

Lgpd compliance

Skill gabriel-f-santos/coding-agents/skills/lgpd-compliance

Guide LGPD (Brazilian data-protection) compliance for a web app/SaaS — audit the codebase for gaps, implement the required features, and scaffold the legal docs. Use for "LGPD", "adequação LGPD", "privacidade / proteção de dados", "política de privacidade", "banner de cookies / consentimento", "opt-in de analytics", "direitos do titular", "exclusão / portabilidade de dados", "DPO", "DPA", or "GDPR". Audits against the ANPD checklist (privacy policy, real cookie opt-in, data-subject rights, security by design, DPA), guides implementation (consent gating for GA4/Pixel, account-deletion cascade, data-export endpoint, MFA/crypto/log hygiene, Sentry sendDefaultPii:false), and drafts a privacy-policy / DPA. Technical guidance, NOT legal advice — a DPO/lawyer signs off. Do not use for general security review unrelated to privacy (use review-security) or for app features that don't touch personal data.From its SKILL.md

Install
npx -y skills add gabriel-f-santos/coding-agents --skill lgpd-compliance

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

2 things to look at

  • no licenseNo license file was found in the repository. Code published without one is not open source by default, so using it at work is a question for whoever answers licensing questions where you are.
  • 0 stars0 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

What its file declares

Copied from the file, not written here

The file declares its own license as MIT. That is the author’s claim about this one file, and it is not the same thing as the license GitHub reports for the repository, which is listed with the other numbers below.

SKILL.md

5.1 KB, ~1.1k tokens by cl100k_base, as published. Nobody here has run it

lgpd-compliance — privacy & data protection (LGPD)

Help a web app/SaaS comply with the LGPD (Lei 13.709/2018) — audit what's missing, implement the controls, and draft the documents. Grounded in the law (art. 7/11 legal bases, art. 18 data subject rights, art. 52 sanctions) and the ANPD cookie guidance (out/2022).

⚠️ Not legal advice. This is technical guidance to build compliant software. Legal sign-off (the privacy policy's legal bases, the DPA, retention periods) is the DPO/lawyer's call. Flag legal decisions as "(confirmar com DPO/jurídico)".

Modes (detect intent, then route)

The user wants…RunPrimary references
to audit the app for LGPD gaps (default)gap analysis vs the checklistreferences/audit-checklist.md + all
to implement a specific controlguided implementationthe matching reference
to draft a document (privacy policy / DPA)scaffold from a templateassets/templates/

References (load only what the step needs)

Open when you need to…Read
run the compliance gap-analysis checklist (audit mode)references/audit-checklist.md
place roles, legal bases, data-subject rights, sanctions correctlyreferences/roles-bases-rights.md
write/inventory the privacy policy (data map, retention/TTL, DPO)references/privacy-policy.md
do cookie consent + analytics right (real opt-in, IP anonymization, Sentry PII)references/cookies-and-analytics.md
implement data-subject rights (deletion cascade, export, consent revocation)references/data-subject-rights.md
apply security & privacy-by-design controls (MFA, crypto, logs, SAST/DAST)references/security-by-design.md
handle third parties (DPA, controller/operator, subprocessors)references/dpa-third-parties.md

Workflow

Step 1 — Ground in the actual app (read before advising)

Find what personal data the app touches and how. Grep/Glob for: user/auth models, analytics (GA4/gtag/Facebook Pixel), error tracking (Sentry sendDefaultPii), logging of IP/headers, cookie handling, deletion/export endpoints, password hashing, and third-party SDKs. Build a quick data map (what's collected, where it flows, who it's shared with). Don't advise in the abstract — cite the real files.

Step 2 — Run the mode

  • Audit: walk references/audit-checklist.md, marking each item ✅ / ⚠️ partial / ❌ missing, each with the file evidence and the remediation. Prioritize by risk (an active PII leak > a missing retention clause). Output a gap report.
  • Implement: open the matching reference and apply the control to the real code (or hand the fix to the dev). Read-only by default; only Write app code when the user asks.
  • Docs: scaffold the privacy policy / DPA from assets/templates/, filled from the data map. Mark every legal/retention value "(confirmar com DPO/jurídico)".

Step 3 — Report

Summarize: the data map, the gaps by priority (P0 = active PII leak / illegal tracking; P1 = missing right/control; P2 = doc/clause), what was implemented/drafted, and the legal items that need DPO/lawyer sign-off. Chain to review-security for the broader security pass and to tech-discovery if privacy-by-design needs to reshape the architecture.

Cross-cutting gotchas (the ones apps get wrong)

  • Cookie banner that only "avisa" is illegal — GA4/Pixel must load only after "Aceitar"; "Recusar" as easy as "Aceitar"; non-essential cookies off by default (ANPD guide).
  • IP and browser data are personal data — anonymize/truncate/hash IPs; don't log them raw.
  • Sentry sendDefaultPii: true exports PII (headers, cookies, session) to a third party without consent → set false.
  • Deletion must cascade — a "delete account" that leaves orphaned rows isn't deletion.
  • Never log secrets/PII — no passwords, session ids, or raw PII in logs.
  • Consent is revocable and granular — and you must record which base legal applies per data.

What ships with it: 13 files

24.2 KB alongside SKILL.md

agents/

assets/

references/

Gives 0 of the 12 instructions most legal skills give in ~1.1k tokens

Counted across 234 of the 234 authors here whose files we hold, read 2026-08-07

  • Use text operators for text fieldsin 11 of 234, across 6 files
  • Consult qualified counsel before usein 11 of 234, across 3 files
  • Use PatentSearch API for patent searchesin 10 of 234, across 5 files
  • Confirm jurisdiction, employment type, and required clausesin 9 of 234, across 2 files
  • Choose a document template and tailor role-specific termsin 9 of 234, across 2 files
  • Validate compensation, benefits, and compliance requirementsin 9 of 234, across 2 files
  • Add signature, confidentiality, and IP assignment terms as neededin 9 of 234, across 2 files
  • Open the implementation playbook for detailed templatesin 9 of 234, across 2 files
  • Use TSDR for trademark data retrievalin 9 of 234, across 4 files
  • Ask for clarification if required inputs are missingin 8 of 234, across 2 files
  • Set the USPTO_API_KEY environment variablein 8 of 234, across 3 files
  • Use the uspto-opendata-python library for PEDSin 8 of 234, across 3 files

Said here and by no other author read

  • grep the codebase to build a personal data map
  • mark each checklist item with file evidence and remediation
  • prioritize gaps with active personal data leaks first
  • gate analytics behind explicit cookie opt-in
  • make cookie opt-out as easy as opt-in
  • disable non-essential cookies by default

Grouped from the skills themselves: near-identical wordings counted once, and counted by distinct author, so one author publishing three of these counts once. Length counted with cl100k_base; the agent that loads this file may tokenize it differently.

Keep looking

Skills are one crate of 325,949. Ordering is by how many stacks a row turns up in, so the top of any crate is what has actually been picked rather than what has the most stars.