Site Risk Check
Scans a live site for the legal and accessibility flags demand-letter firms look for.
About
A zero-dependency skill that scans a public URL for conditions that draw automated legal complaints: missing privacy/cookie policies, trackers firing before consent, and accessibility gaps like missing alt text, unlabeled inputs, and missing headings.
It runs a local Python scanner, can gate CI by exiting non-zero on high findings, and plainly states which checks it could not evaluate. It is a static scan of one page — no crawling, and it explicitly is not legal advice.
What it can do
- Policy-link detection (privacy, terms, cookies, accessibility, refunds)
- Tracker and consent-mechanism checks
- Cookie-before-consent detection
- Accessibility checks (alt text, labels, headings, lang, HSTS)
- Market-aware scoping (US-CA, EU, and more)
- Delta reporting against a saved state
- CI gating via non-zero exit on high findings
- Self-contained HTML report output
- SSRF-safe local scanning
Setup
- Clone the repo and run the install script, which symlinks the skill into your agents' skills directories.
- Restart your agent session.
- Ask the agent to check a site, e.g. "check if my site is legally covered — example.com".
Prerequisites
Python 3 for the bundled scanner. No API keys or paid services.
Use cases
Works with
Trust score — 5/10
Scored 5/10 (metrics tier, metrics-v1). Evidence: 2 GitHub stars, very early; 19 commits, tagged v0.1.0 release; local-only scanner, no API keys; explicitly not legal advice; static single-page scan. License: MIT.
★ 2 GitHub stars
How the trust score is built
Full methodology →- Adoption · stars/downloads, log-scaled vs peers
- 4.0/10
- Maintenance · recency, releases, issue load
- 5.0/10
- Openness · license + docs
- 8.0/10
- Manual review · sanity read + red-flag check
- 6.0/10
- · 2 GitHub stars, very early
- · 19 commits, tagged v0.1.0 release
- · local-only scanner, no API keys
- · explicitly not legal advice; static single-page scan
Sources
Every fact above was checked against these sources. Where a claim comes from the provider and couldn't be independently verified, the text says so.