Content
# app-compliance-review
**Mobile Application (APP) Personal Information Protection Compliance Review Skill Package.**
For company legal, data compliance lawyers or compliance consultants, conduct a comprehensive personal information protection compliance review of mobile applications, and directly deliver compliance review reports and rectification lists to business departments.
- **Two-stage review methodology**: First, investigate compliance facts from text and technical evidence, then verify the consistency of statements and facts, and locate deviations between "statements" and "actualities".
- **11 compliance modules, 50+ inspection items**: Privacy policy, informed consent, minimum necessity, permission management, SDK and third-party, sensitive personal information, user rights, advertising compliance, data security, special scenarios, and distribution platform information disclosure.
- **MCP clause anchoring**: 72 regulatory anchors, each run through user-configured MCP backend (preferably Huayu Yuandian) to verify the current validity of regulations in real-time, avoiding citing invalid or revised clauses.
- **Dual backend capability slot**: Regulatory verification MCP backend can be plugged and configured, with Huayu Yuandian (requiring API Key) as the first choice, and other connected legal retrieval MCPs as alternatives, see `assets/mcp-backends.yaml`.
- **APK static analysis**: Unpack the installation package to extract permission statements, identify third-party SDKs, and extract embedded privacy policies for cross-comparison with text statements.
- **24 regulatory references**: 4 laws, 8 departmental regulations, 6 national standards, 2 industry standards, and 4 others, all verified by MCP backend.
## Quick Start
```bash
# 1) Dependencies (scripts/ uses standard libraries, usually no need to install)
# For enhanced APK analysis capabilities, optionally install androguard:
# pip install androguard
# 2) Send material collection list to business department
# See assets/input-materials-template.md
# 3) Verify material integrity after receipt
python3 scripts/material_validator.py --materials-dir /path/to/materials/
# 4) APK static analysis
python3 scripts/apk_analyzer.py --apk /path/to/app.apk --output apk_report.json --format summary
# 5) Conduct item-by-item review (refer to references/checklist-full.md)
# 6) Generate compliance review report
python3 scripts/report_generator.py --input check_results.json --apk-analysis apk_report.json --output compliance_report.md
```
## Directory
```
app-compliance-review/
├── SKILL.md # Skill definition (AI Agent can directly read as skill definition)
├── README.md # This file
├── LICENSE # License (in Chinese and English)
├── requirements.txt # Python dependency description
├── scripts/ # Executable scripts
│ ├── apk_analyzer.py # APK static analysis: extract permissions, identify SDKs, and search for embedded privacy policies
│ ├── material_validator.py # Input material integrity verification
│ └── report_generator.py # Compliance review report generation
├── references/ # In-depth documents
│ ├── law-library.md # Regulatory reference library (24 regulations, verified by MCP backend)
│ ├── article-anchors.md # Clause anchoring table (72 anchors, MCP verification basis)
│ ├── checklist-full.md # Complete inspection checklist (11 modules, 50+ inspection items)
│ ├── input-materials-guide.md # Input material detailed format requirements
│ └── apk-analysis-guide.md # APK static analysis method guide
├── assets/ # Configuration and output templates
│ ├── mcp-backends.yaml # MCP regulatory verification backend configuration (preferably yuandian, alternative legal retrieval MCPs)
│ ├── check-results-schema.md # Inspection result JSON data structure documentation
│ ├── input-materials-template.md # Material collection list template (sent to business department)
│ ├── compliance-report-template.md # Compliance review report template
│ └── remediation-template.md # Rectification list template
```
## Design Principles
1. **Separate statements and facts**: Text statements (privacy policies, etc.) and technical facts (APK unpacking results) are collected separately and then compared item by item. Most compliance risks are hidden in the deviations between the two.
2. **Self-closed loop**: All inspection items can be completed with materials provided by the business department (installation package + text statements + list documents), without including operation and management system checks that require additional context.
3. **Regulatory real-time verification**: In the field of data compliance, regulations are frequently updated. The skill verifies the current validity of cited regulations in real-time through MCP backend.
4. **Clear static analysis boundary**: Technical evidence obtains "what is declared, what is embedded, and what is suspected to be accessed", which is different from actual calling behavior during runtime. The report clearly marks the boundary.
## License
Adopt **CC BY-NC-ND 4.0 + Additional Terms** dual-layer licensing: Attribution / Non-commercial / NoDerivatives + Prohibited AI training / Prohibited charging platform / Enterprise and administrative organs identified as commercial / Academic citation format / Prohibited endorsement / Rights reserved. See [LICENSE](LICENSE) for complete terms.
