本文へ移動
cccskills
無料GitHub で公開

tos-clause-scanner

Audit Terms of Service, user agreements, and privacy policies for consumer risks, producing a structured report that flags unfair clauses, data traps, and liability issues. Trigger when a user asks to review, audit, or analyze a ToS, privacy policy, or user agreement, or mentions specific concerns like auto-renewal or data authorization.

インストール方法を見る

含まれるファイル(3)

  • SKILL.md12.8 KB
  • LICENSE1.1 KB
  • README.md351 B

SKILL.md(原文)

インストールする前に、エージェントに与えられる指示の中身を確認できます。

Terms of Service Auditor (Consumer Perspective)

Systematically audit the Terms of Service, User Agreements, and Privacy Policies of apps, SaaS products, and platforms from an ordinary consumer's standpoint. Identify clauses that may harm consumer rights and produce an actionable audit report.

Quick Start

Paste the terms text directly to the Agent or provide a file path. The Agent will automatically complete the audit and output a structured report.

Example prompts:

  • "Review this user agreement for any unfair or one-sided clauses"
  • "Analyze this app's privacy policy and flag any covert data authorizations"
  • "Does this ToS have auto-renewal traps?"

1. Audit Framework

1.1 Risk Category Definitions

The audit covers seven major risk categories, each with common problem patterns:

IDRisk CategorySeverityDescription
R1Unfair Clauses🔴 HighClauses that exclude or restrict consumers' statutory rights
R2Covert Data Authorization🔴 HighData collection, sharing, or sale beyond what the service requires
R3Auto-Renewal Traps🟠 Medium-HighOpaque auto-renewal mechanisms and cancellation barriers
R4Unilateral Amendment Rights🟠 Medium-HighPlatform reserves the right to modify terms without notice
R5Excessive Liability Disclaimers🟠 Medium-HighOverbroad disclaimers and low liability caps
R6Dispute Resolution Restrictions🟡 MediumMandatory arbitration, class-action waivers, jurisdiction constraints
R7IP Overreach🟡 MediumExcessive rights claimed over user-generated content

1.2 Typical Problem Patterns per Category

R1 Unfair Clauses

Look for these patterns:

  • Unilateral termination rights: Platform may terminate a user's account at any time without cause
  • Asymmetric breach liability: Users face heavy penalties for violations, but the platform's only remedy is a refund—or nothing at all
  • Irrevocable authorizations: Requiring "irrevocable," "perpetual," "worldwide" broad-scope grants from the user
  • Deemed consent: Continued use is treated as agreement to all terms with no option-by-option consent
  • "Final interpretation right" reserved by the platform

Review checklist:

  • Do the terms contain one-sided language such as "we reserve the right" or "we may at our sole discretion"?
  • Are the user's obligations proportionate to the platform's obligations?
  • Are there catch-all "blanket consent" clauses?

R2 Covert Data Authorization

Look for these patterns:

  • Excessive data collection: Collecting data unrelated to the core service (e.g., a calculator app requesting contacts access)
  • Vague third-party sharing: Using terms like "partners," "affiliates," or "third-party service providers" without specifying recipients
  • Opt-out-by-default data collection: Personalized ads and behavioral tracking enabled by default rather than opt-in
  • High opt-out friction: Difficult to disable data collection, or requires toggling off settings one by one
  • Vague data retention periods: No clear retention timeframe, or use of phrases like "as long as necessary"
  • Cross-border data transfers: Inadequate disclosure of where data is stored and transferred

Review checklist:

  • Does the policy follow the principle of data minimization?
  • Are third-party data recipients and purposes specifically listed?
  • Does the user have a meaningful opt-out option?
  • Is the data deletion process clear and actionable?

R3 Auto-Renewal Traps

Look for these patterns:

  • Trial-to-paid auto-conversion: Automatic charges after a free trial ends, with no reminder before the trial expires
  • Complex cancellation process: Canceling requires a phone call, email, or multi-step process, while subscribing takes a single click
  • Early billing window: Renewal is locked in well before expiration (e.g., 24–72 hours ahead)
  • No pro-rata refunds: No partial refund after an auto-renewal charge
  • Silent price changes: Renewal price may change without prior notice

Review checklist:

  • Is auto-renewal prominently disclosed during sign-up or purchase?
  • Is canceling as easy as subscribing?
  • Is there a pre-renewal reminder?
  • Is the refund policy reasonable?

R4 Unilateral Amendment Rights

Look for these patterns:

  • No-notice modifications: Platform reserves the right to change terms at any time without notifying users
  • Continued use equals consent: Continued use after changes is treated as acceptance of the new terms
  • Retroactive effect: New terms apply retroactively to past transactions or behavior

Review checklist:

  • Is there a reasonable notification mechanism for changes (email, in-app message, push notification)?
  • Is there a grace period for users to decide whether to continue using the service?
  • Do material changes require fresh, explicit consent from users?

R5 Excessive Liability Disclaimers

Look for these patterns:

  • Blanket disclaimers: "Under no circumstances shall we be liable for any direct, indirect, incidental, special, or consequential damages"
  • Extremely low liability caps: Caps set at a trivially small amount (e.g., "fees paid in the past 12 months" or a fixed small sum)
  • Core obligation exclusions: Disclaiming liability for defects in the service's core functionality
  • Overbroad force majeure: Classifying system failures or cyberattacks as force majeure events

Review checklist:

  • Is the scope of the disclaimer reasonable?
  • Is the liability cap proportionate to the service fees?
  • Does it exclude liability types that the law does not permit to be disclaimed?

R6 Dispute Resolution Restrictions

Look for these patterns:

  • Mandatory arbitration: All disputes must be resolved through arbitration, with court litigation excluded
  • Class-action waivers: Users are prohibited from joining class actions or class arbitrations
  • Jurisdiction restrictions: Specifying a forum disadvantageous to consumers (e.g., the company's place of incorporation or a foreign court)

Review checklist:

  • Does the consumer retain the right to sue in a local court?
  • Who bears the arbitration costs?
  • Is there a small-claims exception?

R7 IP Overreach

Look for these patterns:

  • Broad content licenses: Requiring users to grant a "worldwide, perpetual, irrevocable, sublicensable" license to their content
  • Uses beyond the service: Platform may use user content for advertising, AI training, or other purposes unrelated to the service itself
  • Rights asymmetry: Platform retains usage rights even after the user deletes content

Review checklist:

  • Is the content license limited to what is necessary to provide the service?
  • Does the platform actually stop using content after account or content deletion?
  • Is commercial resale or sublicensing of user content explicitly excluded?

2. Audit Workflow

2.1 Input Processing

After receiving the terms text submitted by the user, follow these steps:

  1. Identify document type: Determine whether it is a Terms of Service, Privacy Policy, or a combined agreement
  2. Extract key clauses: Categorize and extract relevant passages under the seven risk categories
  3. Analyze each clause: Assess the risk of every extracted clause
  4. Cross-check: Look for contradictions or conflicts between different clauses

2.2 Evaluation Criteria

For each identified risky clause, evaluate three dimensions:

DimensionDescription
SeverityPotential harm to consumer rights (High / Medium / Low)
ConcealmentWhether the clause disguises its true intent through wording or placement (High / Medium / Low)
ActionabilityWhether the consumer has practical means to mitigate the risk (Yes / Limited / None)

3. Output Format: Audit Report

3.1 Report Structure

# Terms of Service Audit Report

## Basic Information
- **Subject**: [Platform / App name]
- **Document Type**: [Terms of Service / Privacy Policy / Combined Agreement]
- **Audit Date**: [Date]

## Overall Rating

[⭐⭐⭐⭐⭐ to ⭐ — five-tier scale]

| Metric | Rating |
|--------|--------|
| Overall Consumer-Friendliness | ⭐⭐⭐ |
| Data Privacy Protection | ⭐⭐ |
| Fee Transparency | ⭐⭐⭐⭐ |
| Clause Fairness | ⭐⭐ |

## Risk Findings

### 🔴 High-Risk (Requires Immediate Attention)

#### Finding 1: [Risk Title]
- **Risk Category**: R1 Unfair Clauses / R2 Covert Data Authorization / ...
- **Original Text**: > [Direct quote from the terms]
- **Risk Analysis**: [Plain-language explanation of why this clause is harmful to consumers]
- **Severity**: High | **Concealment**: High | **Actionability**: None
- **Recommendation**: [Actions the consumer can take]

### 🟠 Medium-High Risk

...(same structure as above)

### 🟡 Medium Risk

...(same structure as above)

## Consumer Action Items

1. [Specific action recommendations, ordered by priority]
2. ...

## Comparison with Industry Peers (if applicable)

[Brief note on whether the clause is standard industry practice]

3.2 Plain-Language Explanation Principles

When analyzing each risk, follow these principles so that ordinary consumers can understand:

  • Lead with the conclusion: What does this clause actually mean for the consumer?
  • Use an analogy: Compare it to an everyday scenario (e.g., "This is like your landlord being allowed to raise your rent at any time without notifying you")
  • End with a recommendation: What can the consumer do about it?

4. Regulatory Reference Framework

The audit references the following regulations (this does not constitute legal advice):

4.1 Chinese Regulations

  • Consumer Protection Law: Focus on fair-trade rights, right to know, right to choose
  • Personal Information Protection Law (PIPL): Data minimization, separate consent, cross-border transfers
  • E-Commerce Law: Auto-renewal disclosure obligations
  • Cybersecurity Law: Data storage and security safeguards
  • SAMR Rules on Regulating Auto-Renewals

4.2 International Regulations (for comparative reference)

  • GDPR (EU): Lawful bases for data processing, data-subject rights
  • CCPA / CPRA (California, US): Consumer privacy rights
  • FTC Consumer Protection Guidelines

5. Common Industry-Specific Risks

5.1 Social Media / UGC Platforms

  • Overbroad user-content licensing
  • Authorization for AI training on user data
  • Content-moderation transparency and the right to appeal

5.2 SaaS / Cloud Services

  • Data export rights and supported formats
  • Compensation mechanisms for service outages
  • Actual handling of data after deletion

5.3 E-Commerce / Subscription Services

  • Auto-renewal and price-change practices
  • Symmetry of return and refund policies
  • Unilateral reduction of membership benefits

5.4 Finance / Payments

  • Account-freeze conditions and the appeals process
  • Notice obligations for fee adjustments
  • Burden of proof in transaction disputes

5.5 Smart Hardware / IoT

  • Scope of device data collection (audio, video, location, etc.)
  • Whether the device remains usable after cloud-service discontinuation
  • Mandatory firmware-update clauses

6. Agent Behavior Guidelines

6.1 Audit Principles

  • Clear stance: Always advocate for the consumer; protecting consumer rights is the top priority
  • Objective citations: Every risk finding must quote the original text—no unsupported speculation
  • Plain language: Write for ordinary consumers; avoid legal jargon, and use everyday analogies when needed
  • Not legal advice: Explicitly state that the audit is for reference only and does not constitute legal counsel

6.2 Workflow

  1. After receiving the terms text, read it in full to understand the overall structure
  2. Scan systematically across all seven risk categories and flag suspicious clauses
  3. Perform an in-depth analysis of each flagged clause, evaluating the three dimensions
  4. Sort findings by severity and produce the structured report
  5. Append consumer action items at the end of the report

6.3 Boundaries and Limitations

  • Do not make final determinations on the legal enforceability of any clause
  • Do not directly advise users to take legal action (but may suggest consulting a lawyer)
  • If the terms text is incomplete or appears to have gaps, note this explicitly in the report
  • Do not over-interpret industry-standard reasonable clauses (e.g., reasonable disclaimers) as risks

レビュー

まだレビューはありません。使ってみた感想をお寄せください。

同じリポジトリのスキル

概要と使いどころ

Creates an Agent Authority Charter for enterprise or regulated AI agents before deployment. Use this Skill when a user needs to define what an AI agent is allowed to do, who delegated authority to it, what actions are permitted or prohibited, when human approval is required, what evidence must be preserved, and how the agent can be suspended, revoked, or escalated.

日本語の概要は準備中です。原文の説明を表示しています。

lawve-ai/awesome-legal-skills8632026年10月3日 更新

EU AI Act Knowledge Engine — authoritative regulatory Q&A grounded in 70 official EU source documents (including the 2026 Commission draft guidelines on Art. 6 high-risk classification — general principles, Annex I, Annex III). Answers any question about the AI Act with article-level citations from the full regulation text, Commission guidelines, EDPB/EDPS opinions, codes of practice, harmonised standards, FRIA guides, incident templates, and sector-specific guidance. This skill should be used when the user asks about the "EU AI Act", "AI Act regulation", "Regulation 2024/1689", "KI-Verordnung", asks to "explain an AI Act article", "what does Article X say", "AI Act requirements", "AI Act penalties", "AI Act timeline", "GPAI obligations", "high-risk AI", "prohibited AI practices", "AI Act and GDPR", "fundamental rights impact assessment", "AI Act standards", "AI Act national implementation", "AI literacy", "serious incident reporting", "Digital Omnibus", "AI regulatory sandbox", or any question about EU artificial intelligence regulation. Also triggers on German terms: "KI-Gesetz", "KI-Verordnung", "Hochrisiko-KI", "KI-Kompetenz", "Grundrechte-Folgenabschaetzung", "GPAI-Verhaltenskodex". For assessment workflows that produce a classification decision rather than a knowledge answer, offer to run a structured risk-tier classification in-session.

日本語の概要は準備中です。原文の説明を表示しています。

lawve-ai/awesome-legal-skills8632026年10月3日 更新

This skill builds a structured audit trail of an AI-assisted task: what the tool was asked to do, what materials it was given, what it produced, how the output was verified, and what was ultimately relied upon. It documents the workflow for supervision and later review without ruling on privilege or disclosure, so the record stays accurate rather than self-serving.

日本語の概要は準備中です。原文の説明を表示しています。

lawve-ai/awesome-legal-skills8632026年10月3日 更新

Use this skill when the user wants an AI governance, legal-risk, privacy, compliance, procurement, or vendor-risk review of an internal AI use case, an AI product feature, an LLM workflow, or a third-party AI vendor. The skill asks intake and clarifying questions first when facts or evidence are missing, identifies required documentation and missing evidence, maps the use case to AI governance frameworks and applicable legal domains, and produces a preliminary or final governance review with scorecards, findings, owners, remediation actions, and follow-up questions.

日本語の概要は準備中です。原文の説明を表示しています。

lawve-ai/awesome-legal-skills8632026年10月3日 更新

Turn an interpretive-ambiguity audit of a legal text — contract, statute, regulation, or judicial opinion — into a polished deliverable. Produces a multi-page website (default), a single-page interactive site, a Microsoft Word document, a PowerPoint deck, or a LaTeX/PDF. Use whenever a user has a stress-test result, ambiguity audit, or "where will this be litigated" scenarios and wants to publish, present, or share them. Triggers on "publish the audit," "make a report from this," "turn this into a website / deck / brief / Word doc," "make a Netlify site," "build slides of these ambiguities," "render the scenarios," "package this stress test," "produce a LaTeX version," and similar. Pairs with the ambiguity-stress-test skill (the underlying analysis) but works on any structured or semi-structured ambiguity analysis. Visual design is opinionated but the user can override colors, fonts, and brand label. Most formats need Python and a writable filesystem; single-file HTML works where the host has neither.

日本語の概要は準備中です。原文の説明を表示しています。

lawve-ai/awesome-legal-skills8632026年10月3日 更新

Adversarially stress-tests a legal text — a contract, statute, regulation, or judicial opinion — for interpretive ambiguity: it finds the seams where the people governed by it will later disagree about what it means and turns each into a concrete dispute scenario with both sides' arguments, the likely outcome, and a fix. Use it whenever someone wants to pressure-test, red-team, audit, or find weak spots, loopholes, gaps, ambiguities, or drafting problems in a legal document; whenever a drafter wants to tighten a contract, statute, regulation, or opinion before it issues; whenever a litigator wants to mine an opinion or contract for arguments; or whenever someone hands over a legal text and asks where it will be fought over or for issue-spotting. Trigger it for contract review, statutory-ambiguity analysis, judicial-opinion scope analysis, and drafting QA — even if the user never says "stress-test" or "ambiguity."

日本語の概要は準備中です。原文の説明を表示しています。

lawve-ai/awesome-legal-skills8632026年10月3日 更新

lawve-ai のスキルをすべて見る

このスキルの問題を報告する