18 open-source Agent Skills that review your code for GDPR, CCPA, HIPAA, PCI DSS and more

I just added a compliance category to my open-source agents-skills repo: 18 Agent Skills that let a coding agent (Claude Code, Codex, Cursor and friends) review your code, data flows and documents against a regulation, and write a findings report you can actually act on.

What a review looks like

You point the agent at a repo, a diff, an architecture description or a document (privacy notice, cookie banner text, DPA, DPIA...) and ask something like:

Check this signup flow and privacy notice for GDPR compliance.

The skill makes the agent:

1. Scope the review – what the artifact is, your role (controller or processor), and whether the law even applies. If it doesn't, the report says so and stops.
2. Walk a checklist grounded in the official text and the regulator's guidance.
3. Write findings – each one with the article it comes from, the evidence (file and line, or the paragraph in a document), the issue and a concrete fix.

The bar: a review a developer can act on and a privacy lawyer can verify quickly.

The skills

The orchestrator: world-wide-compliance

The one I'm most excited about is world-wide-compliance. Launching in new markets? It screens your product against every regime above, runs the full review for each one that applies, and merges the results into a single report:

• an applicability table (which laws apply and why),
• a status per regime,
• cross-regime findings – where one fix closes requirements in several laws at once (e.g. one retention policy that satisfies GDPR, LGPD and DPDP).

Install

With the Skills CLI:

# One regime
npx skills add cookieMonsterDev/agents-skills@gdpr-compliance -g -y

# Everything (the orchestrator needs all compliance skills installed side by side)
npx skills add cookieMonsterDev/agents-skills --all -g -y

Then just ask your agent: "Is this app ready to launch in the EU, UK and Brazil?"

Ground rules

• Not legal advice. These are technical and documentary reviews. Decisions on lawful basis, risk acceptance or threshold calls are routed to your DPO, compliance officer or counsel.
• Citations or it didn't happen. Every requirement cites the article, recital or clause and links the authoritative source.
• No real personal data in reports. Personal data is described by category and location; examples use synthetic values only.

Feedback welcome

The repo is MIT-licensed: github.com/cookieMonsterDev/agents-skills. Issues and PRs welcome – especially from people who live with these regulations day to day. Which regime should I add next?