# Compliance Check

> Check compliance status for a Meta app — surfaces open required actions, active violations, and recommendations with remediation guidance. Use to audit compliance posture or resolve compliance blockers.

- Skill: `facebook/compliance-check` (Agent Skill)
- Install (CLI): `npx skillmds@latest add facebook/compliance-check`
- Raw SKILL.md: https://api.skillmd.com/api/skills/facebook/compliance-check/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- License: MIT
- Author: facebook (https://skillmd.com/u/facebook)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/facebook/compliance-check

---


# Compliance Check

Audit the compliance posture of a Meta app and provide remediation guidance.

## Workflow

1. **Start tracking.** Before any other work, call `devtools_skill_invocation` with action `start` and `skill_name` `compliance-check`. Pass `skill_name` `compliance-check` on every `devtools_*` tool call in the following steps.

2. **Identify the app.** Ask the user for the app **name or ID**. If they give a name (or aren't sure of the ID), call `devtools_app_list` (action `list`) and resolve it to an `app_id` — match the name case-insensitively. If several apps match or it's ambiguous, show the candidates (name, ID, viewer role) and ask the user to pick. If they give a numeric ID, use it directly.

3. **Collect data in parallel:**
   - `devtools_compliance` with action `status` — full compliance status
   - `devtools_app` with action `basic_settings` — app context (name, category, status)
   - `devtools_app` with action `data_protection_officer` — DPO contact info

4. **Analyze compliance status.** Categorize findings by severity:

   **Violations** (critical — may result in app restrictions or removal)
   - What the violation is
   - When it was flagged
   - What action is required
   - Deadline for resolution

   **Required Actions** (high — must be completed by deadline)
   - Description of the required action
   - Deadline
   - Steps to complete

   **Recommendations** (low — suggested improvements)
   - What's recommended and why
   - How to implement

5. **Produce the compliance report:**

   ### Report Format

   **App Overview**
   - App name, ID, category

   **Compliance Score**
   - Overall status: COMPLIANT / ACTION REQUIRED / VIOLATION
   - Count of items by severity

   **Violations** (if any)
   - Each violation with description, deadline, and remediation steps

   **Required Actions** (if any)
   - Each action with description, deadline, and steps to complete

   **Recommendations** (if any)
   - Each recommendation with description and implementation guidance

   **Data Protection Officer**
   - Current DPO contact info
   - Flag if DPO info is missing or incomplete

   **Action Plan**
   - Prioritized list: violations first, then required actions by deadline, then recommendations
   - For each item, provide specific steps the developer can take

6. **Suggest follow-ups:**
   - If violations exist: emphasize urgency and potential consequences
   - If DPO info is missing: explain why it matters and how to set it up
   - If app review is blocked by compliance: suggest `/app-review-prep` after resolving issues

7. **End tracking.** After completing all preceding steps, call `devtools_skill_invocation` with action `end` and `skill_name` `compliance-check`.

## Tips

- Compliance deadlines are hard deadlines — missing them can result in app restrictions.
- Some compliance items require changes in the Meta Developer Dashboard that can't be done via API. Flag these clearly as "manual action required in Developer Dashboard."
- If the app is fully compliant, keep the report brief and congratulatory.