CtrlK
BlogDocsLog inGet started
Tessl Logo
SkillPublic

gdpr-audit-prep

/compliance-os:gdpr-audit-prep [scope] — GDPR audit 6-question Article-cited forcing interrogation. Use before annual internal GDPR review, post-breach internal audit, DPA investigation readiness, or acquisition due diligence.

64

Quality

81%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide
SecuritybySnyk

Passed

No findings from the security scan

SKILL.md
Quality
Evals
Security

Quality

Content

76%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A highly actionable, well-structured audit skill with concrete commands, article-cited questions, and a complete output template. Its weakest area is the workflow: the four steps run sequentially with no validation checkpoints, error handling, or mapping of script outputs to the final verdict.

Suggestions

Add validation checkpoints to the Workflow (e.g., after each script run, state what output to inspect and what to do on failure or missing input files), so the sequence earns a feedback loop rather than bare step listing.

Specify how the four script outputs map into the Output Format template and the final 🟢/🟡/🔴 verdict (e.g., which checker fields drive which report sections), so Claude knows how to translate results into the report.

Trim enumerations of knowledge Claude already has (the Article 6 lawful-basis options and Article 35(7) element list) down to the audit-specific deltas (e.g., 'verify exactly ONE basis per purpose is recorded; flag multiple-basis claims').

DimensionReasoningScore

Conciseness

The body is dense and checklist-driven with no concept padding (no explanation of what GDPR is), but it enumerates details Claude already knows ("Six options: consent / contract / legal obligation...", the Article 35(7) element list), which are minor instances of over-explanation that could be trimmed; it is not a 5 for that reason and not a 3 because those lists double as audit checklists so most tokens earn their place.

4 / 5

Actionability

The workflow provides copy-paste-ready commands with concrete arguments, the six questions specify exactly what to demand and cite, and the output format is a fully specified template; this covers the common cases the skill targets.

5 / 5

Workflow Clarity

The Workflow section lists a clear numbered sequence (posture check, DPIA, DSAR validation, cross-framework mapping) but has no validation checkpoints at all: no guidance on verifying script output, handling script failure, or how findings feed the verdict. This matches the 'steps listed but validation gaps' anchor rather than 'most checkpoints present'.

3 / 5

Progressive Disclosure

Sections are well organized (When to Run, Six Questions, Workflow, Output Format, Routing, Related) with detail-heavy material (playbook, agent definition, sibling skills) clearly signaled via one-level-deep links in the Related section and no nested references. It is not a 5 because some inline content (the long output template and per-question checklists) could live in a reference file, and no bundle files exist to verify the referenced vendor paths resolve.

4 / 5

Total

16

/

20

Passed

Description

78%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A strong, well-scoped description that clearly states what the skill does and when to use it with multiple concrete trigger scenarios. Its main gaps are limited action enumeration (one composite action rather than several) and missing common synonym triggers like RoPA or DSAR.

DimensionReasoningScore

Specificity

The description names the domain and one concrete composite action ("6-question Article-cited forcing interrogation") but does not enumerate several distinct specific actions, matching the 'names domain and 1-2 concrete actions' anchor rather than the 'lists several specific actions' anchor.

3 / 5

Completeness

It explicitly answers both what ("GDPR audit 6-question Article-cited forcing interrogation") and when ("Use before annual internal GDPR review, post-breach internal audit, DPA investigation readiness, or acquisition due diligence") with concrete trigger phrases, matching the top anchor; it is not a 4 because the 'when' clause is explicit and enumerates multiple concrete scenarios rather than being loosely stated.

5 / 5

Trigger Term Quality

Natural trigger phrases like "GDPR audit", "annual internal GDPR review", "post-breach internal audit", "DPA investigation readiness", and "acquisition due diligence" are present, but common variations users would say (RoPA, DSAR, privacy compliance review) are missing, so it falls just below comprehensive coverage.

4 / 5

Distinctiveness Conflict Risk

The GDPR/DPO audit niche and its triggers (DPA investigation, breach audit) are clearly distinct from general skills, but the generic "audit" trigger overlaps with closely related sibling audit-prep skills in the same plugin family, indicating minor overlap risk rather than minimal.

4 / 5

Total

16

/

20

Passed

Validation

93%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

CriteriaDescriptionResult

relative_links

Relative link issues: 2 missing, 2 deeper-than-1-level, 1 suspicious

Warning

Total

15

/

16

Passed

Repository

alirezarezvani/claude-skills

Path

compliance-os/skills/gdpr-audit-prep/SKILL.md

Reviewed

Table of Contents

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.