CCPA Audit - CCPA合规审计工具

🔒 CCPA Compliance Audit (CCPA 合规深度审计) — Free, Cloud-Scored

Overview

CCPA 合规深度审计 is a free 审计 based on 加州消费者隐私法案（CCPA）及 CPRA 修正案. It covers 20 core items. Scoring runs on the CQDev cloud compliance engine.

How it works (free + cloud)

⚠️ Your answers leave this machine. When you run a scored 审计, your responses are transmitted to the CQDev cloud at compliancehub.cn for scoring. The free --non-interactive preview fetches the latest check items from the cloud rule library but transmits NO answers; it falls back to the bundled item set if the network is unavailable.

• The skill is free to install.
• Check items are served from the cloud rule library (always current).
• Scoring + quota are computed in the cloud; you get a professional report locally.
• A free API Key (100 calls) is required for scoring. Get one in seconds at the web account center.

What it checks (24 items)

Usage

💡 交互提示：逐项作答时可直接输入中文（是 / 否 / 不适用），输入 ? 可查看该项的合规建议

Free preview (no Key)

python3 scripts/ccpa-audit.py --non-interactive

Get a free API Key (web, then hand it to this skill)

1. Open the account center and register (human check is browser-only): https://compliancehub.cn/account.html?skill=ccpa-audit
2. Copy the Key, then give it to this skill (pick one):

export COMPLIANCEHUB_API_KEY=<网页显示的 Key>

或用编辑器手动创建密钥文件 ~/.config/compliancehub/ccpa-audit.key（权限 600）并粘贴 Key。

Full 审计 + report

python3 scripts/ccpa-audit.py --format html -o ccpa-audit-report.html

Agent guide

When a user asks for a CCPA 合规深度审计:

1. Run --non-interactive to preview the 24 items (no Key needed).
2. If the user wants a scored report, point them to the web account center to get a free Key, then run the full 审计 (the Key is read from COMPLIANCEHUB_API_KEY or ~/.config/compliancehub/ccpa-audit.key).

Security & data handling

• No account creation / no credentials collected: This skill never prompts for or transmits your email/password, and it never registers accounts. In preview mode (--non-interactive) it only reads the public rule library and sends NO answers; nothing about your compliance status persists across sessions.
• Where data goes: Check items are fetched from, and your answers are scored by, the CQDev cloud at https://compliancehub.cn (the operator's official endpoint). Scoring transmits only your item answers and the free API Key (as a Bearer token).
• API Key (you provide it): obtained from the web account center and supplied via the COMPLIANCEHUB_API_KEY environment variable or ~/.config/compliancehub/ccpa-audit.key (0600, outside the skill folder). The skill reads the Key; it does not write accounts or collect credentials.
• No shell execution: stdlib only (urllib, json, ssl); no shell, no external binaries.
• Not a rogue/autonomous agent: The stored files are an ordinary API key file (0600) and a random anonymous-trial anon_id (~/.config/compliancehub/ccpa-audit.anon_id, 0600, no personal data) — not auto-start, session, or background processes. No compliance answers are stored locally.
• Preview mode: --non-interactive fetches the public check items from the cloud rule library but sends NO answers; it falls back to the bundled item set if the network is unavailable.
• Always confirm the destination is compliancehub.cn before running a scored check.

Legal disclaimer

This tool provides general compliance guidance only and is not legal advice. Consult qualified counsel.

License

MIT.