This Openclaw Skills compliance scan audits code repositories and data-processing workflows for privacy, security, and industry compliance risks, then returns audit-ready remediation guidance.
Install & Download
1. ClawHub CLI
The fastest way to install a skill directly from the registry.
npx clawhub@latest install compliance-scan
2. Manual Installation
Copy the skill folder to one of these locations
~/.openclaw/skills/ <project>/skills/ Priority: Workspace > Local > Bundled
3. Prompt Installation
Copy this prompt to OpenClaw to install it automatically.
Help me install compliance-scan using Clawhub. If Clawhub is not installed, install it first (npm i -g clawhub).
Prefer to download?
Get the raw skill files in a ZIP archive.
What is Compliance Scan?
Compliance Scan is an Openclaw Skills workflow for AI coding agents that reviews repositories, code snippets, or data-processing pipelines for GDPR, CCPA, PIPL, SOC 2, ISO 27001, HIPAA, and PCI-DSS risk patterns. It focuses on code-layer signals such as exposed secrets, insecure transport, weak access control, sensitive-data logging, and noncompliant payment or PHI handling.
The result is a structured compliance report with severity-ranked findings, file locations, line references, framework mapping, concrete remediation steps, and an audit-prep checklist. Openclaw Skills helps engineering, compliance, and security teams run fast self-assessments before release, audit preparation, or internal risk review without replacing a formal legal or professional compliance audit.
Compliance Scan Use Cases
- Preparing for SOC 2, HIPAA, PCI-DSS, GDPR, or CCPA readiness reviews.
- Scanning a new repository before release when it handles PII, PHI, or payment data.
- Reviewing APIs for HTTPS, CORS, CSRF, JWT, session, and authorization issues.
- Detecting hard-coded secrets, plaintext credentials, and leaked tokens in logs or configs.
- Checking data-processing flows for consent, deletion, export, cross-border transfer, and privacy policy references.
- Auditing e-commerce or fintech code paths for card data handling, tokenization, and storage exposure.
- Creating an audit-ready remediation plan with severity and compliance score.
How Compliance Scan Works
- Define scope: provide a local repo path, GitHub URL, or pasted code snippet, plus optional target framework, business type, and region.
- Scan code and data paths: inspect files for secrets, sensitive-data storage, transmission, access control, and framework-specific compliance patterns.
- Map findings to frameworks: evaluate issues against GDPR, CCPA, PIPL, SOC 2, ISO 27001, HIPAA, or PCI-DSS requirements.
- Rank severity: classify each finding as critical, high, medium, low, or informational and calculate the overall compliance score.
- Generate remediation guidance: attach file locations, line numbers, code excerpts, impact notes, and concrete code-level fixes.
- Produce audit outputs: summarize counts, build a compliance matrix, list evidence items, and create a prioritized fix roadmap.
- Review and iterate: re-scan after fixes to confirm the report no longer contains the original risk patterns.
Compliance Scan Setup
- Add the skill to your agent's skills directory and make sure the SKILL.md file is discoverable.
mkdir -p <skills-directory>/compliance-scan
cp SKILL.md <skills-directory>/compliance-scan/
- Load the skill in a supported Openclaw Skills-compatible agent such as Claude Code, Cursor, Codex CLI, or OpenClaw.
- Invoke the scan with the repository path, GitHub URL, or code snippet, and optionally specify the framework.
/compliance-scan --framework=soc2
/compliance
- Provide business context in natural language when relevant, such as B2B, B2C, healthcare, finance, ecommerce, or a data region.
- Review the generated report, apply the remediation roadmap, and run the scan again to verify fixes.
Compliance Scan Data Schema & Taxonomy
Input schema
| Field | Type | Notes |
|---|---|---|
| scan_target | string | Local repo path, GitHub URL, or pasted snippet |
| target_framework | string | Optional; defaults to full-scope scan |
| business_type | string | Optional; B2B, B2C, healthcare, finance, ecommerce |
| region_scope | string | Optional; EU, US, China, global |
Findings model
| Field | Type | Notes |
|---|---|---|
| severity | enum | critical, high, medium, low, info |
| framework | string | GDPR, CCPA, PIPL, SOC 2, ISO 27001, HIPAA, PCI-DSS |
| file_path | string | Location of the issue |
| line_number | number | Exact line reference when available |
| description | string | What is wrong |
| code_excerpt | block | Relevant code snippet |
| impact | string | Compliance or security consequence |
| remediation | string | Executable code-level fix |
| reference | string | Framework citation or policy note |
Report structure
- Scan summary with counts by severity
- Compliance score using 100 - (critical×15 + high×8 + medium×3 + low×1)
- Detailed findings grouped by severity
- Framework comparison matrix
- Audit readiness checklist
- Priority remediation roadmap
Generated artifact taxonomy
- Executive summary
- Per-framework analysis
- Per-file issue list
- Evidence checklist
- Fix-priority plan
Compliance Scan Advanced Features
- Framework-aware scanning across GDPR, CCPA, PIPL, SOC 2, ISO 27001, HIPAA, and PCI-DSS.
- Code-level evidence with file paths, line numbers, snippets, and framework references.
- Severity scoring plus a compliance score for fast audit triage.
- Context-sensitive analysis for B2B, B2C, healthcare, finance, ecommerce, and regional privacy rules.
- Explicit secret and credential pattern detection for API keys, tokens, private keys, and plaintext passwords.
- Audit-ready remediation roadmap and evidence checklist in a structured report format.
- Works across Openclaw Skills, Claude Code, Cursor, and Codex CLI.
- Supports repo paths, GitHub URLs, and pasted snippets for quick one-off checks or repeatable reviews.
SKILL.md
Loading
Related Openclaw Skills
Photo to Perler Bead Pattern Generator
Openclaw Skills turns any image into a printable perler bead pattern with a color-coded grid, bead counts, and a preview PNG.
Walmart Product Reviews Scraper
An automated browser-based scraper designed to extract paginated customer reviews and structured metadata directly from walmart.com.
BizMuse Music Video
Openclaw Skills packages the official BizMuse CLI workflow for turning audio and 1-7 reference images into complete AI music videos.
Toutiao Search & Content Analyzer
A command-line search and data extraction utility for tracking trending articles and video engagement on the Jinri Toutiao platform.
Invoice and Contract Data Extraction
Openclaw Skills extracts structured invoice and contract data from PDFs or images, validates key fields, and outputs clean JSON plus readable reports.
Huawei Cloud DWS SQL Check
Huawei Cloud DWS SQL Check is an Openclaw Skills utility that validates SQL syntax, standards, and DWS-specific compatibility before execution.
Featured*
