privacy-by-design

Use when building apps that collect user data. Ensures privacy protections are built in from the start—data minimization, consent, encryption.

Quality

52%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Passed

No findings from the security scan

Fix and improve this skill with Tessl

tessl review fix ./skills/privacy-by-design/SKILL.md

Quality

Content

46%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The skill covers privacy-by-design comprehensively with good code examples and checklists, but suffers from significant verbosity—explaining concepts Claude already knows (GDPR basics, why minimization matters) and duplicating content (When to Use appears twice, Deep Dive rehashes Core Principles). The monolithic structure would benefit from splitting into a concise overview with references to detailed files for legal frameworks, code examples, and checklists.

Suggestions

Remove the 'Deep Dive: Why It Matters' section entirely—it restates the Core Principles section and explains concepts Claude already understands.

Remove the duplicate 'When to Use' section at the bottom and trim the legal framework descriptions to one-line summaries (Claude knows what GDPR and CCPA are).

Split code examples and legal framework details into separate bundle files (e.g., EXAMPLES.md, LEGAL.md) and reference them from a leaner SKILL.md overview.

Add explicit validation steps to the workflow, such as: 'After implementation, grep logs for PII patterns' or 'Run schema audit to verify purpose/retention annotations are present.'

Dimension	Reasoning	Score
Conciseness	The skill is noticeably verbose. It explains concepts Claude already knows well (what GDPR is, why data minimization matters, what purpose limitation means). The 'Deep Dive: Why It Matters' section rehashes the Core Principles section. The 'When to Use' section appears twice (top and bottom). Legal framework summaries are unnecessary padding for Claude.	2 / 5
Actionability	The skill provides concrete, executable code examples in JavaScript, Python, and SQL with clear BAD/GOOD comparisons. The checklists are actionable. However, some guidance remains at the principle level rather than providing specific implementation patterns (e.g., no concrete retention job implementation, no actual consent management code, no data export endpoint example).	4 / 5
Workflow Clarity	The implementation checklist provides a reasonable sequence of considerations, but there's no clear step-by-step workflow for integrating privacy into a build process. There are no validation checkpoints or feedback loops—for instance, no step to verify that PII isn't leaking in logs after implementation, or to validate schema compliance. Given this involves potentially destructive/batch operations on user data, the lack of validation steps caps this at 3.	3 / 5
Progressive Disclosure	The content is a monolithic ~200-line document with no references to external files. The legal frameworks section, deep dive section, and extensive code examples could be split into separate reference files. There are no bundle files, and the skill doesn't reference any external resources despite having enough content to warrant splitting.	2 / 5
	Total	11 / 20 Passed

Description

58%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description has a clear 'Use when' trigger and identifies the privacy/data protection domain, which is good. However, it describes principles (data minimization, consent, encryption) rather than concrete actions the skill performs, leaving ambiguity about what it actually does. It also uses second-person-adjacent framing and could benefit from more specific trigger terms and clearer action verbs.

Suggestions

Replace abstract principles with concrete actions the skill performs, e.g., 'Generates privacy policies, implements consent flows, adds data encryption layers, and audits data collection practices.'

Add more natural trigger terms and synonyms users might use, such as 'GDPR', 'compliance', 'PII', 'personal data', 'data protection', 'privacy policy', 'cookies'.

Sharpen distinctiveness by clarifying the boundary with related skills (e.g., general security, compliance auditing) and specifying the skill's unique focus area.

Dimension	Reasoning	Score
Specificity	Names the domain (privacy/data protection in apps) and lists a few concrete concepts (data minimization, consent, encryption), but these are more principles than specific actions. It doesn't describe what the skill actually does (e.g., generates privacy policies, adds consent forms, implements encryption code).	3 / 5
Completeness	Has an explicit 'when' clause ('Use when building apps that collect user data') and a 'what' component ('Ensures privacy protections are built in from the start—data minimization, consent, encryption'). However, the 'what' is more about principles than concrete actions the skill performs, making it slightly less explicit than ideal.	4 / 5
Trigger Term Quality	Includes some relevant terms like 'user data', 'privacy', 'data minimization', 'consent', 'encryption', but misses common natural phrases users might say such as 'GDPR', 'compliance', 'personal data', 'privacy policy', 'data protection', 'PII', or 'cookies'.	3 / 5
Distinctiveness Conflict Risk	The focus on privacy and data protection gives it some distinctiveness, but 'building apps that collect user data' is quite broad and could overlap with security skills, compliance skills, or general app development skills. The boundary between this and a general security skill is unclear.	3 / 5
	Total	13 / 20 Passed

Validation

90%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 10 / 11 Passed

Validation for skill structure

Criteria	Description	Result
frontmatter_unknown_keys	Unknown frontmatter key(s) found; consider removing or moving to metadata	Warning

	Total	10 / 11 Passed

Repository: administrakt0r/AI-Agents-Safe-Coding-Skills
Path: skills/privacy-by-design/SKILL.md
Commit: 57c135b

Reviewed: 3 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.