# Tools > Every listed resource, editors’ picks first. The filters below can be combined. - Search: append `?q=` to the URL. Separate several keywords with spaces; all of them must match. Matches name, repository, tags, professions, description and README. - Filter by type: append `?type=` to the URL. - Filter by profession: append `?profession=` to the URL. Separate several ids with commas; a resource matches when it suits any of them. Ids are listed at https://hebbmind.com/api/v1/professions - Filter by tag: append `?tag=` to the URL. Separate several tags with commas; a resource must carry all of them. Tags are listed at https://hebbmind.com/api/v1/tags Resources for Full-stack / Indie or ML / AI or Security, Tagged `compliance`: 15 items. > - Full-stack / Indie: General software work: coding-agent workflows, code review, debugging and Git collaboration. > - ML / AI: Model training, evaluation and LLM application development. > - Security: Code audits, vulnerability triage, penetration testing and compliance. - [GDPR Data Handling](https://hebbmind.com/skill/gdpr-data-handling.md): [Skill] EU GDPR compliance skill covering lawful bases, consent management, access and deletion requests, data retention and breach notification, with checklists and sample code so legal and engineering can review privacy together. No account or API key; have a lawyer check conclusions. - [Anthropic Cybersecurity Skills](https://hebbmind.com/skill/anthropic-cybersecurity-skills.md): [Skill] Community-maintained cybersecurity skill library: 800+ skills across 34 domains including threat hunting, incident forensics, penetration testing and cloud security, mapped to MITRE ATT&CK and NIST CSF. Not by Anthropic; offensive skills are for authorized testing only. - [Compliance Tracking](https://hebbmind.com/skill/compliance-tracking.md): [Skill] Compliance skill from Anthropic's official operations plugin: maps controls, owners and evidence for SOC 2, ISO 27001, GDPR, HIPAA and PCI DSS, schedules audits, runs gap analyses, and outputs audit-readiness checklists and evidence collection plans. Have legal or compliance experts review. - [alirezarezvani/claude-skills](https://hebbmind.com/skill/claude-skills.md): [Skill] A collection of 380+ skills across engineering, product, marketing, compliance, finance and executive advisory roles, with many standard-library Python scripts. Claude Code can install them by domain as plugins; works with Codex, Gemini CLI and a dozen other agents. - [Claude Code Skills & Plugins](https://hebbmind.com/plugin/claude-skills.md): [Plugin] Large multi-domain plugin marketplace: 99 plugins bundle hundreds of skills, agents and slash commands covering engineering, marketing, product, project management, regulatory and quality, finance and C-level advisory. Also offers install options for Codex, Gemini CLI and others. - [Prowler](https://hebbmind.com/cli/prowler.md): [CLI] Security baseline and compliance checks for AWS, Azure, GCP, Kubernetes, GitHub, M365 and more, with built-in CIS, NIST, PCI-DSS, SOC 2 and other frameworks. Generates reports or opens a local dashboard. Configure credentials for each cloud account first. - [Presidio CLI](https://hebbmind.com/cli/presidio.md): [CLI] Scans files and directories for personal data such as names, emails and credit card numbers using Presidio Analyzer, with configurable entity types, confidence thresholds and ignore rules. Needs Python 3.10+ and a spaCy language model. - [Privacy Legal](https://hebbmind.com/plugin/privacy-legal.md): [Plugin] Privacy compliance plugin: decides whether processing activities need a PIA or DPIA, generates privacy impact assessments, reviews DPAs from the controller or processor side, and drafts DSAR responses within statutory deadlines. Official from Anthropic. - [AI Governance Legal](https://hebbmind.com/plugin/ai-governance-legal.md): [Plugin] Anthropic's official AI governance plugin: tiers AI use cases against your internal register, runs impact assessments across applicable laws such as the EU AI Act, reviews vendor AI terms for training-data and liability risk, and periodically checks for drift between AI policy and practice. - [Checkov](https://hebbmind.com/cli/checkov.md): [CLI] Static scanner for security and compliance issues in Terraform, CloudFormation, Kubernetes, Helm, Dockerfiles and CI pipeline configs, with over a thousand built-in policies and hard-coded secret detection. Outputs SARIF, JSON and more. Maintained by Prisma Cloud. - [ScanCode Toolkit](https://hebbmind.com/cli/scancode-toolkit.md): [CLI] Scans codebases and dependencies for open-source licenses, copyright notices and package manifests, detecting licenses by full-text matching, with output in JSON, SPDX, CycloneDX and more, for open-source compliance reviews. - [OSS Review Toolkit (ORT)](https://hebbmind.com/cli/ort.md): [CLI] The Linux Foundation's open-source compliance toolchain: analyzes project dependencies, scans licenses and copyrights, checks known vulnerabilities, flags policy violations and generates SBOMs and notice files. Needs Java 25 or Docker and ideally 8 GB RAM; have legal review license findings. - [Awesome Legal Skills](https://hebbmind.com/skill/awesome-legal-skills.md): [Skill] 250+ human-reviewed legal skills from practicing lawyers, in-house counsel and academics, mostly US and EU law: compliance, GDPR, legal research, litigation, contract review and drafting, the EU AI Act. Install all or pick one; output is a draft for a lawyer to review. - [REUSE Tool](https://hebbmind.com/cli/reuse-tool.md): [CLI] Official FSFE command-line tool that checks every file in a project for copyright and license information per the REUSE spec, adds headers in bulk, downloads license texts and generates an SPDX bill of materials. Needs Python; have legal review the results. - [Vanta](https://hebbmind.com/plugin/vanta-mcp-plugin.md): [Plugin] Vanta's official plugin: from Claude Code, review control gaps for SOC 2, ISO 27001 and other frameworks, failing tests, vendor risk and policies, and generate fixes for code-level issues. Needs admin access to a paid Vanta account (browser auth); have compliance conclusions reviewed by an expert.