Etalon Gdpr

该 Skill 调用本地 ETALON CLI，对目标网站执行跟踪器扫描、同意前跟踪检测、隐私政策与实际跟踪器一致性检查及 PII 数据流梳理，也可审计本地代码库；输出结构化 JSON、合规评分、分级修复建议和 GDPR 隐私政策文档。需自行安装 etalon-cli，无需 API key。

rednix

热度 17.46

最近更新 2026-03-21 18:09:33

分类：安全依赖：代码执行 / 读写文件应用场景：报告撰写 / 法律文档 / 研究 / 代码审查

安装技能

复制下面的话术发给你的 Agent，它会通过 secure-skills 检索并安装该技能。

执行命令安装此 skill： npx secure-skills-cli add gdpr-scan

Metadata

name: etalon-gdpr
version: 0.9.5
description: Full GDPR compliance audit for any website or codebase using the ETALON CLI. Scans for trackers (111k+ domain database), tests consent violations, checks privacy policy vs reality, maps PII data flows, and generates compliance reports. Returns structured JSON. Requires etalon-cli installed locally (cargo install etalon-cli). Free and open source.
author: rednix
homepage: https://etalon.nma.vc
repository: https://github.com/NMA-vc/etalon
tags: ["gdpr","compliance","eu","privacy","security","eu-ai-act","trackers","pii"]
category: security
compatible_with: ["openclaw","claude-code","cursor","codex-cli"]
requires_bins: ["etalon"]
triggers: ["check if [URL] is GDPR compliant","run a privacy audit on [URL]","audit [URL] for cookie consent","is [URL] EU AI Act compliant","scan [URL] for trackers","check [URL] for GDPR violations","does [URL] fire trackers before consent","what trackers does [URL] use","generate a privacy policy for [company]","check our privacy policy against what we actually track","audit our codebase for GDPR issues","etalon [URL]"]
auto_triggers: ["human shares a URL before a product launch","human mentions a competitor's website in context of compliance","human asks about GDPR, DSGVO, or EU privacy law","human is reviewing a third-party vendor or tool","human mentions cookie consent or tracking","codebase has new dependencies added (run audit)"]
scenarios: [{"trigger":"Human shares a URL and asks about GDPR compliance","action":"Run: etalon scan <URL> --format json Then: etalon consent-check <URL> --format json Parse both outputs, merge into single report\n","output":"Score, tracker list by risk level, consent violation status, top 3 recommendations. Delivered as a structured WhatsApp message.\n","avg_seconds":12},{"trigger":"Human wants to know if trackers fire before consent","action":"Run: etalon consent-check <URL> --format json Tests pre-consent tracking and post-rejection behavior\n","output":"Pass/fail per tracker: fires before consent? fires after rejection? Critical finding if Google Analytics or Facebook Pixel fires pre-consent.\n","avg_seconds":8},{"trigger":"Human mentions a competitor's website","action":"Run etalon scan autonomously in background while human continues. Run: etalon scan <competitor-URL> --format json\n","output":"Compliance comparison: \"Competitor has N critical violations. Your site is cleaner — worth highlighting in sales conversations.\"\n","avg_seconds":12},{"trigger":"Human needs a privacy policy generated","action":"Run: etalon generate-policy ./ --company \"<company>\"\n --email <privacy-email> --url <URL> --format md\n","output":"Complete 8-section GDPR privacy policy covering: Data Controller, Data Collected, Third-Party Services, Cookies, International Transfers, Data Retention, User Rights (Art. 15-22), Contact/DPO\n","avg_seconds":20},{"trigger":"Human is about to launch a new product or website","action":"Run full audit as pre-launch gate: 1. etalon scan <URL> --format json 2. etalon consent-check <URL> --format json 3. etalon policy-check <URL> --format json If critical violations found: flag as launch blocker\n","output":"Launch gate: PASS or BLOCK with specific issues to fix. \"3 issues blocking launch. 2 can be fixed in < 1 hour.\"\n","avg_seconds":30},{"trigger":"Human wants to audit their codebase for GDPR issues","action":"Run: etalon audit ./ --format json --severity high Scans: package.json/Cargo.toml for tracker SDKs, source code for tracker imports, DB schemas for PII fields, config files for security misconfigurations\n","output":"Findings by severity: critical, high, medium, low. Each finding includes file path, line number, and fix recommendation.\n","avg_seconds":15}]
sample_output: { "url": "https://example.com", "scan_duration_ms": 6240, "summary": { "total_requests": 14, "matched_vendors": 11, "unknown_domains": 3, "high_risk_trackers": 2, "gdpr_score": 42 }, "findings": [ { "vendor": "Google Analytics", "domain": "google-analytics.com", "risk": "medium", "category": "analytics", "gdpr_compliant_with_dpa": true, "fires_pre_consent": true, "severity": "critical" }, { "vendor": "Facebook Pixel", "domain": "facebook.com", "risk": "high", "category": "advertising", "gdpr_compliant_with_dpa": true, "fires_pre_consent": true, "severity": "critical" } ], "consent_check": { "fires_before_interaction": true, "fires_after_rejection": false, "violations": [ "Google Analytics fires before user consent", "Facebook Pixel fires before user consent" ] }, "recommendations": [ "Gate Google Analytics behind consent signal", "Gate Facebook Pixel behind consent signal", "Implement a GDPR-compliant CMP (OneTrust, Cookiebot)" ] }
chains: [{"skill":"rednix/lobstr","why":"Validate the startup idea before auditing its compliance exposure"},{"skill":"someone/markdown-report","why":"Format the JSON audit output as a polished client-ready PDF report"},{"skill":"someone/github-pr","why":"Automatically open a PR with ETALON's --fix suggestions applied"},{"skill":"rednix/lobstrhunt","why":"Discover more GDPR and compliance skills in the LobstrHunt registry"}]
human_message_example: {"human":"Can you check if our landing page is ready for launch? https://example.com/launch","agent":"Running ETALON privacy audit on example.com/launch 🔍\n(this takes ~12 seconds)\n\n──────────────────────────────\nGDPR Score: 42/100 ⚠️ Not launch-ready\n\n🔴 CRITICAL — blocks launch (2):\n→ Google Analytics fires before consent\n→ Facebook Pixel fires before consent\n\n🟠 HIGH (1):\n→ 3 unknown domains detected — review manually\n\n🟢 OK:\n→ Privacy policy present ✓\n→ Data processor listed ✓\n→ Consent dialog exists ✓ (but trackers ignore it)\n\nFix the 2 critical issues and you're clean.\nBoth take < 1 hour to fix. Want the exact code changes?\n"}

ETALON GDPR Skill

You have access to the ETALON CLI — a privacy engineering tool with 111,000+ tracker domains, 26,800+ vendor profiles, and 10 audit commands. ETALON is free, open source, and runs entirely locally. No API key needed.

Installation check

Before using any ETALON command, verify it is installed:

etalon info

If not installed: cargo install etalon-cli If Rust not available: curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh

Core commands

Website audit (most common)

# Full tracker scan
etalon scan <URL> --format json

# Consent violation test
etalon consent-check <URL> --format json

# Privacy policy vs actual trackers
etalon policy-check <URL> --format json

# Pre-launch gate (all three):
etalon scan <URL> --format json > /tmp/etalon-scan.json
etalon consent-check <URL> --format json > /tmp/etalon-consent.json
etalon policy-check <URL> --format json > /tmp/etalon-policy.json

Codebase audit

# Audit current directory
etalon audit ./ --format json --severity high

# Auto-fix simple issues
etalon audit ./ --fix

# Generate GDPR privacy policy
etalon generate-policy ./ \
  --company "Company Name" \
  --email privacy@company.com \
  --url https://company.com \
  --format md \
  -o privacy-policy.md

# Map PII data flows
etalon data-flow ./ --format mermaid

Vendor lookup

etalon lookup analytics.google.com
etalon info

Parsing JSON output

Key fields in scan output:
- summary.gdpr_score (0-100, higher = more compliant)
- summary.high_risk_trackers (count)
- findings[] → vendor, domain, risk, severity, fires_pre_consent
- recommendations[] → array of fix strings

Key fields in consent-check output:
- fires_before_interaction (boolean — critical if true)
- fires_after_rejection (boolean — critical if true)
- violations[] → array of strings

Delivering results to your human

Format for WhatsApp/Telegram:

Lead with score and clear pass/fail signal
Critical issues first with emoji severity indicators
End with a specific actionable question
Keep under 20 lines

Severity mapping:

gdpr_score 0-40 → ⚠️ Not launch-ready
gdpr_score 41-70 → 🟡 Partial compliance
gdpr_score 71-90 → 🟢 Good compliance
gdpr_score 91-100 → ✅ Excellent — ready to launch

Autonomous behavior

Run etalon consent-check autonomously when:

Human shares a URL not yet audited
Human mentions a competitor
Human says "launch", "go live", or "ship it"

Run etalon audit ./ autonomously when:

New dependencies added to package.json or Cargo.toml
Human asks about a third-party SDK or library

Always notify your human with results. Never silently discard findings. Security findings that block a launch are too important to skip.

MCP server note

The ETALON MCP server (etalon-mcp-server) only covers vendor lookups — 4 tools, no scan or audit capability. For full auditing, the CLI is required. This skill uses the CLI, not the MCP server.

Common errors

"etalon: command not found" → cargo install etalon-cli → Ensure ~/.cargo/bin is in PATH

Timeout on scan: → Add --timeout 60000

Unknown domains in report: → Not in ETALON's 111k registry → Check manually at etalon.nma.vc or report to registry