SuperAPI AI Directory
Partner with us中文AI newsFavorites
Skillsapp-compliance-review

app-compliance-review

Office & productivity

View repository

Updated 10-15 20:29

About this skill

APP Personal Information Protection Compliance Inspection Skill

An APP personal information protection compliance review toolkit for corporate legal counsel, data compliance lawyers, or compliance consultants. It adopts a two-stage review methodology of "compliance fact-finding + declaration consistency verification", covering 11 major compliance modules and 53 inspection items, with legal bases verified in real time through a runtime-detected MCP backend. From "APP materials submitted by business departments" to "compliance review reports and rectification checklists that can be delivered directly", one package completes the closed loop.

Overview

This skill provides a systematic and structured inspection framework for personal information protection compliance review of mobile applications (APPs) in China. With the Personal Information Protection Law, the Cybersecurity Law, and the Data Security Law as the core bases, and combining regulatory enforcement practice and industry compliance standards, it establishes a compliance inspection system covering the entire lifecycle of APP personal information processing.

All legal and regulatory bases are verified through the legal verification MCP backend to ensure the accuracy of law and regulation names, document numbers, article numbers, and current validity. See references/law-library.md(including 24 laws and regulations, national standards, and group standards).

MCP Legal Verification Backend (Capability Slot Design)

The legal verification function of this skillis not bound to any specific MCP product. When the skill runs to Stage 4 (legal verification), it automatically scans the user's locally connected MCP connectors and selects a backend according to the following logic:

Runtime detection logic:

  1. Scan connected MCP connectors and detect whether the following backends are available:
Backend Detection Method Tool Prefix
PKULaw (pkulaw) Detect whether tools with the mcp__pkulaw__ prefix are available mcp__pkulaw__mcp-law/
HuaYu YuanDian (yuandian) Detect whether tools with the yuandian_ prefix are available yuandian_rh_fg_search etc.

  1. Select a backend according to the detection results:

    • 0 available → Mark in the report: "⚠️ No legal verification MCP backend detected; legal bases could not be verified in real time; manual confirmation is recommended", and skip the MCP verification step
    • 1 available → Automatically use that backend
    • Both available → Ask the user to choosewhich backend to use for this verification

  2. When asking the user, provide the following information to assist decision-making:

Backend Advantages
PKULaw Built into WorkBuddy, zero additional configuration, returns the TimelinessDic field to directly determine timeliness
HuaYu YuanDian Additionally supports a legal hallucination verification interface, which can batch-verify the accuracy of legal citations in reports

After the backend is determined, perform verification according to the corresponding tool mapping:

Verification Action PKULaw HuaYu YuanDian
Verify the current status of laws and regulations mcp__pkulaw__mcp-law/get_law_list(title=...) yuandian_rh_fg_search(keyword=...)
Verify clause content mcp__pkulaw__mcp-law-search-service/get_article(...) yuandian_rh_ft_detail(...)
Search for replacement clauses mcp__pkulaw__mcp-law-search-service/search_article(...) yuandian_law_vector_search(...)

HuaYu YuanDian MCP configuration method (if the user has not yet configured it):

{
  "yuandian-law": {
    "type": "http",
    "url": "https://open.chineselaw.com/mcp/law/stream",
    "headers": {
      "Accept": "application/json, text/event-stream",
      "Authorization": "Bearer YOUR_YUANDIAN_API_KEY"
    }
  }
}

Applicable Scenarios

  • Pre-launch compliance review: Before a new app or major version update goes live, comprehensively identify personal information protection compliance risks
  • Version iteration compliance self-check: When a minor version iteration involves changes in personal information collection behavior, incrementally review the changed parts
  • Regulatory notification rectification localization: After receiving a notice from the Ministry of Industry and Information Technology or an app store takedown notice, locate violations and generate a rectification checklist
  • M&A due diligence data compliance review: In investment and M&A scenarios, conduct data compliance due diligence on the target app
  • SDK integration assessment: Before adding a third-party SDK, assess whether its personal information processing behavior meets compliance requirements

Review boundaries (important)

The review scope of this skill is strictly limited tocheck items that legal affairs/lawyers can complete in a self-contained closed loop using app materials provided by business departments. The following matters are not included in this skill because they require additional context or belong to a different stage of work:

Excluded matters Reason When it should be handled
Data breach emergency response plan Requires enterprise security operations system documents, which app review materials cannot cover Regulatory inspection response or special security audit
Data full lifecycle management system Belongs to the enterprise's internal data security management system, not app-level review Enterprise data compliance system construction
Personal Information Protection Impact Assessment (PIA) Belongs to a special assessment at the product design stage and needs to be carried out independently At product initiation or major feature changes
Data classification and grading management system Belongs to the enterprise data governance system, not within the scope of app review Enterprise data governance system construction
Cybersecurity Classified Protection evaluation Belongs to a special cybersecurity compliance matter and requires evaluation by a certified institution Carry out periodically in accordance with Classified Protection 2.0 requirements
Compliance audit (PIPL §54) Belongs to a periodic audit system, not pre-launch review Carry out according to the statutory cycle

If gaps in the above matters are found during the review, point them out in the report in the form ofadvisory suggestions, but do not treat them as compliance determination items.

Two-stage review methodology

Compliance review of an app is divided into two major stages: firstascertain compliance facts, thenverify the consistency between declarations and facts. Most compliance risks are precisely hidden in the deviations between "declarations" and "facts", so the second stage is the core of the review.

Stage 1: Ascertaining compliance facts

Collect compliance facts from two dimensions: textual evidence collection and technical evidence collection:

Evidence collection dimension Review object Method
Textual evidence collection Privacy policy, user agreement, permission pop-up wording, third-party sharing statement, dual lists Item-by-item text review, against regulatory requirements and checklists
Technical evidence collection AndroidManifest.xml within the APK installation package, permission declarations, SDK package names, embedded privacy policy text/links, resource files Unpack the APK to extract technical facts, using scripts/apk_analyzer.py Automated analysis

Phase 2: Statement consistency verification

Compare textual statements item by item with technical facts, customer materials, and the actual contents of the installation package, and identify inconsistencies (for example, the privacy policy discloses SDKs A/B/C, but the installation package actually also contains D; or the privacy policy does not declare a certain permission, but the APK actually requests it).

What technical forensics obtains is "what was declared, what was embedded, and what is suspected to have been integrated," which is not equivalent to actual runtime invocation behavior. Actual runtime behavior requires further confirmation through dynamic testing, and the boundary between static forensics and dynamic verification should be clearly marked in the report.

Input material requirements

The completeness of the input materials directly determines the depth of the review. Before starting the review, send to the business department assets/input-materials-template.md to collect the following materials:

Required materials (none may be missing)

  1. APP installation package(APK file; for iOS it is an IPA, but this skill focuses on static analysis of Android APKs)
  2. Latest version of the privacy policy(complete text, including the third-party SDK list)
  3. User agreement/service agreement
  4. SDK list(including SDK name, affiliated company, function, types of personal information collected, purpose of collection, and usage scenarios)
  5. Permission use list(including permission name, usage scenarios, and purpose description)
  6. Business function list(division of basic functions and additional functions)
  7. List of collected personal information(one of the dual lists)
  8. List of personal information shared with third parties(one of the dual lists)

Optional materials (affect review completeness; may be skipped if not applicable)

After receiving the materials, confirm item by item whether they are applicable. Some materials may not be needed in specific scenarios, and reviewers must judge for themselves based on the actual situation of the APP:

  1. Description of personalized recommendation/algorithmic push settings (not needed if the APP has no personalized recommendation function)
  2. Description of the account cancellation process (not needed if the APP has no account system)
  3. Description of complaint and reporting channels (not needed if fully described in the privacy policy)
  4. Description of elderly-friendly adaptation (not needed if the APP is not within the scope of key APPs for elderly-friendly adaptation)
  5. Rules for the protection of children's personal information (not needed if the APP does not involve minors' business)
  6. Description of data cross-border transfer (not needed if the APP has no cross-border transmission)
  7. Description of the automatic renewal/membership subscription mechanism (not needed if the APP has no automatic renewal function)

Note: If a certain optional material is not applicable, simply mark it as "not applicable" in the material collection list and explain the reason; this does not affect the start of the review. If a certain material is applicable but the business department fails to provide it, mark the corresponding check item in the report as "material missing, review could not be completed."

After receiving the materials, run scripts/material_validator.py to verify material completeness, generate a list of missing items, and prompt the business department to supplement them.

# 校验材料完整性，输出缺失项清单与完整度评分
python scripts/material_validator.py --materials-dir /path/to/materials/

Workflow

Phase 1: Material collection and verification (Day 1)

  1. Send to the business department assets/input-materials-template.md material collection list
  2. After receiving the materials, run scripts/material_validator.py to verify completeness
  3. List the missing materials and require the business department to supplement them within the agreed time limit

Phase 2: Technical verification (Day 2-3)

  1. Run scripts/apk_analyzer.py to perform static analysis on the APK installation package and extract:
    • All permissions declared in AndroidManifest.xml
    • Third-party SDKs identified within the installation package (based on package name signature library matching)
    • Embedded privacy policy text or links
    • Basic application information (package name, version number, targetSdkVersion, etc.)
  2. Save the technical forensic results as structured JSON for subsequent consistency verification
# APK静态分析：提取权限、识别SDK、搜索内嵌隐私政策
# 脚本启动时会自动打印能力边界告知，并检测是否安装了增强工具
python scripts/apk_analyzer.py --apk /path/to/app.apk --output apk_report.json --format summary

Capability Boundaries: The APK analysis script runs with zero dependencies based on the Python standard library, using regular expression matching + byte search. Known limitations: permission extraction may miss non-standard formats, SDK identification only covers unobfuscated mainstream package names, and package name/version number may be inaccurate. At startup, the script automatically detects whether androguard/aapt2/apktool/jadx are installed; if installed, it prompts reviewers that they can be used for cross-validation.

For detailed APK analysis methods, see references/apk-analysis-guide.md。

Phase 3: Compliance Fact-Finding and Declaration Consistency Verification (Day 4-7)

  1. Against the 11 major module check items in references/checklist-full.md , first complete text forensics (review text materials)
  2. Compare the SDKs, permissions, and personal information types declared in the privacy policy item by item with the APK technical forensic results (consistency verification)
  3. Compare the SDK list provided by the client item by item with the SDKs identified in the APK (consistency verification)
  4. Compare the permission usage list item by item with the permissions declared in AndroidManifest.xml (consistency verification)
  5. Record the factual findings, compliance determination, and risk level for each check item

Phase 4: Real-Time Verification of Regulatory Basis (Day 7) — MCP Provision Anchoring

Laws and regulations in the data compliance field are updated frequently (e.g., the Cybersecurity Law was amended in October 2025), so the skill must verify the current validity of the regulations on which it relies at each run, avoiding citation of provisions that have become invalid or been amended.

Verification Mechanism: Through the references/article-anchors.md provision anchoring table, establish a programmatic mapping between each check item and specific legal provisions (72 anchors in total). At each run, first scan the connected MCP backends (see the capability slot design for "MCP Regulatory Verification Backend" above), determine the backend used for this run, and then verify each anchor according to the corresponding tool mapping.

Verification Process：

  1. Scan connected MCP connectors and detect the availability of pkulaw/yuandian (0 → skip and warn; 1 → use automatically; 2 → ask the user to choose)
  2. Load references/article-anchors.mdto obtain the full list of anchors
  3. For each anchor, execute according to the verification frequency policy:
    • every_run Class anchors (Personal Information Protection Law, Cybersecurity Law, Data Security Law, Identification Measures, 42 in total): must be verified at every run
    • quarterly Class anchors (Provisions on the Scope of Necessary Personal Information, Provisions on the Administration of Mobile Internet Application Information Services, Document No. 164, Action Notice No. 524, Document No. 26, Algorithm Recommendation Provisions, Advertising Administration Measures, Law on the Protection of Minors, Regulations on the Cyber Protection of Minors, 23 in total): verify if more than 90 days have passed since the last verification
    • annual Class anchors (GB/T national standards, 7 in total): marked as "requires manual verification" because regulatory MCP backends usually do not include national standards
  4. Invoke the corresponding MCP tool for verification according to the active backend:

When the backend is pkulaw (Peking University Law):

# 核验法规现行状态（检查TimelinessDic字段是否为"现行有效"）
mcp__pkulaw__mcp-law/get_law_list(title="个人信息保护法")

# 核验具体条款内容
mcp__pkulaw__mcp-law-search-service/get_article(title="中华人民共和国个人信息保护法", number="十七")

# 法规已修订时检索替代条款
mcp__pkulaw__mcp-law-search-service/search_article(text="敏感个人信息单独同意")

When the backend is yuandian (Huayu Yuandian):

# 核验法规现行状态（检查返回结果中的时效性字段）
yuandian_rh_fg_search(keyword="个人信息保护法")

# 核验具体条款内容
yuandian_rh_ft_detail(law_title="中华人民共和国个人信息保护法", article_no="十七")

# 法规已修订时检索替代条款
yuandian_law_vector_search(query="敏感个人信息单独同意")
  • Verify the current status of the regulation: Invoke the corresponding tool according to the active backend
    • pkulaw: mcp__pkulaw__mcp-law/get_law_list(title=<law_search_key>), check the TimelinessDic field
    • yuandian: yuandian_rh_fg_search(keyword=<law_search_key>), check the timeliness field in the returned result
    • If "repealed or invalid" is displayed, mark the anchor as invalid and suspend citation
    • If multiple versions exist, confirm that the latest version is cited (e.g., the Provisions on the Administration of Mobile Internet Application Information Services must use the 2022 revised version rather than the 2016 original version)
  • Verify clause content: call the corresponding tool according to the active backend
    • pkulaw: mcp__pkulaw__mcp-law-search-service/get_article(title=<law_title>, number=<law_article_no>)
    • yuandian: yuandian_rh_ft_detail(law_title=<law_title>, article_no=<law_article_no>)
    • Confirm that the clause content is consistent with the skill citation
  • Retrieve alternative clauses(if the regulation has been revised): call the corresponding tool according to the active backend
    • pkulaw: mcp__pkulaw__mcp-law-search-service/search_article(text=<关键词>)
    • yuandian: yuandian_law_vector_search(query=<关键词>)
  1. Record the verification results in the run log (JSON format, including the status, verification time, and remarks for each anchor)
  2. For invalid or revised bases, mark a warning in the report and adjust the cited clauses

Verification result handling rules：

  • Regulation repealed → mark in the report "⚠️ The original regulatory basis has been repealed; verify a replacement regulation"
  • Regulation revised → retrieve the new clauses, update the citation, and mark in the report "This report has adopted the latest revised clauses"
  • Regulation MCP backend cannot return → mark in the report "⚠️ The regulation status could not be verified through MCP; manual confirmation is recommended"
  • National standards (GB/T series) → mark in the report "Manual verification through the National Public Service Platform for Standards Information is required"
  1. For each non-compliance finding, cite references/law-library.md the specific regulatory clauses in, and attach the clause anchor number (e.g., [A014])
  2. The verification results of the clause anchoring table serve as an appendix to the report, proving the current validity of the basis

Phase 5: Report generation and delivery (Day 8-10)

  1. Run scripts/report_generator.py or based on assets/compliance-report-template.md generate the compliance review report
# 方式一：交互式输入检查结果，生成Markdown报告
python scripts/report_generator.py --interactive --output compliance_report.md

# 方式二：从JSON文件读取检查结果，附带APK分析报告
python scripts/report_generator.py --input check_results.json --apk-analysis apk_report.json --output compliance_report.md
  1. Generate assets/remediation-template.md rectification list, sorted by priority
  2. Deliver to the business department: compliance review report + rectification list + regulatory basis index

11 major compliance check modules

Module Check focus Core regulatory basis
M1 Privacy policy compliance Policy completeness, first-run prompt, easy access and reading, dual lists PIPL §7, §17; Identification Measures §1-2; 524 Action Notice; Document No. 26
M2 Informed consent No collection before consent, no frequent requests after refusal, no exceeding authorization, withdrawal channels PIPL §13-16, §22; Identification Measures §3; Document No. 26
M3 Minimum necessity Related to business functions, non-essential items can be refused, no forced bundling, reasonable frequency PIPL §6, §19; Necessary Scope Provisions; Identification Measures §4; GB/T 41391-2022; T/TAF 077 series
M4 Permission management Complete permission declarations, synchronous notice upon request, correspondence with invocation scenarios, refusal mechanism PIPL §13-16; Identification Measures §3-4; Document No. 164; Document No. 26; T/TAF 078.4
M5 SDKs and third parties Complete SDK list, standardized declarations, third-party application access, auto-start PIPL §23; Identification Measures §5; Document No. 164; Document No. 26; T/TAF 078.10
M6 Sensitive personal information Sensitive information identification, separate consent, necessity, security measures, real-name authentication compliance PIPL §28-32; GB/T 35273-2020; Identification Measures §3-4; Cybersecurity Law §24
M7 User rights Account cancellation, correction and deletion, withdrawal of consent, complaints and reports, convenient uninstallation PIPL §44-50; Identification Measures §6; Document No. 164; Document No. 26
M8 Advertising Compliance Advertising identification, pop-ups, closing, distribution, advertising to minors, not misleading Measures for the Administration of Internet Advertising §9-10, §14; Advertising Law §14, §43-44; Document No. 164; Document No. 26; T/TAF 078.7
M9 Data Security (Presentation and Transmission Layer) De-identified presentation, encrypted transmission, plaintext transmission check PIPL §51; Cybersecurity Law §21, §42; Data Security Law §27
M10 Special Scenarios Children, age-friendly adaptation, data cross-border transfer, personalized recommendation (including prohibition of differential treatment), automatic renewal PIPL §31, §36, §38-40; Minors Protection Law; Age-friendly Notice; Provisions on the Administration of Algorithmic Recommendations §10, §15, §17, §24; T/TAF 078.2
M11 Information Disclosure on Distribution Platforms Information disclosure of the APP on distribution platforms, distribution conduct norms (only applicable to APPs with distribution functions), filing number display Provisions on the Administration of Mobile Internet Application Information Services (2022); Document No. 164; Document No. 26; Notice on APP Filing Work

The complete checklist items for each module (including inspection standards, violation circumstances, compliance recommendations, and legal provisions) are see references/checklist-full.md(11 major modules, 53 checklist items).

Output Deliverables

1. Compliance Review Report

Based on assets/compliance-report-template.md generated, including:

  • Executive Summary: APP basic information, review scope, overall compliance rate, overview of major risk items
  • Compliance Overview Table: Compliance status of the 11 major modules (✅Compliant / ⚠️Needs Attention / ❌Non-compliant / —Not Applicable), four-color labeling
  • Item-by-Item Inspection Results: Each item includes checklist item number, inspection content, legal basis, factual findings, risk level (high/medium/low), and rectification recommendations
  • Consistency Verification Findings: List of inconsistencies between textual statements and technical facts
  • Legal Basis Index: Summary of all laws and regulations provisions cited in this report

2. Rectification List

Based on assets/remediation-template.md generated, sorted by priority:

  • P0 Urgent(must be fixed before launch): Violation of mandatory legal provisions, risk of being taken down
  • P1 High Priority(fix within a time limit): High-frequency issues notified by regulators, relatively large impact on user rights
  • P2 Medium Priority(fixed in version iterations): Normative defects, completeness requirements
  • P3 Low Priority(long-term optimization): Best practice recommendations

Legal Basis Verification Method

The laws and regulations cited in this skill are all verified through the MCP backend configured by the user. Verification method:

  1. For law and regulation names and document numbers, use references/law-library.md as the standard
  2. Read assets/mcp-backends.yaml to confirm the active backend (pkulaw or yuandian)
  3. If it is necessary to confirm whether a law or regulation has been amended or repealed, call the corresponding tool for retrieval according to the active backend
  4. For national standards (GB/T series), they may not be included in the legal MCP backend; confirm the current version through official channels

Important NoticeRegulations are continuously updated; before using this skill, confirm that the following key regulations are the latest versions:

  • Cybersecurity Law, amended in October 2025, effective January 1, 2026
  • Regulations on the Administration of Mobile Internet Application Information Services, use the 2022 revised version

Resource Description

references/ (loaded on demand during review)

File Content Loading Timing
law-library.md Regulatory basis library verified by the MCP backend (regulation names, document numbers, clause summaries, current status) When citing regulatory bases
article-anchors.md Clause anchoring table (72 anchors, programmatic mapping of check items to regulatory clauses, supporting dual-backend MCP verification) During regulatory verification in each run of Phase 4
checklist-full.md Complete checklist for the 11 major modules (detection standards, violation scenarios, compliance recommendations) During item-by-item review
input-materials-guide.md Detailed format requirements and collection guidelines for input materials Material collection stage
apk-analysis-guide.md APK static analysis methods, tool usage, result interpretation Technical verification stage

scripts/ (executable scripts)

Script Function
apk_analyzer.py APK unpacking and static analysis: extract permissions, identify SDKs, extract embedded privacy policies
material_validator.py Input material completeness verification: check whether required materials are complete
report_generator.py Compliance check report generation: aggregate check results and output a Markdown report

assets/ (output templates)

File Purpose
input-materials-template.md Template for the material collection checklist sent to business departments
compliance-report-template.md Compliance review report output template
remediation-template.md Rectification checklist output template

Usage Restrictions

  • This skill provides compliance self-check assistance and does not constitute formal legal advice
  • APK static analysis is not equivalent to runtime behavior verification; dynamic behavior must be confirmed by dynamic testing
  • For major compliance decisions or regulatory investigations, a professional lawyer must be consulted
  • Regulations are continuously updated; the latest status of regulations should be verified before use
  • iOS (IPA) analysis capability is limited; this skill focuses on Android APK analysis

Tips

  • The practical key points for each check item are embedded in references/checklist-full.md in the "Practical Key Points" annotation of the corresponding check item, and are presented together with the rules during review without omission
  • The Identification Measures has only 6 articles in total, corresponding to 6 major categories of violations; when citing, do not fabricate nonexistent clause numbers (e.g., §7-§11 do not exist)
  • Static forensics obtains "what was declared, what was embedded, what was suspected to be integrated," which is not equivalent to actual runtime invocation behavior—any conclusion in the report involving runtime behavior must be marked "requires dynamic testing confirmation"
  • When citing regulatory bases, clause anchor numbers must be attached (e.g., [A014]) to facilitate tracing during MCP verification