skills/statute-analysis-rafal-fryc/SKILL.md
Guide for reading, interpreting, and applying statutes, regulations, and rules in legal and compliance contexts. Use when the user asks about (1) how to read and interpret statutes, regulations, or rules, (2) statutory interpretation methods and canons of construction, (3) understanding legislative intent, (4) applying statutes to specific legal situations, (5) extracting requirements from legal text, (6) distinguishing between different types of legal requirements, or (7) cross-jurisdictional compliance analysis.
npx skillsauth add lawvable/awesome-legal-skills statute-analysis-rafal-frycInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
Use this skill when the user asks about:
| Type | Created By | Characteristics | |------|------------|-----------------| | Statute | Legislature (Congress, state legislature) | Formal written enactment; commands, prohibits, or declares policy; provides framework | | Regulation | Government agency | Implements statutes; more detailed than statutes; has force of law | | Rule | Government agency or court | Another term for regulation (administrative rules) or procedural requirements |
Key Insight: Statutes give agencies authority to create regulations. Always read BOTH the statute AND implementing regulations for complete understanding. The regulation often contains the operational details that the statute leaves to agency discretion.
Before analyzing any statute:
Lesson: The statute as passed may not be the statute as implemented. A statute with a future effective date may be amended before taking effect.
Lesson: The same statutory language can mean different things depending on who enforces it.
State statutes are organized by topic and subtopic. Before diving into specific sections:
Every word has meaning. Find the definitions section first and reference it constantly.
Practical Tip: Create a reference sheet of key definitions before analyzing substantive provisions.
Statutes are dense. Every word AND punctuation mark has meaning.
These words have consistent legal functions across all statutes:
| Term | Meaning | |------|---------| | Shall | Mandatory—you are REQUIRED to do this | | May | Permissive—you are ALLOWED to do this | | And | Conjunctive—ALL elements must be satisfied | | Or | Disjunctive—ANY ONE element is sufficient | | Unless / Except | Signals an exception to the general rule | | Subject to | This provision is limited by another section | | Notwithstanding | This provision applies DESPITE what other sections say | | If...then / Upon / Provided that | A precondition must be satisfied | | Means | Exhaustive definition follows | | Includes | Examples follow (may not be exhaustive) |
Critical Warning: Misreading "and" as "or" or "shall" as "may" fundamentally changes a provision's meaning.
When you encounter references to other statutes or sections:
When language is ambiguous, use these established methods:
Plain Meaning Rule: Courts assume words mean what an ordinary person would understand. If clear and unambiguous, no further inquiry is needed.
Dictionary Definitions: Compare multiple dictionaries for consensus. Use legal dictionaries for technical terms, general dictionaries for common terms.
Textual Canons:
| Canon | Meaning | |-------|---------| | General-Terms Canon | General terms get their full scope without arbitrary limitation | | Negative-Implication Canon (Expressio Unius) | Expressing one thing implies exclusion of others | | Whole-Act Rule | Construe the text as a coherent whole | | Consistent Usage Presumption | Same word used repeatedly has the same meaning | | Meaningful Variation | Different terms presumably have different meanings | | Surplusage Canon | Every word should have meaning; avoid rendering words superfluous | | Associated Words Canon (Noscitur a Sociis) | Words grouped together inform each other's meaning | | Ejusdem Generis | General terms following specific ones are limited to the same class |
Purpose Canons:
| Canon | Application | |-------|-------------| | Presumption Against Ineffectiveness | Favor interpretations that further the statute's purpose | | Avoiding Absurdity | Reject interpretations producing absurd results | | Remedial Statutes | Liberally construe to achieve remedial purpose | | Rule of Lenity | Penal statutes strictly construed in favor of defendant |
When extracting requirements, categorize by type:
| Type | Examples | Implementation | |------|----------|----------------| | Disclosure | Privacy notices, warning labels, terms | Legal/policy team; document publication | | Operational | Response deadlines, internal processes | Compliance team; process design | | Technical | System requirements, security standards | Engineering team | | UI/Design | Link placement, font size, button design | Product/design team |
Key Insight: A "privacy policy requirements" checklist should not include operational deadlines that never appear in the policy itself. Separate WHAT must be disclosed from HOW the business must operate.
Most state statutes defer to federal sector-specific laws:
Some entities have delayed compliance deadlines rather than permanent exemptions. Track WHEN the grace period ends.
Before extracting requirements, determine WHO must comply:
| Type | Examples | |------|----------| | Revenue | Annual gross revenue > $X million | | Volume | Process data of > X consumers/transactions | | Revenue from Activity | Derive X% of revenue from [regulated activity] | | Entity Type | Applies to [developers/controllers/operators] |
Lesson: A statute requiring "$25M revenue AND 100K consumers" is far more limited than one requiring either condition.
When analyzing multiple related statutes:
Practical Approach: Identify the most protective standard as a baseline; note where others are more permissive.
| Factor | Questions to Ask | |--------|------------------| | Enforcement Authority | Who can enforce? AG only? Private parties? Agency? | | Penalties | Civil, criminal, or administrative? Amount? | | Cure Period | Opportunity to fix before penalties? | | Private Right of Action | Can individuals sue? | | Enforcement History | Is the agency actively enforcing? |
Lesson: Two requirements with identical language may have vastly different practical importance depending on enforcement dynamics.
Compare against typical provisions to identify notable absences:
Lesson: The absence of a remedy or protection is often as significant as what is included.
Keep these principles in mind:
Internal Consistency: Statutes are written to be consistent, not contradictory. If your interpretation creates a conflict, reconsider.
Avoiding Absurdity: Statutes are written to make sense. If your interpretation leads to an absurd result, it's probably wrong.
Purposive Reading: Consider what problem the legislature was trying to solve. Interpretations that further that purpose are preferred.
See references/index.md for detailed documentation including:
development
Perform language and framework specific security best-practice reviews and suggest improvements. Trigger only when the user explicitly requests security best practices guidance, a security review/report, or secure-by-default coding help. Trigger only for supported languages (python, javascript/typescript, go). Do not trigger for general code review, debugging, or non-security tasks.
development
Expert CMMC 2.0 (Cybersecurity Maturity Model Certification) advisor for US defense contractors and subcontractors in the Defense Industrial Base (DIB). Use this skill whenever a user asks about CMMC 2.0, CMMC Level 1, Level 2, or Level 3, DoD cybersecurity compliance, NIST SP 800-171, CUI (Controlled Unclassified Information) protection, System Security Plan (SSP), Plan of Action & Milestones (POA&M), C3PAO assessments, DIBCAC audits, self-assessment, SPRS score, or any requirement under DFARS 252.204-7012 or 7021. Also trigger for: "CMMC gap analysis", "CMMC readiness", "FCI protection", "CUI scoping", "CMMC practices", "DoD contract cybersecurity", "defense supply chain security", or "prime contractor flow-down requirements".
tools
Build a client instruction schedule — a plain-English, Scott Schedule-style Word table that gathers a struggling client's evidence and instructions issue by issue, with a one-page covering note. Use whenever the user asks for a "client instruction schedule", "instruction schedule", "client questionnaire", "schedule of questions for the client", "get instructions from the client on the papers", or says the client is overwhelmed and needs the case broken into manageable questions. Also trigger when asked to turn case papers into a structured request for client input. Do NOT use for court-facing Scott Schedules, pleadings, witness statements, or advice letters — this skill produces a client-facing working document only. Output is always a .docx draft for solicitor review, never a final document.
tools
Turn complex legal analysis into clear, commercially useful client-facing advice. Use this whenever the user has dense legal material — drafting, internal analysis, counsel notes, research memos, pleadings, a case update, or correspondence — and wants it converted into something a client can actually understand and act on. Trigger on phrases like 'explain this to the client', 'put this in plain English', 'translate this for a non-lawyer', 'turn this into client-facing advice', 'make this client-ready', 'draft a client update', or when the user shares legal analysis and asks 'what does this mean for them'. Also trigger when the user wants a board summary, litigation risk update, or call script derived from legal material. The skill preserves legal nuance, uncertainty, and risk rather than oversimplifying — it makes advice usable, not just simpler.