How to use the Privacy Policy Monitor agent skill

What the policy-monitor skill makes the agent do

Privacy policies tend to fall behind what a company actually does. A privacy impact assessment approves a new data category, a data processing agreement adds a subprocessor, or a triage result makes a new use conditional on a disclosure that the policy does not yet make. This skill is meant to catch that drift.

It works in two modes. In sweep mode it reads saved privacy impact assessments, data processing agreements and triage results, finds practices the published policy does not cover or misstates, and drafts suggested replacement wording. In direct-query mode you describe a planned new data practice and it tells you whether the policy covers it, is missing it, or conflicts with it.

• It also checks related notices such as app store labels, cookie banners and sector-specific notices.
• Every gap comes with suggested language, which is a draft for review with counsel rather than a final legal opinion.

Install the policy-monitor skill

You can install the skill in either of two ways. Download the ZIP from the skill page on this site. Then choose one of the options below.

To install it for yourself across projects, unzip it into ~/.claude/skills/. To install it for one project only, unzip it into that project's .claude/skills/ folder. If you use the Claude apps instead, upload the ZIP under Settings, then Capabilities, then Skills.

The skill's files include SKILL.md. Note that the skill refers to the claude-for-legal privacy-legal plugin, so the plugin setup described in the requirements section also has to be in place.

• Option 1: unzip into ~/.claude/skills/ for personal use.
• Option 2: unzip into a project's .claude/skills/ folder for one project.
• Option 3: upload the ZIP in the Claude apps under Settings, then Capabilities, then Skills.

Set up the configuration the skill depends on

The skill reads a configuration file at ~/.claude/plugins/config/claude-for-legal/privacy-legal/CLAUDE.md. That file needs an outputs folder path and the location of your policy document. Sweep mode depends on both. Without them the skill cannot scan prior outputs.

If the outputs section still contains a placeholder, the skill says so and offers direct-query checks only. To enable the crawl sweep, the skill points you to the separate /privacy-legal:cold-start-interview setup step and asks for the outputs folder path.

• An outputs folder that holds your saved PIAs, DPAs and triage results.
• The path to the saved privacy policy document.
• Read access to the policy document and prior outputs.

Trigger the skill with natural requests

You can run the skill as a slash command or describe what you want in plain language. The skill responds to requests such as 'does our policy cover this', 'we want to start doing X, does the policy need updating', 'run the policy monitor', 'policy sweep', or any request to find where the policy no longer matches what the team does.

For a sweep, run the command with no argument or with --sweep. For a direct check, put your planned practice in quotes after the command. The output for a direct check reports whether the practice is covered, missing or conflicting, with suggested language and a timing recommendation.

• Sweep: no argument, or --sweep.
• Direct check: describe the proposed practice as the argument.
• Natural request: 'does our policy cover using location data for offers?'

Read the output and what the sweep checks

A sweep classifies each gap. REQUIRED means the policy misrepresents current practice. ADVISABLE means the policy is silent on a practice. For each gap the output quotes the current policy text, describes the gap and drafts replacement language.

The sweep also looks beyond the website policy. It can check cookie consent banners, app store privacy labels, in-product consent flows and sector-specific notices such as GLBA, HIPAA, FERPA and COPPA notices. If a sectoral notice is required by your regulatory footprint but not configured, the sweep reports that as a standing gap until it is resolved.

• REQUIRED: the policy misrepresents current practice.
• ADVISABLE: the policy is silent on a practice.
• Sweep output includes a sectoral notice coverage list.

Safety notes: scripts, network and scheduling

According to the skill's listing, it runs no scripts and uses no network. It reads local files you configure and writes its output for your review. It does not send your policy or outputs anywhere.

The skill does not run on a schedule by itself. The skill suggests setting up a recurring reminder in your own calendar, task manager or CI to run the command weekly. Scheduled execution needs a scheduled-tasks integration, which is not bundled with this plugin.

• Runs scripts: no.
• Uses network: no.
• Scheduled automatic runs are not bundled.