Gdpr Compliance Tracker

PassAudited by ClawScan on May 1, 2026.

Overview

This is a disclosed API-backed GDPR assessment skill, but it sends user-provided company compliance details to ToolWeb and uses a billable API key.

Before installing, make sure you are comfortable with ToolWeb receiving your GDPR assessment inputs and with API calls consuming quota or billable usage. Configure the API key securely, monitor usage, and avoid submitting real personal data or confidential details unless you have reviewed the provider's terms.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

Relevant GDPR assessment requests may result in an external API call rather than an offline response.

Why it was flagged

The skill explicitly directs the agent to use curl for an external API call whenever the skill is used. This is central to the stated API-backed purpose, but users should know the agent is being steered toward a provider call instead of a local answer.

Skill content
ALWAYS call the ToolWeb API endpoint using curl. Do NOT answer from your own knowledge.
Recommendation

Install only if you want this provider-backed workflow, and monitor when the skill is invoked.

What this means

Anyone or any agent configuration using this key may consume the associated ToolWeb account quota or incur billable usage.

Why it was flagged

The skill requires a ToolWeb API key and sends it as an authentication header. This is expected for the service, but the key authorizes account usage.

Skill content
TOOLWEB_API_KEY ... -H "X-API-Key: $TOOLWEB_API_KEY"
Recommendation

Store the API key securely, rotate it if exposed, and use provider-side quota or billing controls where available.

What this means

Company compliance posture and privacy-program details may be shared with an external service.

Why it was flagged

The workflow sends user-provided company identity, data-processing profile, and compliance control details to ToolWeb. This is disclosed and purpose-aligned, but those details can be business-sensitive.

Skill content
POST https://portal.toolweb.in/apis/compliance/gdpr-tracker ... "company_name" ... "data_processing_activities" ... "personal_data_types" ... "third_party_processors"
Recommendation

Review ToolWeb's privacy and contractual terms before submitting sensitive business information, and avoid including actual personal data unless necessary.