CtrlK
BlogDocsLog inGet started
Tessl Logo

803-regulations-gdpr

Use when reviewing, designing, or modifying Java enterprise systems that process personal data and need GDPR-aware engineering controls. This should trigger for requests such as Review a Java service for GDPR privacy controls; Design data-subject rights workflows; Add retention, deletion, pseudonymization, or privacy-safe logging; Assess data transfer, DPIA, breach evidence, or processor/controller boundary concerns before production release. Part of Plinth Toolkit

64

Quality

76%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

SecuritybySnyk

Passed

No findings from the security scan

Fix and improve this skill with Tessl

tessl review fix ./skills/803-regulations-gdpr/SKILL.md
SKILL.md
Quality
Evals
Security

Quality

Content

52%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

This is a well-structured governance/review skill with a clear workflow and good progressive disclosure to reference files, but it suffers from significant verbosity — repeating the same lists of data stores, stakeholders, and disclaimers across multiple sections. The skill would benefit greatly from concrete Java code examples inline rather than deferring all implementation patterns to reference files, and from aggressive deduplication of repeated content.

Suggestions

Deduplicate repeated lists (e.g., 'logs, caches, search indexes, backups, exports' appears 5+ times) — define the list once and reference it, or trust Claude to understand the scope from a single mention.

Add at least 2-3 inline Java code snippets showing key patterns (e.g., a minimal DTO example, a privacy-safe logging configuration, a deletion job skeleton) rather than deferring all examples to reference files.

Remove or consolidate the multiple 'not legal advice' disclaimers — state it once prominently rather than weaving it through multiple sections.

Add an explicit feedback loop in the workflow for when review findings invalidate earlier questionnaire answers or when blocking issues are discovered mid-review.

DimensionReasoningScore

Conciseness

The skill is significantly verbose, with extensive repetition of concepts (e.g., the 'not legal advice' disclaimer appears multiple times, the list of personal data stores/logs/caches/indexes/backups/exports is repeated nearly verbatim across multiple sections). Many constraints restate what Claude already knows about GDPR principles. The scope section largely duplicates the opening paragraph. The skill could be cut by 40-50% without losing actionable content.

2 / 5

Actionability

The workflow provides a structured process with specific file references and a 6-step sequence, but lacks any concrete code examples, commands, or executable snippets. For a Java-focused skill, there are zero Java code samples inline — all are deferred to reference files. The guidance remains at the level of 'review X, check for Y' rather than showing specific patterns or implementations directly.

3 / 5

Workflow Clarity

The 6-step workflow is clearly sequenced with explicit prerequisites (step 1 must complete before proceeding), a checkpoint in step 2 (all 22 questions must have evidence or Unknown before proceeding), and a structured output via report template. However, there's no explicit error recovery or feedback loop — e.g., what happens if the review reveals the questionnaire answers were wrong, or if the report reveals blocking issues. The validation is mostly implicit.

4 / 5

Progressive Disclosure

The skill appropriately references external files (chapters summary, engineering examples, questionnaire, report template) with clear paths and purposes. References are one level deep and well-signaled. However, since no bundle files were provided for verification, and the inline content is still quite long with material that could be further offloaded to references, it loses a point. The structure between overview, constraints, workflow, and references is well-organized.

4 / 5

Total

13

/

20

Passed

Description

100%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

This is an excellent skill description that clearly defines its scope at the intersection of Java enterprise development and GDPR compliance engineering. It provides comprehensive trigger terms, explicit 'Use when' guidance with concrete example requests, and enough specificity to be highly distinguishable from other skills. The description is well-structured and actionable for skill selection.

DimensionReasoningScore

Specificity

The description lists multiple specific concrete actions: reviewing Java services for GDPR controls, designing data-subject rights workflows, adding retention/deletion/pseudonymization/privacy-safe logging, and assessing data transfer/DPIA/breach evidence/processor-controller boundaries. This is comprehensive coverage of the skill's capabilities.

5 / 5

Completeness

The description explicitly answers both 'what' (reviewing/designing/modifying Java enterprise systems with GDPR-aware engineering controls) and 'when' with a clear 'Use when' clause and concrete trigger phrases like 'Review a Java service for GDPR privacy controls' and 'Design data-subject rights workflows'. The 'This should trigger for requests such as' section provides explicit examples.

5 / 5

Trigger Term Quality

Excellent coverage of natural trigger terms including 'GDPR', 'privacy controls', 'data-subject rights', 'retention', 'deletion', 'pseudonymization', 'privacy-safe logging', 'data transfer', 'DPIA', 'breach', 'processor/controller boundary', and 'Java enterprise systems'. These are terms users would naturally use when requesting this type of work.

5 / 5

Distinctiveness Conflict Risk

Highly distinctive with a clear niche: the intersection of Java enterprise systems, GDPR compliance, and specific privacy engineering controls. The combination of domain (Java), regulation (GDPR), and specific technical actions (pseudonymization, DPIA, processor/controller boundaries) makes it very unlikely to conflict with other skills.

5 / 5

Total

20

/

20

Passed

Validation

100%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation11 / 11 Passed

Validation for skill structure

No warnings or errors.

Repository
jabrena/plinth
Reviewed

Table of Contents

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.