compliance-review
starsforks
How to install compliance-review?
blueprintos/analysis-to-delivery/compliance-review
$npx -y skills add BlueprintOS/analysis-to-delivery --skill compliance-review合规性评审 — 按 compliance-path.md 引用的合规规则,逐条评估设计。涉及 GSP / HIPAA / SOX / GDPR 等强合规场景时调用。
SKILL.md
| 1 | # Compliance-Review — 合规评审 |
| 2 | |
| 3 | ## Contract |
| 4 | |
| 5 | - 输入: 已签字的 `01-业务需求文档 BRD.md` 与 `compliance-path.md` |
| 6 | - 输出: `04-合规评审.md` |
| 7 | - 门控: 所有适用合规条款均已判定;严重缺陷已修复或显式接受;用户 + 合规方签字 |
| 8 | - Required rules: `stage-gate`, `context-pointer` |
| 9 | - Required paths: `compliance-path`, `doc-naming-path` |
| 10 | - 下一步: `/test-case-design` |
| 11 | |
| 12 | ## 适用场景 |
| 13 | |
| 14 | | 需求类型 | 是否需要 | |
| 15 | |---|---| |
| 16 | | 涉及个人健康信息(PHI) | ✅ 必须 | |
| 17 | | 涉及支付/金融 | ✅ 必须 | |
| 18 | | 涉及个人身份信息(PII) | ✅ 必须 | |
| 19 | | 涉及医药追溯(GSP) | ✅ 必须 | |
| 20 | | 纯内部工具 | ⚠️ 按团队规范 | |
| 21 | |
| 22 | ## 流程步骤 |
| 23 | |
| 24 | ### 1. 加载合规规则 |
| 25 | |
| 26 | - 读项目根 `compliance-path.md` |
| 27 | - 加载其引用的合规规则文件(`config/compliance/<行业>.md` 或 skill 级 fallback) |
| 28 | - 列出所有适用条款 |
| 29 | |
| 30 | ### 2. 逐条评估 BRD |
| 31 | |
| 32 | 对每条合规条款,按以下格式输出: |
| 33 | |
| 34 | | 条款编号 | 缺陷等级 | 检查要点 | 合规设计 | 证据位置 | 状态 | |
| 35 | |---|---|---|---|---|---| |
| 36 | | **{条款编号} | {严重/主要/一般} | {检查要点} | {合规设计摘要} | FSD §{章节号} | ✅/⚠️/🔄 | |
| 37 | |
| 38 | **判定标准**: |
| 39 | - ✅ 符合:完全满足 |
| 40 | - ⚠️ 不符合:存在合规缺口 |
| 41 | - 🔄 不适用:条款不适用本功能 |
| 42 | |
| 43 | ### 3. 写评审结论 |
| 44 | |
| 45 | 按条款输出后,给出整体结论: |
| 46 | - ✅ 全部通过 → 进入下一阶段 |
| 47 | - ⚠️ 带条件通过(列出条件) |
| 48 | - ❌ 不通过(回 BRD 修复) |
| 49 | |
| 50 | ## 输出 |
| 51 | |
| 52 | - `04-合规评审.md` |
| 53 | |
| 54 | ## 调用的 rule |
| 55 | |
| 56 | - `rules/context-pointer` — 三层合规规则加载(项目级 > skill 级 > 默认) |
| 57 | - `rules/stage-gate` — 阶段 4 门控 |
| 58 | |
| 59 | ## 结束条件 |
| 60 | |
| 61 | - [ ] 所有适用条款已评审(无遗漏) |
| 62 | - [ ] 每条都有 ✅/⚠️/🔄 判定 |
| 63 | - [ ] 整体结论签字(用户 + 合规方) |
| 64 | - [ ] 缺陷等级为"严重"的条款全部 ✅ |
| 65 | |
| 66 | ## 反模式 |
| 67 | |
| 68 | - ❌ 留 {待评估}/{TBD}/{N/A} — `compliance-check.py` 视为未判定,直接 fail;必须给 ✅/⚠️/🔄 |
| 69 | - ❌ 严重条款状态为 ⚠️ — 必须修复或豁免到 ✅/🔄 后才能签字 |
| 70 | - ❌ 跳过 evidence(证据位置)列 — 每条必须标具体位置(FSD §X / PRD §Y / 设计回测报告) |
| 71 | - ❌ 不分缺陷等级(严重/主要/一般) — 必须分级,否则整改建议无法排序 |
| 72 | - ❌ 条款数量 ≠ `compliance-path.md` 引用的合规清单 — 必须 1:1 全覆盖 |
| 73 | - ❌ 仅做技术合规(代码层面)忽略业务流程合规 — 两者必须都覆盖 |
People who liked this also viewed
6 picksType
- find-skillsHelps users discover and install agent skills when they ask questions like "how do I do X", "find a skill for X", "is there a skill that can...", or express interest in extending capabilities. This skSkillsJul 2026
- grill-meA relentless interview to sharpen a plan or design.SkillsJul 2026
- vercel-react-best-practicesVercel's official collection of agent skillsSkillsJul 2026
- improve-codebase-architectureScan a codebase for deepening opportunities, present them as a visual HTML report, then grill through whichever one you pick.SkillsJul 2026
- setup-matt-pocock-skillsConfigure this repo for the engineering skills — set up its issue tracker, triage label vocabulary, and domain doc layout. Run once before first use of the other engineering skills.SkillsJul 2026
- triageMove issues and external PRs through a state machine of triage roles — categorise, verify, grill if needed, and write agent-ready briefs.SkillsJul 2026
