vendor-privacy-policy-first-pass SKILL.md skillA
vendor-privacy-policy-first-pass from legalquants/lq-ai is an agent skill: a SKILL.md folder an AI agent loads when a task calls for it.
mdr add legalquants/lq-ai/vendor-privacy-policy-first-pass@git:20260508.eadedbbPins git:20260508.eadedbb in mdr.lock. Pin the fingerprint instead.
- Audit grade
- A, 17 of 17 checks passed
- Kind
- SKILL.md skill
- Repository
- legalquants/lq-ai
- Path
skills/vendor-privacy-policy-first-pass/SKILL.md- Versions recorded
- 2
- Latest version
- git:20260508.eadedbb, committed May 8, 2026
- First version recorded
- May 8, 2026
- Size
- 17,124 bytes
- Repository stars
- 152
- License
- Apache-2.0
Use when the user has a vendor's published privacy policy (URL, PDF, or pasted text) and wants a fast triage assessment to decide whether deeper diligence is warranted. Produces a short structured report covering what the policy says about key data practices (collection, use, sharing, retention, transfers, rights) plus identification of red flags that warrant escalation to deeper review. Explicitly a first pass, not a full privacy assessment, DPA negotiation, or compliance certification.
Collected from public GitHub. Every version is saved exactly as it was and never changes. Install it at an exact version with the mdr tool, and every file is checked before it reaches your agent. The main file is checked against the SHA-256 fingerprint recorded here, and the others against the fingerprints GitHub keeps for its source commit. The automatic checks below grade the latest version, and the same checks always give the same file the same grade.
What the file says
# Vendor Privacy Policy First Pass Conduct a fast triage assessment of a vendor's privacy policy to help the user decide whether deeper diligence is warranted before sharing data with the vendor. The output is a structured summary plus red-flag identification, not a full privacy assessment. This skill is calibrated for the in-house counsel use case: a vendor has been proposed, the user has limited time, and the question is "does this policy contain anything that would change our decision to proceed, or does it look standard enough that we can move to DPA negotiation and security review?" ## When this skill applies Apply when the user provides a vendor's privacy policy (or what is presented as one) and asks for a quick assessment. Common triggers: - Vendor proposed during procurement; quick read needed before deeper review. - Vendor's published policy used as a baseline for DPA negotiation (the policy describes what the vendor *says* it does; the DPA captures what the vendor *commits* to do). - Periodic re-review of an existing vendor's updated privacy policy. - Pre-meeting prep before a vendor security/privacy review call. Do not apply when: …
Read the whole file at its exact version.
How to install
mdr add legalquants/lq-ai/vendor-privacy-policy-first-pass@sha256:f0c1d380fd602aabThe line at the top of this page pins the label git:20260508.eadedbb, which is what most people want. This one pins the sha256 fingerprint of the contents instead, so it survives a label being moved. Either way the exact version is written to mdr.lock, and mdr install downloads and checks those contents again, so it installs them exactly or stops with an error.
[](https://markdownregistry.com/a/art_jpj3qbs6m2bjea6u)
2 badge image fetches in 30 days. What the badge shows.
Versions
The registry has recorded 2 versions of this file, all committed on May 8, 2026.
| version | committed | commit | size | audit | |
|---|---|---|---|---|---|
| git:20260508.eadedbb latest | 2026-05-08 | eadedbb | 17,124 B | A | view · diff |
| git:20260508.91990ac | 2026-05-08 | 91990ac | 17,126 B | A | view |
Audit of the latest version
- pass: Frontmatter block present
- pass: Frontmatter declares a name
- pass: Frontmatter declares a description
- pass: Size between 200 bytes and 200 KB (17124 bytes)
- pass: No zero-width or bidi control characters
- pass: No instruction hidden inside an HTML comment
- pass: No link to an exfiltration or paste host
- pass: No credential-shaped string
- pass: No instruction to send local credentials anywhere
- pass: No text hidden with inline styles
- pass: No prompt-injection phrasing
- pass: No curl or wget piped into a shell
- pass: No recursive delete of root, home or parent
- pass: No instruction to read or print local credentials
- pass: No base64 blob over 200 characters
- pass: No link to a raw IP address
- pass: No script tag
Source
legalquants/lq-ai · 152 stars · license Apache-2.0 · pushed 2026-10-22 · branch main
API
GET https://markdownregistry.com/api/v1/artifacts/art_jpj3qbs6m2bjea6u GET https://markdownregistry.com/api/v1/resolve?ref=legalquants/lq-ai/vendor-privacy-policy-first-pass GET https://markdownregistry.com/api/v1/blob/f0c1d380fd602aab9e679129ba77a4f97c7240f83584e7528266305f6a1baa8a
Your AI assistant does the legwork. You hear about the deals worth your word. Hand yours the standing instructions at modelranch.com and it joins the network that reads files like this one.
Guides: the SKILL.md format and its required fields · what to check before you install a skill · how to pin a skill to an exact version · where to find agent skills · keeping a team on the same skills · which agent file does what.