An agent skill for auditing OneTrust / CookiePro cookie-consent implementations in a real browser. Point it at a URL and it verifies the consent banner end to end the way a human tester would — banner display, preference center, toggles, the consent cookie, and persistence — then reports pass/fail per test point with screenshot evidence.
It was built from a live audit of Penn Today and generalized from there: OneTrust banners are tenant-configured (button labels, category names, and copy vary per site), so the skill locates every control from the live page instead of assuming defaults.
- Banner (P0) — fresh-visit render, accept-all behavior (banner dismisses, consent cookies written), preference center opens
- Preference center (P1) — category tabs render, toggles flip, Strictly Necessary is locked "Always Active", the saved consent cookie matches the toggles exactly, the choice persists across reload, and Allow All grants everything
- Reopen path (P2) — a footer "Manage Cookies" / "Cookie Settings" link reopens the preference center
- Observations (P3) — layout, focus handling after the modal closes, reject-button prominence (explicit opt-out vs implied consent), and GPC flag values
Plus the two gotchas that most often produce false audit results:
- The banner only renders without prior consent. A leftover
OptanonAlertBoxClosedcookie makes a working banner look broken. The skill manages fresh-visitor state explicitly, and treats cookie resets as logged environment preparation — never as a mid-test workaround. - Hidden DOM ≠ closed. OneTrust keeps the preference center node in the DOM (hidden) after it closes. The skill verifies with computed style and screenshots, not DOM presence.
Copy the onetrust-audit/ folder into your skills directory:
git clone https://github.com/upenn/onetrust-audit-skill.git
cp -R onetrust-audit-skill/onetrust-audit ~/.agents/skills/ # personal — available in every project
# or, for a single project:
cp -R onetrust-audit-skill/onetrust-audit <project>/.agents/skills/Claude Code and compatible agents discover skills in .agents/skills/ (project) and ~/.agents/skills/ (personal).
The skill drives whatever browser automation the session provides (a browser MCP or built-in browser tools) and works strictly black-box: real clicks on real controls, read-only DOM/network/cookie checks, and screenshots as evidence. It never injects scripts to trigger behavior.
The skill triggers whenever you ask about a cookie banner, consent banner, cookie preferences, "Manage Cookies", or OneTrust — including vague asks like "does our banner still work?". You can also invoke it explicitly:
/onetrust-audit Test the cookie banner on https://penntoday.upenn.edu
/onetrust-audit Audit the consent banner on our staging site before launch
Did we break cookie preferences in the redesign?
An interleaved markdown report with screenshots inline next to their verdicts:
- Per test point: ✅ pass / ❌ fail /
⚠️ observation, with reproduction steps for failures and the screenshot path for every verdict - Cookie evidence: the decoded
OptanonConsentgroups string placed directly beside the UI state it is supposed to reflect (e.g., Performance toggled off →C0002:0) - Console errors with the step at which each occurred
- Environment-prep log — what was reset, when, and why
- A bottom-line answer first, supporting detail after
It also flags compliance-relevant design choices without judging them for you — for example, a banner offering only "Accept" plus "Manage Cookies" with implied-consent wording ("continued use constitutes agreement") is a common US-market pattern, but GDPR-style regimes expect an equally prominent reject option. And if the site turns out not to run OneTrust at all, the skill identifies the actual consent platform (Cookiebot, TrustArc, Ketch, custom, …) and reports that rather than forcing a OneTrust-shaped audit.
onetrust-audit/
└── SKILL.md # OneTrust internals, black-box rules, P0–P3 protocol, cookie reference, report format
- This skill tests whether an implementation works as configured; it is not legal advice and does not determine regulatory compliance on its own.
- OneTrust and CookiePro are trademarks of OneTrust LLC. This is an independent testing methodology and is not affiliated with or endorsed by OneTrust.
- Verified against OneTrust's 202606 banner template; the SDK's versioned script templates change over time, so the skill keys on stable surfaces (cookies, network hosts, user-visible controls) wherever possible.
Corrections welcome — especially when OneTrust changes its SDK behavior or cookie names in ways that break a check. Open an issue or pull request describing what you observed, on what site and banner version, and include the console/DOM evidence if you can.