Conduct due diligence on third-party operators (operadores) under LGPD Art. 39. Use when user asks 'auditar fornecedor', 'vendor audit LGPD', 'operadores LGPD', 'devida diligência', or onboarding/reviewing third-party services. Produces vendor tier assessment + remediation list.
The English summary is being prepared. Showing the original description.
Run score Not tested
See how to installReview the instructions the agent will receive before you install.
Interaction Localization Rule: When locale: pt-BR (or user speaks Portuguese), ALL questions (AskUserQuestion / sk_question), confirmation prompts, and selectable options MUST be translated and presented in Brazilian Portuguese (PT-BR). Any English question text or options in this skill are illustrative examples — NEVER display English questions or options to a Portuguese developer. Internal reasoning, code synthesis, tests, and technical documentation MUST remain in English (except Brazilian statutory compliance documents under .lgpd/).
Art. 39 LGPD: operador trata segundo instruções do controlador. Art. 42: controlador responde solidariamente por danos causados pelo operador. Logo, escolha do operador é responsabilidade direta do controlador.
Liste TODOS os operadores (cloud, SDK, analytics, comms, pagamento, observability, CRM, etc.). Cruze com:
package.json / requirements.txtcors origins no backend| Tier | Critério | Exemplo | Periodicidade de revisão |
|---|---|---|---|
| Crítico | Acesso a dados sensíveis OU volume grande de PII | Cloud principal, payment, identity provider | Trimestral |
| Alto | Acesso a PII comum em larga escala | Email, SMS, push, observability | Semestral |
| Médio | Acesso limitado a PII | Analytics agregada, CRM | Anual |
| Baixo | Sem PII ou pseudonimizada | CDN, monitoramento de uptime | Anual ou ad-hoc |
Ver assets/vendor-checklist.md.
Para cada vendor: .lgpd/vendors/{vendor-slug}.md com:
Lista priorizada em .lgpd/gaps.md.
Se o operador:
## F (L4 ou F14a) — Vendor audit ✓
- {N} operadores inventariados
- {Crit/Alto/Med/Baixo} por tier
- {M} com DPA + cláusulas adequadas
- {X} gaps abertos: ver `.lgpd/gaps.md`
- Próximo: saas-lgpd-dpa ou saas-lgpd-international-transfer
No reviews yet. Tell others what you thought.
No login needed. Share how it worked for you, ask a question, or note where it did not run.
No comments yet. Be the first to write one.
Turn your AI session into an autonomous SaaS and software engineering studio with 49 specialized agents, 74 workflow skills (/saas-*), 28 director gates, and complete architecture across Next.js, FastAPI, Supabase, Tailwind, and Stripe.
The English summary is being prepared. Showing the original description.
Brownfield audit — do existing artifacts actually work? Numbered migration plan. Unlike /saas-project-stage-detect, checks compliance not existence.
The English summary is being prepared. Showing the original description.
Create an ADR documenting a technical decision: context, alternatives considered, consequences.
The English summary is being prepared. Showing the original description.
Traceability matrix mapping PRD requirements to ADRs. Finds gaps, cross-ADR conflicts, stack compatibility. PASS/CONCERNS/NOT ASSESSED/FAIL.
The English summary is being prepared. Showing the original description.
Audit assets against naming conventions, file size budgets, format standards. Finds orphaned assets, missing references.
The English summary is being prepared. Showing the original description.
Author per-asset visual specs, SVG dimensions, and generation prompts from PRDs and design tokens. After design tokens.
The English summary is being prepared. Showing the original description.