CtrlK
BlogDocsLog inGet started
Tessl Logo
SkillPublic

nzism

Expert New Zealand Information Security Manual (NZISM) advisor for NZ government agencies and their supply chains. Use for NZISM control guidance, gap analysis, agency security obligations, classification framework (Unclassified through Top Secret), security risk management, system certification, and GCSB/NCSC NZ compliance. Triggers on: NZISM controls, NZ government security, GCSB compliance, agency cybersecurity obligations, NZ classification markings, Restricted/Confidential/Secret system scoping, agency security policies, third-party supplier security, Certification and Accreditation (C&A), and any question about NZ government information security requirements or the NZISM framework.

Quality

92%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide
SecuritybySnyk

Passed

No findings from the security scan

SKILL.md
Quality
Evals
Security

Quality

Content

86%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A well-engineered advisory skill body: concrete, citation-safe guidance with clearly sequenced workflows and exemplary progressive disclosure. The residual slack is minor — a few terminology rows and partial duplication of the classification table that could live solely in the reference file.

Suggestions

Trim the Key Terminology table to NZ-specific entries only (drop generic rows like "Need-to-know" and common expansions such as BCP/DRP) to save tokens.

Replace the inline classification-level table with a two-row summary and defer the full table to references/classification-framework.md, which already contains it.

Add an explicit verification step to the gap-analysis workflow (e.g., 'confirm the table covers every applicable section for the stated classification before presenting') to close the workflow-clarity gap.

DimensionReasoningScore

Conciseness

The body is dense and table-driven with no prose padding and no explanation of generic concepts, but the Key Terminology table includes entries Claude already knows ("Need-to-know", BCP/DRP expansions) and the classification table partially duplicates references/classification-framework.md. It is above anchor 3 (only minor trim opportunities, not whole unnecessary sections) but below anchor 5 (not every token earns its place).

4 / 5

Actionability

Guidance is fully concrete and executable for an advisory skill: exact output-table columns, a verified-CID citation rule with real examples (16.1.46.C.02) and an explicit never-invent-IDs fallback, named assurance artifacts (SOC 2 Type II, IRAP, ISO 27001), and stepwise pathways (7-step C&A, 5-step offshore/cloud) with specific control requirements.

5 / 5

Workflow Clarity

The multi-step workflows are clearly sequenced with real gates ("formal risk acceptance by the Accreditation Authority / agency head before go-live", control validation "not documentation alone") and status definitions/checklists, matching anchor 4. It falls short of anchor 5 because there is no explicit validate-then-correct feedback loop on produced outputs (e.g., a completeness check that a gap table covers all applicable sections before presenting it).

4 / 5

Progressive Disclosure

The body is a genuine overview with three real, one-level-deep reference files (verified: no nested references inside them), each signposted with its purpose plus a "When to load reference files" decision list — a textbook match to the top anchor.

5 / 5

Total

18

/

20

Passed

Description

95%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A strong description: third-person, explicit what-and-when structure, and a rich trigger list that covers natural synonyms and abbreviations. The only weakness is that a few capability statements lean on advisory abstractions ("guidance", "compliance") rather than concrete actions.

DimensionReasoningScore

Specificity

The description lists several specific capability areas — "gap analysis", "classification framework (Unclassified through Top Secret)", "security risk management", "system certification" — but several verbs remain advisory abstractions ("control guidance", "compliance") rather than the crisp concrete actions of the top anchor. It sits above anchor 3 because coverage is broad and domain-named, but short of anchor 5's fully concrete action list.

4 / 5

Completeness

It explicitly answers both what ("Expert New Zealand Information Security Manual (NZISM) advisor for NZ government agencies and their supply chains" plus the enumerated services) and when ("Use for..." followed by an explicit "Triggers on:" list), matching the top anchor's pattern of concrete trigger phrases.

5 / 5

Trigger Term Quality

"Triggers on: NZISM controls, NZ government security, GCSB compliance, NZ classification markings, Restricted/Confidential/Secret system scoping, agency security policies, third-party supplier security, Certification and Accreditation (C&A)" gives comprehensive coverage of natural terms, including synonyms, abbreviations, and both plain-language and formal phrasings users would actually say.

5 / 5

Distinctiveness Conflict Risk

The niche is unambiguous — NZ government NZISM/GCSB/NCSC compliance — and every trigger term is specific to that domain, so conflict with other security or compliance skills is minimal.

5 / 5

Total

19

/

20

Passed

Validation

100%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 16 / 16 Passed

Validation for skill structure

No warnings or errors.

Repository

Sushegaad/Claude-Skills-Governance-Risk-and-Compliance

Path

plugins/nzism/skills/nzism/SKILL.md

Reviewed

Table of Contents

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.