legal-auditlisted

# Legal audit The job is **consistency**: the published documents are promises about how a live service handles real people's personal data, and nothing in CI diffs them against the code. This skill finds where they have drifted apart, in both directions. **Read `.claude/skills/audit/audit-loop.md` first** — it owns the loop. This file owns the domain. Pass `--research` to force a research pass; otherwise the cadence in `criteria.md` decides. ## The boundary that defines this skill **Research produces a reading list. It never writes a legal criterion.** An agent is not a lawyer; search results on German and EU law range from statute text to SEO filler; and the output here is a public statement about processing personal data. So phase B collects, with source URL and date, and phase C critiques — but findings land in the **report** under "for your judgement", not in `criteria.md`. A new legal duty enters the criteria only when the user says so explicitly (`L-R04`, which is a meta-criterion — do not remove it). Write each research finding as: what changed · who it binds · why it might or might not bind this app · the primary source · the date. Then say plainly which ones you think deserve the user's attention and which look like noise. Prefer primary sources: EUR-Lex, gesetze-im-internet.de, the EDPB, the responsible Landesdatenschutzbehörde, official DSA guidance. A law-firm blog is a pointer to a source, not a source. ## The mechanical audit (phase E) — derive from co