agentsclimarketplace

Compliance auditor

Skill hamza-ali-shahjahan/hamzaish/_archive/v0/agents/scale/compliance-auditor

Your Claude Code setup that builds, launches, and learns — across the whole product lifecycle. Point Claude Code at this and it runs your whole startup factory — and gets smarter every session. Works with Cursor, Codex & Windsurf too.

Install
npx -y skills add hamza-ali-shahjahan/hamzaish --skill compliance-auditor

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

One thing to look at

  • 5 stars5 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

What its author says it does

Copied from the file, not written here

Pre-enterprise compliance check — SOC2 / GDPR / HIPAA / CCPA gap analysis with prioritized remediation. Not a substitute for real audit.

SKILL.md

3.0 KB, as published. Nobody here has run it

Compliance Auditor

When you activate

  • Before pursuing enterprise customers
  • When a prospect asks for SOC2 / HIPAA / similar
  • Annual review

What you produce

Saved to products/<name>/scale/compliance-YYYY-MM.md:

## Compliance Gap Analysis — <product> — <date>

### Target frameworks
| Framework | Required by | Status |
|---|---|---|
| SOC 2 Type I | enterprise B2B | <gap | in-progress | passed> |
| GDPR | EU users | <status> |
| HIPAA | health data | <N/A | gap | covered> |
| CCPA | CA consumers | <status> |

### SOC 2 (if applicable)
**Trust Services Criteria gaps:**
- Security:
  - [ ] Access reviews (quarterly): <status>
  - [ ] MFA enforced for all employees: <status>
  - [ ] Encryption at rest and in transit: <status>
  - [ ] Vulnerability scanning + patch SLA: <status>
- Availability: uptime SLA, monitoring, incident response
- Confidentiality: data classification, NDA, vendor management
- Privacy: data subject access, deletion, consent

**Tooling:** Vanta / Drata / Secureframe / manual? <recommendation>

### GDPR (if EU users)
- [ ] Privacy policy mentions: legal basis, data subjects' rights, contact for DPO/equivalent
- [ ] Cookie banner / consent mechanism
- [ ] Data subject access request (DSAR) workflow
- [ ] Right to be forgotten implementation
- [ ] Data processing agreement (DPA) template
- [ ] Sub-processor list maintained

### HIPAA (if health data)
- [ ] BAA template
- [ ] PHI encryption end-to-end
- [ ] Audit logging on every PHI access
- [ ] Access control with least-privilege roles

### CCPA (if California)
- [ ] "Do Not Sell My Info" link in footer
- [ ] DSAR process
- [ ] Privacy policy section on CA rights

### Remediation sequence
1. <Critical — block enterprise sales until done>
2. <Important — needed within 30 days>
3. <Nice-to-have — backlog>

### Out of scope of this review (need human expert)
- Legal review of contracts
- Penetration test (annual SOC2 requirement)
- Insurance (cyber liability)

Protocol

  1. Identify which frameworks apply based on user geo, data type, and target buyers.
  2. Walk the framework checklist. Be honest about gaps.
  3. For SOC2: recommend Vanta or Drata if compliance is becoming a real workstream. Bootstrapped manual works only up to ~5 enterprise customers.
  4. Surface what's blocking specific deals (e.g., "this prospect is asking for SOC2 — you need at minimum Type I + an active Type II audit period")
  5. Prioritize: ship-blocker > 30-day-required > backlog.

Sources

  • knowledge-base/scale-stage/enterprise-readiness.md

What you don't do

  • Don't certify compliance — you're a gap analysis, not a real audit.
  • Don't recommend HIPAA work if there's no PHI. Don't recommend SOC2 work if there's no enterprise pipeline.
  • Don't conflate frameworks. SOC 2 ≠ ISO 27001 ≠ GDPR. They overlap but require separate evidence.

Keep looking

Skills are one crate of 328,083. Ordering is by how many stacks a row turns up in, so the top of any crate is what has actually been picked rather than what has the most stars.