CtrlK
BlogDocsLog inGet started
Tessl Logo

gdpr-data-handling

Implement GDPR-compliant data handling with consent management, data subject rights, and privacy by design. Use when building systems that process EU personal data, implementing privacy controls, or conducting GDPR compliance reviews.

81

1.25x
Quality

72%

Does it follow best practices?

Impact

98%

1.25x

Average score across 3 eval scenarios

SecuritybySnyk

Passed

No findings from the security scan

Fix and improve this skill with Tessl

tessl review fix ./tests/ext_conformance/artifacts/agents-wshobson/hr-legal-compliance/skills/gdpr-data-handling/SKILL.md

The canonical home for this skill is gdpr-data-handling in wshobson/agents

SKILL.md
Quality
Evals
Security

Quality

Content

57%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The skill delivers rich, mostly-executable code across the core GDPR patterns, but it is a long monolithic document that restates some known concepts and lacks explicit validation feedback loops for its destructive/batch operations. Splitting patterns into reference files and adding verification steps would meaningfully raise quality.

Suggestions

Add explicit validation/verification checkpoints to destructive and batch workflows — e.g. after erasure, confirm deletion per data source and report any mismatches; before retention enforcement, dry-run the cutoff and log what would be deleted/anonymized.

Move the five large code patterns into separate reference files under references/ (e.g. consent.md, dsar.md, retention.md) and keep SKILL.md as a concise overview with one-level-deep links, improving progressive disclosure and token efficiency.

Trim the Core Concepts section to GDPR-specific details Claude would not already know (Article numbers, the 1-month / 72-hour deadlines, the explicit-consent distinction for Art. 9/10) rather than restating basic personal-data categories and lawful bases.

DimensionReasoningScore

Conciseness

Mostly efficient with substantial executable code, but the Core Concepts section restates basic GDPR knowledge Claude already has (data categories, Article 6 lawful bases, Article 15-21 rights) and the overall ~600-line body could be tightened.

3 / 5

Actionability

Provides mostly executable, copy-paste-ready class implementations for consent, DSAR, retention, privacy-by-design, and breach handling, with minor gaps where helper methods (notify_dpo, get_request, generate_request_id) are referenced but not defined.

4 / 5

Workflow Clarity

Sequences are present (submit → verify → process → collect → format → update), but destructive and batch operations (erasure deletion, retention enforcement loops) lack explicit validation/verification checkpoints and feedback loops, which caps this dimension at 3 per the rubric.

3 / 5

Progressive Disclosure

The body has clear section headers and organization, but all five large code patterns and reference material are inlined in a single ~600-line file with no bundle files and no signaling to separate reference documents, so content that should be split stays inline.

3 / 5

Total

13

/

20

Passed

Description

87%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A strong, well-structured description that explicitly states both capabilities and use-when triggers with natural keyword coverage. Minor gains are possible by adding common synonyms and framing capabilities as discrete actions.

DimensionReasoningScore

Specificity

Names several concrete capabilities — 'consent management, data subject rights, and privacy by design' — but these are domains rather than the discrete granular actions (e.g. 'record consent', 'process erasure requests') that would warrant a 5.

4 / 5

Completeness

Clearly answers both what ('Implement GDPR-compliant data handling with consent management, data subject rights, and privacy by design') and when ('Use when building systems that process EU personal data, implementing privacy controls, or conducting GDPR compliance reviews') with concrete trigger phrases.

5 / 5

Trigger Term Quality

Good natural-term coverage including 'GDPR', 'EU personal data', 'consent management', 'privacy controls', and 'GDPR compliance reviews', though common synonyms like 'data protection' or 'right to be forgotten' are absent.

4 / 5

Distinctiveness Conflict Risk

The GDPR/EU-personal-data niche is specific with distinct triggers, giving minimal overlap risk with general privacy or security skills.

5 / 5

Total

18

/

20

Passed

Validation

93%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation15 / 16 Passed

Validation for skill structure

CriteriaDescriptionResult

skill_md_line_count

SKILL.md is long (631 lines); consider splitting into references/ and linking

Warning

Total

15

/

16

Passed

Repository
Dicklesworthstone/pi_agent_rust
Reviewed

Table of Contents

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.