CtrlK
BlogDocsLog inGet started
Tessl Logo
SkillPublic

ccpa

California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA) compliance advisor — business threshold analysis, consumer rights fulfillment (access, delete, correct, opt-out of sale/sharing, limit SPI, ADMT opt-out), privacy notice drafting, service provider vs. contractor vs. third-party classification, sensitive personal information (SPI) handling, data minimization, opt-out mechanisms (including GPC), cybersecurity audits and risk assessments (live since Jan 1, 2026), ADMT obligations (effective 2026, deadline Jan 1, 2027), CPPA enforcement (Disney $2.75M, PlayOn $1.1M, Ford $375K), penalty exposure, GDPR comparison, and gap assessments for businesses operating in or targeting California residents.

Quality

77%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide
SecuritybySnyk

Passed

No findings from the security scan

Fix and improve this skill with Tessl

tessl review fix ./plugins/ccpa/skills/ccpa/SKILL.md
SKILL.md
Quality
Evals
Security

Quality

Content

71%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

An unusually actionable legal-compliance body: exact figures, deadlines, statutory citations, and per-right step tables that make answers concrete. Its weaknesses are redundancy — basics Claude already knows plus heavy duplication of content that already lives in the reference files — which hurts both conciseness and the progressive-disclosure split.

Suggestions

Remove the inlined per-right workflow tables and identity-verification detail from the body, keeping only a summary plus a pointer to references/consumer-rights-workflows.md, since that file already covers them.

Cut the "Key Definitions" section or reduce it to only CPRA-specific additions (SPI, sharing, contractor) — the general PI/sale/third-party definitions are concepts Claude already knows.

Collapse the GDPR-comparison section in the body to the structural-difference bullets and delegate the rest to references/ccpa-gdpr-comparison.md to avoid maintaining the same content twice.

DimensionReasoningScore

Conciseness

The precise, time-sensitive material (Regs §§7060–7062 verification tiers, §7050(c) CCBA rule, 2026 enforcement and legislation updates) earns its place, but the body restates basics Claude already knows (e.g., "Personal Information (PI): Information that identifies, relates to..." and the basic rights list) and duplicates content that lives in the reference files (identity-verification tiers and right-to-know details appear both inline and in references/consumer-rights-workflows.md).

3 / 5

Actionability

Guidance is fully concrete and executable for an advisory skill: exact thresholds ("$25 million", "100,000 or more", "50% or more"), exact deadlines ("45 days (+ 45-day extension)", "15 business days", "January 1, 2027"), exact verification standards ("match at least 2 data points", "3 data points PLUS a signed declaration under penalty of perjury"), numbered step tables per right, and explicit answer requirements ("State this rule explicitly in any ad-tech classification answer").

5 / 5

Workflow Clarity

Applicability and each consumer right have clearly sequenced numbered workflows with checkpoint-like steps ("Check whether any exception applies; document reasoning if invoking one"; "Document the determination — ... reassessed annually"), but there are no error-recovery feedback loops beyond the single §7022(f) verification-failure rule, so it falls short of the top anchor.

4 / 5

Progressive Disclosure

The two reference files are real, one level deep, and clearly signaled in a dedicated "Reference Files" section, but the body fully inlines consumer-rights workflows and a GDPR comparison section that duplicate references/consumer-rights-workflows.md and references/ccpa-gdpr-comparison.md — content that clearly belongs in the separate files is inlined.

3 / 5

Total

15

/

20

Passed

Description

71%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A highly specific, well-scoped description that names concrete capabilities across the CCPA/CPRA domain with strong distinctiveness. Its main weakness is the missing explicit "Use when..." trigger clause, which leaves the invocation condition weakly implied and caps completeness.

Suggestions

Add an explicit trigger clause, e.g. "Use when the user asks about CCPA, CPRA, California privacy law compliance, consumer rights requests, or whether their business must comply with California privacy rules."

Include common natural variations such as "California privacy law", "Proposition 24", and "Do Not Sell or Share" so the description matches how users actually phrase requests.

Trim the enforcement-dollar detail ("Disney $2.75M, PlayOn $1.1M, Ford $375K") from the description — it signals currency but adds tokens without improving triggering.

DimensionReasoningScore

Specificity

The description lists multiple concrete capabilities — "business threshold analysis", "consumer rights fulfillment (access, delete, correct, opt-out of sale/sharing, limit SPI, ADMT opt-out)", "privacy notice drafting", "service provider vs. contractor vs. third-party classification" — giving comprehensive, specific coverage of the domain rather than vague claims.

5 / 5

Completeness

The "what" is clear and comprehensive, but there is no "Use when..." clause or equivalent; the only when-like phrase ("for businesses operating in or targeting California residents") scopes the client rather than explicitly guiding when to invoke the skill, so completeness is capped at 3.

3 / 5

Trigger Term Quality

Natural statutory keywords users would actually say are present ("CCPA", "CPRA", "consumer rights", "opt-out", "GDPR comparison", "California residents"), but common variations like "California privacy law", "Proposition 24", "data broker registration", or "Do Not Sell" are missing.

4 / 5

Distinctiveness Conflict Risk

The CCPA/CPRA advisor niche is unmistakable ("California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA) compliance advisor"), but the "GDPR comparison" mention creates minor overlap risk with a dedicated GDPR skill.

4 / 5

Total

16

/

20

Passed

Validation

100%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 16 / 16 Passed

Validation for skill structure

No warnings or errors.

Repository

Sushegaad/Claude-Skills-Governance-Risk-and-Compliance

Path

plugins/ccpa/skills/ccpa/SKILL.md

Reviewed

Table of Contents

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.