[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M751HZ18TM4ES4ZW28WN69DV":3,"skill-same:01M751HZ18TM4ES4ZW28WN69DV":49},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":18,"publishedAt":19,"linkOnly":20,"markdownContent":21,"markdownBody":22,"frontMatter":23,"refName":26,"commitSha":27,"skillDirectory":28,"forksCount":29,"repositoryHtmlUrl":30,"repositoryHomepageUrl":31,"ownerHtmlUrl":32,"ownerBlogUrl":31,"ownerDescription":33,"updatedAt":34,"install":35,"resources":48},"01M751HZ18TM4ES4ZW28WN69DV","regulatory-scan",null,"Maps which regulations apply to a product or business across every operating jurisdiction, translates them into concrete obligations, and produces a prioritized compliance-gap table. Use when someone asks \"what regulations apply to my product\", \"are we GDPR or CCPA exposed\", \"run a compliance gap analysis\", or is entering a new market or handling a new data type. Do NOT use for drafting the legal documents themselves - use terms-of-service instead. Do NOT use for assembling SOC 2 audit evidence - use soc2-evidence-helper instead. Do NOT use for patent landscape questions - use patent-prior-art instead.","SkillMedev\u002Fskills","SkillMedev","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F298078254?v=4","01M74ZSGTQ918CB0VXW4EG3RMX","SkillMe","01M74ZSGVBT497NA95CBT8JTY4",25,"MIT","https:\u002F\u002Fgithub.com\u002FSkillMedev\u002Fskills\u002Fblob\u002Fmain\u002Fskills\u002Fregulatory-scan\u002FSKILL.md",[],[],"2026-11-11 18:15:31",false,"---\nname: regulatory-scan\ndescription: Maps which regulations apply to a product or business across every operating jurisdiction, translates them into concrete obligations, and produces a prioritized compliance-gap table. Use when someone asks \"what regulations apply to my product\", \"are we GDPR or CCPA exposed\", \"run a compliance gap analysis\", or is entering a new market or handling a new data type. Do NOT use for drafting the legal documents themselves - use terms-of-service instead. Do NOT use for assembling SOC 2 audit evidence - use soc2-evidence-helper instead. Do NOT use for patent landscape questions - use patent-prior-art instead.\nmetadata:\n  title: \"Regulatory Scanner\"\n---\n\n# Regulatory Scanner\n\nProduce a clear map of which regulations apply to a product and where the gaps are - research and triage, not legal advice. The costly failure this prevents is discovering an obligation from the enforcement letter: teams routinely learn that a checkout flow triggered a state privacy law, or a health-adjacent feature crossed into HIPAA territory, only after the exposure exists.\n\n## Operating procedure\n\nJurisdiction drives everything, so scoping comes first; a scan that assumes US-only while the product sells into the EU is worse than no scan, because it creates false confidence.\n\n### Step 1: Gather inputs\n\nCollect from the user:\n\n- What the product does, in plain terms, and the industry it serves.\n- What data it collects, stores, or processes - especially personal data, health data, payment data, children's data, biometric data.\n- Who the customers are (consumers vs. businesses; whether any are minors).\n- Every jurisdiction where it operates, sells, or has users - not just where it is incorporated. Serving EU residents triggers GDPR regardless of company location.\n- Company scale (revenue, user counts) - many regimes have applicability thresholds.\n\nLabel anything assumed as a guess and confirm before Step 2, because a wrong jurisdiction list invalidates the whole map.\n\n### Step 2: Identify applicable regulatory domains\n\nWork through the domains systematically and mark each apply \u002F not apply \u002F unclear, with a one-line reason:\n\n- **Data & privacy**: GDPR (EU residents; fines up to 4% of global annual turnover or €20M, whichever is higher), CCPA\u002FCPRA (California; applicability thresholds include ~$25M+ annual revenue or data on 100,000+ consumers\u002Fhouseholds), other US state privacy laws, sector privacy rules.\n- **Sector-specific**: HIPAA (health data held by covered entities and business associates), GLBA and PCI-DSS (finance\u002Fpayments), FDA (medical devices, food, software-as-medical-device), FCC (telecom), FTC Act §5 (unfair or deceptive practices - the catch-all that reaches almost every consumer product), COPPA (users under 13).\n- **Product safety & labeling**; **accessibility** (ADA, WCAG, EN 301 549); **employment & labor**; **environmental**; **export controls** (EAR\u002FITAR, sanctions).\n- **Emerging**: AI regulation (EU AI Act risk tiers), platform and content rules (DSA).\n\n\"Unclear\" is a legitimate status - it becomes a question for counsel, which is more useful than a guess.\n\n### Step 3: Translate each regulation into requirements\n\nFor each applicable regulation, list the concrete obligations it imposes - consent mechanisms, breach notification timelines, record-keeping, audits, disclosures, data-subject rights. Cite the specific article or section so every requirement is traceable and checkable. Precision matters because obligations carry real deadlines: GDPR breach notification to the supervisory authority is 72 hours from awareness (Art. 33); GDPR data-subject access requests must be answered within one month (Art. 12).\n\n### Step 4: Assess current state and score gaps\n\nFor each requirement, mark status: **Met \u002F Partial \u002F Not met \u002F Unknown**. \"Unknown\" is a gap, not a pass. Prioritize gaps by three factors:\n\n1. **Penalty exposure** - fines, injunctions, criminal liability, private rights of action.\n2. **Likelihood of enforcement** - active regulator, audit triggers, complaint-driven regimes.\n3. **Effort to remediate** - quick disclosures before multi-quarter engineering work.\n\nHigh exposure + high likelihood + low effort is the top of the list.\n\n### Step 5: Output the compliance map\n\nFill one row per requirement:\n\n```\nRegulation | Jurisdiction | Requirement (with citation) | Status | Gap | Priority | Owner\n\nExample row:\nGDPR       | EU           | Notify supervisory authority of a personal-data breach\n                            within 72h of awareness (Art. 33)  | Not met | No incident-response\n                            playbook with notification step    | HIGH    | [FILL]\n[FILL]     | [FILL]       | [FILL]                             | [FILL]  | [FILL] | [FILL] | [FILL]\n```\n\nAdd a narrative summary of the top 3 risks in plain language an executive can act on, and note the date the scan was performed - regulations change, and an undated scan misleads.\n\n### Step 6: Recommend next steps\n\nFor each high-priority gap, suggest a concrete remediation action and an owner. Explicitly flag every item that needs qualified legal counsel before action - binding interpretation, filings, regulator contact, anything ambiguous in Step 2.\n\n## Deliverable\n\nProduce: the jurisdiction and data inventory, the domain applicability checklist with reasons, the compliance map table (Regulation | Jurisdiction | Requirement + citation | Status | Gap | Priority | Owner), a top-3 risk narrative, a remediation list, and an explicit \"requires counsel\" list.\n\n## Do NOT\n\n- Do NOT assume US-only or headquarters-only exposure; check every jurisdiction where users actually are.\n- Do NOT mark a requirement \"Met\" on the team's say-so without an artifact (policy, log, control) behind it - mark it Partial or Unknown.\n- Do NOT blend hard law (statutes, regulations) with soft guidance (frameworks, best practices) in the same rows without labeling which is which; only one carries penalties.\n- Do NOT interpret ambiguous statutory language definitively - state the plausible readings and route to counsel.\n- Do NOT let the scan go stale; stamp the date and recommend re-scanning on market entry, new data types, or major regulatory news.\n\n## Quality bar\n\n- Every requirement carries a specific article\u002Fsection citation.\n- Every status is one of Met \u002F Partial \u002F Not met \u002F Unknown - no blanks, and Unknowns are counted as gaps.\n- Priorities reflect all three factors (exposure, enforcement likelihood, effort), not just fine size.\n- The \"requires counsel\" list is present and non-empty for any non-trivial product.\n\n## Escalation\n\nThis is a research scan, NOT legal advice - no output from it should be treated as a binding interpretation, and nothing here creates an attorney-client relationship. Bring in qualified counsel for: any binding interpretation, all filings and regulator communications, anything marked \"unclear\" in Step 2, and any regime with criminal liability or where enforcement is active in the user's sector. For drafting policies and terms, route to terms-of-service; for audit-evidence assembly, route to soc2-evidence-helper.\n","# Regulatory Scanner\n\nProduce a clear map of which regulations apply to a product and where the gaps are - research and triage, not legal advice. The costly failure this prevents is discovering an obligation from the enforcement letter: teams routinely learn that a checkout flow triggered a state privacy law, or a health-adjacent feature crossed into HIPAA territory, only after the exposure exists.\n\n## Operating procedure\n\nJurisdiction drives everything, so scoping comes first; a scan that assumes US-only while the product sells into the EU is worse than no scan, because it creates false confidence.\n\n### Step 1: Gather inputs\n\nCollect from the user:\n\n- What the product does, in plain terms, and the industry it serves.\n- What data it collects, stores, or processes - especially personal data, health data, payment data, children's data, biometric data.\n- Who the customers are (consumers vs. businesses; whether any are minors).\n- Every jurisdiction where it operates, sells, or has users - not just where it is incorporated. Serving EU residents triggers GDPR regardless of company location.\n- Company scale (revenue, user counts) - many regimes have applicability thresholds.\n\nLabel anything assumed as a guess and confirm before Step 2, because a wrong jurisdiction list invalidates the whole map.\n\n### Step 2: Identify applicable regulatory domains\n\nWork through the domains systematically and mark each apply \u002F not apply \u002F unclear, with a one-line reason:\n\n- **Data & privacy**: GDPR (EU residents; fines up to 4% of global annual turnover or €20M, whichever is higher), CCPA\u002FCPRA (California; applicability thresholds include ~$25M+ annual revenue or data on 100,000+ consumers\u002Fhouseholds), other US state privacy laws, sector privacy rules.\n- **Sector-specific**: HIPAA (health data held by covered entities and business associates), GLBA and PCI-DSS (finance\u002Fpayments), FDA (medical devices, food, software-as-medical-device), FCC (telecom), FTC Act §5 (unfair or deceptive practices - the catch-all that reaches almost every consumer product), COPPA (users under 13).\n- **Product safety & labeling**; **accessibility** (ADA, WCAG, EN 301 549); **employment & labor**; **environmental**; **export controls** (EAR\u002FITAR, sanctions).\n- **Emerging**: AI regulation (EU AI Act risk tiers), platform and content rules (DSA).\n\n\"Unclear\" is a legitimate status - it becomes a question for counsel, which is more useful than a guess.\n\n### Step 3: Translate each regulation into requirements\n\nFor each applicable regulation, list the concrete obligations it imposes - consent mechanisms, breach notification timelines, record-keeping, audits, disclosures, data-subject rights. Cite the specific article or section so every requirement is traceable and checkable. Precision matters because obligations carry real deadlines: GDPR breach notification to the supervisory authority is 72 hours from awareness (Art. 33); GDPR data-subject access requests must be answered within one month (Art. 12).\n\n### Step 4: Assess current state and score gaps\n\nFor each requirement, mark status: **Met \u002F Partial \u002F Not met \u002F Unknown**. \"Unknown\" is a gap, not a pass. Prioritize gaps by three factors:\n\n1. **Penalty exposure** - fines, injunctions, criminal liability, private rights of action.\n2. **Likelihood of enforcement** - active regulator, audit triggers, complaint-driven regimes.\n3. **Effort to remediate** - quick disclosures before multi-quarter engineering work.\n\nHigh exposure + high likelihood + low effort is the top of the list.\n\n### Step 5: Output the compliance map\n\nFill one row per requirement:\n\n```\nRegulation | Jurisdiction | Requirement (with citation) | Status | Gap | Priority | Owner\n\nExample row:\nGDPR       | EU           | Notify supervisory authority of a personal-data breach\n                            within 72h of awareness (Art. 33)  | Not met | No incident-response\n                            playbook with notification step    | HIGH    | [FILL]\n[FILL]     | [FILL]       | [FILL]                             | [FILL]  | [FILL] | [FILL] | [FILL]\n```\n\nAdd a narrative summary of the top 3 risks in plain language an executive can act on, and note the date the scan was performed - regulations change, and an undated scan misleads.\n\n### Step 6: Recommend next steps\n\nFor each high-priority gap, suggest a concrete remediation action and an owner. Explicitly flag every item that needs qualified legal counsel before action - binding interpretation, filings, regulator contact, anything ambiguous in Step 2.\n\n## Deliverable\n\nProduce: the jurisdiction and data inventory, the domain applicability checklist with reasons, the compliance map table (Regulation | Jurisdiction | Requirement + citation | Status | Gap | Priority | Owner), a top-3 risk narrative, a remediation list, and an explicit \"requires counsel\" list.\n\n## Do NOT\n\n- Do NOT assume US-only or headquarters-only exposure; check every jurisdiction where users actually are.\n- Do NOT mark a requirement \"Met\" on the team's say-so without an artifact (policy, log, control) behind it - mark it Partial or Unknown.\n- Do NOT blend hard law (statutes, regulations) with soft guidance (frameworks, best practices) in the same rows without labeling which is which; only one carries penalties.\n- Do NOT interpret ambiguous statutory language definitively - state the plausible readings and route to counsel.\n- Do NOT let the scan go stale; stamp the date and recommend re-scanning on market entry, new data types, or major regulatory news.\n\n## Quality bar\n\n- Every requirement carries a specific article\u002Fsection citation.\n- Every status is one of Met \u002F Partial \u002F Not met \u002F Unknown - no blanks, and Unknowns are counted as gaps.\n- Priorities reflect all three factors (exposure, enforcement likelihood, effort), not just fine size.\n- The \"requires counsel\" list is present and non-empty for any non-trivial product.\n\n## Escalation\n\nThis is a research scan, NOT legal advice - no output from it should be treated as a binding interpretation, and nothing here creates an attorney-client relationship. Bring in qualified counsel for: any binding interpretation, all filings and regulator communications, anything marked \"unclear\" in Step 2, and any regime with criminal liability or where enforcement is active in the user's sector. For drafting policies and terms, route to terms-of-service; for audit-evidence assembly, route to soc2-evidence-helper.\n",{"name":5,"metadata":24,"description":7},{"title":25},"Regulatory Scanner","main","97a13607d669157a4a16d5ba79b77f208319f7b9","skills\u002Fregulatory-scan",3,"https:\u002F\u002Fgithub.com\u002FSkillMedev\u002Fskills","https:\u002F\u002Fskillme.dev","https:\u002F\u002Fgithub.com\u002FSkillMedev","MCP-native catalog of Claude Agent Skills. Browse, recommend, install, and auto-apply skills in chat. Open source, every skill free and clonable on GitHub.","2026-10-14 03:19:31",{"source":8,"skillName":5,"commands":36,"prompt":46,"zipAvailable":47},[37,40,43],{"tool":38,"command":39},"npx","npx skills add SkillMedev\u002Fskills --skill regulatory-scan",{"tool":41,"command":42},"bunx","bunx skills add SkillMedev\u002Fskills --skill regulatory-scan",{"tool":44,"command":45},"pnpm","pnpm dlx skills add SkillMedev\u002Fskills --skill regulatory-scan","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002FSkillMedev\u002Fskills\u002Fblob\u002Fmain\u002Fskills\u002Fregulatory-scan\u002FSKILL.md",true,[],[50,58,65,72,79,86],{"skillNo":51,"name":52,"nameZh":6,"description":53,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":54,"categories":55,"keywords":56,"publishedAt":57},"01M75271B256DF3FX2VG5VRYEE","zone-2-cardio-plan","Use when someone asks to build a steady-state cardio plan, train an aerobic base or Zone 2, structure easy or endurance weekly cardio, train by heart-rate zones, or improve resting heart rate, VO2, or endurance. Builds a heart-rate-zone aerobic training block with session structure, modality choice, and progression. General fitness guidance, not medical advice. Do NOT use to design a strength or lifting program (use Strength Training Plan), high-intensity interval conditioning, HIIT, or circuits (use Conditioning & HIIT Program), or a mobility\u002Fflexibility routine (use Mobility Routine).","https:\u002F\u002Fgithub.com\u002FSkillMedev\u002Fskills\u002Fblob\u002Fmain\u002Fskills\u002Fzone-2-cardio-plan\u002FSKILL.md",[],[],"2026-11-11 18:27:18",{"skillNo":59,"name":60,"nameZh":6,"description":61,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":62,"categories":63,"keywords":64,"publishedAt":57},"01M7526VP1QBBKYBE17S1WR86Y","youtube-script-writer","Writes retention-engineered long-form YouTube scripts on a hook\u002Fbody\u002Fpayoff architecture - a first-30-seconds hook that survives the retention cliff, a beat-sheet body with mini-hooks and bridges, timed pattern interrupts, and a payoff that over-delivers - with B-roll and editing cues marked inline. Use when someone says \"script my next video\", \"my retention graph dies at the start\", \"tighten this draft\", or \"outline a video on X\". Do NOT use for the 3-second opener of TikTok, Reels, or Shorts - use video-hook-writer instead; do NOT use for spoken voiceover synced to on-screen tutorial actions - use narration-script instead; do NOT use for a sales demo built on a buyer's discovery notes - use demo-script instead; do NOT use to design the thumbnail and title - use thumbnail-concept instead.","https:\u002F\u002Fgithub.com\u002FSkillMedev\u002Fskills\u002Fblob\u002Fmain\u002Fskills\u002Fyoutube-script-writer\u002FSKILL.md",[],[],{"skillNo":66,"name":67,"nameZh":6,"description":68,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":69,"categories":70,"keywords":71,"publishedAt":57},"01M7526P2T0WKMHDXS4Q58237T","win-back-campaign","Designs segmented win-back email sequences for dormant users - dormancy tiers, a three-beat sequence with a single proportional incentive, and a suppression rule - and measures success by re-activation, not opens. Use when someone says \"our users went quiet\", \"design a win-back campaign\", \"how do I re-engage lapsed customers\", \"should we email people who haven't logged in for months\", or lifecycle messaging has stopped landing with a lapsed segment. Do NOT use for recovering an unfinished checkout - use abandoned-cart-sequence instead. Do NOT use for diagnosing and fixing why active customers cancel - use churn-reduction instead. Do NOT use for building always-on onboarding or nurture flows - use email-drip-builder instead.","https:\u002F\u002Fgithub.com\u002FSkillMedev\u002Fskills\u002Fblob\u002Fmain\u002Fskills\u002Fwin-back-campaign\u002FSKILL.md",[],[],{"skillNo":73,"name":74,"nameZh":6,"description":75,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":76,"categories":77,"keywords":78,"publishedAt":57},"01M7526HF2RCDJ50P93WRZRHVV","wikipedia-style","Writes neutral, verifiable, encyclopedic prose following Wikipedia's core content policies and manual of style - NPOV, inline citations, notability-backed claims, and a strict ban on promotional language. Use when someone asks \"write this like a Wikipedia article\", \"draft a Wikipedia page for this company or person\", \"make this neutral and encyclopedic\", or \"why does my article draft keep getting rejected\". Do NOT use for persuasive or opinion writing - use op-ed-writer instead; for thesis-driven academic papers, use academic-essay; for verifying claims in existing text, use fact-checker.","https:\u002F\u002Fgithub.com\u002FSkillMedev\u002Fskills\u002Fblob\u002Fmain\u002Fskills\u002Fwikipedia-style\u002FSKILL.md",[],[],{"skillNo":80,"name":81,"nameZh":6,"description":82,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":83,"categories":84,"keywords":85,"publishedAt":57},"01M7526D43CTGRKGKNQ2GB0KVX","whitepapers","Structures and writes authoritative B2B whitepapers - a standalone executive summary, a data-sized problem statement, methodology, evidence-driven findings, recommendations, and a soft call to action - flagging every claim that needs a real citation. Use when a marketer asks \"write a whitepaper on this topic\", \"turn our research into a lead-gen asset\", \"make this credible enough for executives\", or a draft reads like a product pitch instead of analysis. Do NOT use for customer-story-driven proof - use case-study-builder instead; for policy audiences, use policy-brief.","https:\u002F\u002Fgithub.com\u002FSkillMedev\u002Fskills\u002Fblob\u002Fmain\u002Fskills\u002Fwhitepapers\u002FSKILL.md",[],[],{"skillNo":87,"name":88,"nameZh":6,"description":89,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":90,"categories":91,"keywords":92,"publishedAt":57},"01M75268423Y3K50SY5WC2NX2G","white-space-analysis","Finds unmet market gaps by ranking jobs-to-be-done on importance versus satisfaction, overlaying them against current solutions and workarounds, and validating that each gap is real, winnable, and worth winning. Use when someone asks \"where are the gaps in this market\", \"what's underserved here\", \"where should we play next\", or is hunting for product, feature, or market-entry opportunities. Do NOT use for profiling competitors and building battle cards - use competitive-intelligence instead; for putting a dollar figure on an identified opportunity - use market-sizing instead; for extracting jobs-to-be-done from raw customer interviews - use jtbd-extractor instead.","https:\u002F\u002Fgithub.com\u002FSkillMedev\u002Fskills\u002Fblob\u002Fmain\u002Fskills\u002Fwhite-space-analysis\u002FSKILL.md",[],[]]