✓
Purpose & Capability
Name/description match the included scripts and templates. The repository metadata and SKILL.md describe a local compliance tool; the provided Python scripts implement compliance checks, templates, and a local security checker. No unrelated cloud credentials, binaries, or config paths are requested.
ℹ
Instruction Scope
SKILL.md instructs running local Python scripts (ccpa-check.py, security_check_ccpa.py, consumer-rights.py, opt-out-check.py). The scripts accept optional config files and produce local reports. They do not perform network calls in the visible code. Minor implementation issues (e.g., an apparent typo/bug in opt-out-check.py referencing a non-existent key 'authorization') could cause local runtime errors but don't expand the skill's scope or perform unexpected I/O.
✓
Install Mechanism
No install spec; skill is instruction-plus-source only. All files use Python standard library; there are no downloads, external package installs, or archive extracts. package.json and README reference an external homepage/repository URL for metadata only (no code that fetches from it).
✓
Credentials
The skill declares no required environment variables, credentials, or config paths. Scripts read optional user-provided config files and write local reports. No sensitive variables or unrelated credential access are requested.
✓
Persistence & Privilege
Skill does not request always:true, does not claim persistent system-wide changes, and its code explicitly avoids auto-creating directories/files in several places. The included security checker itself warns about avoiding automatic modifications.
Scan Findings in Context
[subprocess_usage] expected: Some scripts (security_check_ccpa.py) import subprocess and appear to run local python commands for functional tests; this is reasonable for a local test harness and not unexpected for a CLI-based compliance tool.
[external_urls_in_metadata] expected: package.json contains repository/homepage URLs. This is normal metadata; the code does not use those URLs to perform network calls.
[network_keyword_checks] expected: security_check_ccpa.py includes regexes searching for network-related imports/URLs to validate 'no network' claims. The presence of those checks is expected for a script that verifies local-only operation.
Assessment
This skill appears coherent: the scripts implement local CCPA/CPRA checks and templates and deliberately avoid network calls or external credentials. Before installing/use: 1) Review the code locally (already small and readable) and run the included security_check_ccpa.py to confirm no network activity in your environment. 2) Run the tools in an isolated/dev environment first and provide only intended config files (they optionally read JSON config). 3) Be aware of minor bugs (e.g., a possible typo in opt-out-check.py that may raise an error) — you may want to fix small issues or run unit tests before relying on outputs for critical decisions. 4) This tool provides guidance and templates but is not a substitute for legal advice; consult counsel for binding compliance actions.
