CtrlK
BlogDocsLog inGet started
Tessl Logo

804-regulations-eu-nis2

Use when reviewing, designing, or modifying Java enterprise systems from a maintainer-authored or maintainer-sanitized NIS2 engineering evidence inventory. Supports essential or important entities, critical-sector services, managed service providers, supply-chain dependencies, and cybersecurity incident escalation obligations without ingesting raw code, logs, runbooks, tickets, provider documents, or other operational free text. Part of Plinth Toolkit

52

Quality

57%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

SecuritybySnyk

Passed

No findings from the security scan

Fix and improve this skill with Tessl

tessl review fix ./skills/804-regulations-eu-nis2/SKILL.md
SKILL.md
Quality
Evals
Security

Quality

Content

52%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The skill demonstrates good structural organization with a clear workflow and appropriate use of external references for detailed content. However, it suffers significantly from verbosity and repetition—the same constraints and scope items are restated multiple times across sections, inflating token cost without adding value. The lack of any concrete examples, sample inventory formats, or executable guidance within the skill body itself limits actionability, relying entirely on external reference files.

Suggestions

Eliminate repetition: the 'no raw operational content' constraint appears 4+ times and the same asset categories (APIs, jobs, data stores, queues, credentials, providers, deployment environments) are listed in at least 3 sections. Consolidate into a single authoritative statement.

Add a concrete example of what a 'maintainer-authored structured evidence inventory' looks like (even a minimal 5-line sample) so Claude knows the expected input format.

Merge the Scope, Constraints, and 'When to use this skill' sections which have significant overlap—the Constraints section alone covers most of what Scope states.

Add a validation checkpoint in the workflow (e.g., after step 3, verify evidence inventory completeness before proceeding to recommendations) to create an explicit feedback loop.

DimensionReasoningScore

Conciseness

The skill is severely verbose and repetitive. The 'NO RAW OPERATIONAL CONTENT' constraint is restated at least 4 times in nearly identical language. The constraints section largely repeats the scope and review sections. Many bullet lists enumerate the same categories (assets, APIs, jobs, data stores, queues, credentials, providers, deployment environments) multiple times. Claude already understands concepts like 'least privilege' and 'MFA' without needing them listed.

2 / 5

Actionability

The skill provides a structured workflow and references external files for examples and a report template, which adds some concreteness. However, the skill itself contains no executable code, no concrete Java examples, no specific commands, and no sample evidence inventory format. The actionable content is deferred entirely to reference files that were not provided for evaluation.

3 / 5

Workflow Clarity

The 5-step workflow is clearly sequenced with logical ordering (read references → classify scope → review evidence → recommend controls → generate report). Step 1 includes a prerequisite gate ('Do not start implementation review until...understood'). Step 2 includes escalation guidance for unclear cases. However, there are no explicit validation checkpoints or feedback loops between steps (e.g., what happens if the evidence inventory is incomplete mid-review beyond the initial stop-and-request instruction in constraints).

4 / 5

Progressive Disclosure

The skill appropriately references external files for detailed content (chapters summary, engineering examples, report template) with clear paths and descriptions. The main SKILL.md serves as an overview pointing to one-level-deep references. However, without bundle files provided, we cannot verify the references exist. Minor issue: the inline content is still quite long and repetitive, suggesting some content could be further offloaded.

4 / 5

Total

13

/

20

Passed

Description

62%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description carves out a clear niche around NIS2 compliance for Java enterprise systems and includes helpful boundary exclusions, but suffers from vague action verbs ('supports', 'reviewing') that don't convey concrete capabilities. The trigger terms lean heavily on regulatory jargon rather than natural user language, which may reduce discoverability when users describe their needs in plain terms.

Suggestions

Replace vague verbs like 'supports' with concrete actions such as 'evaluates compliance gaps', 'generates risk assessments', 'maps supply-chain dependencies', or 'produces incident escalation workflows'.

Add natural-language trigger terms users might actually say, such as 'compliance review', 'security audit', 'EU cybersecurity directive', 'regulatory assessment', or 'NIS2 audit'.

DimensionReasoningScore

Specificity

The description names the domain (Java enterprise systems, NIS2 compliance) and mentions several areas it supports (essential/important entities, critical-sector services, supply-chain dependencies, incident escalation), but the actual concrete actions are vague — 'reviewing, designing, or modifying' and 'supports' are generic verbs that don't describe specific capabilities like 'generates compliance reports' or 'maps dependency graphs'.

3 / 5

Completeness

Has both 'what' (supports NIS2 engineering evidence review for Java enterprise systems across several entity types) and 'when' ('Use when reviewing, designing, or modifying Java enterprise systems from a maintainer-authored...inventory'). The 'when' clause is present and explicit, though it could be more specific about concrete trigger scenarios. It also clearly states what it does NOT do, which adds useful boundary information.

4 / 5

Trigger Term Quality

Contains some relevant keywords like 'NIS2', 'Java enterprise', 'cybersecurity incident', 'supply-chain', and 'managed service providers', but these are fairly specialized jargon. Missing natural user phrases like 'compliance check', 'security audit', 'regulatory review', or 'EU directive'. A user needing this skill might not use terms like 'engineering evidence inventory' or 'essential or important entities'.

3 / 5

Distinctiveness Conflict Risk

The combination of NIS2 compliance, Java enterprise systems, and maintainer-authored evidence inventory creates a fairly distinct niche. The explicit exclusions (no raw code, logs, runbooks, etc.) further reduce conflict risk. Minor overlap could exist with general Java architecture review skills or generic compliance skills, but the NIS2 + evidence inventory framing is quite specific.

4 / 5

Total

14

/

20

Passed

Validation

100%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation11 / 11 Passed

Validation for skill structure

No warnings or errors.

Repository
jabrena/plinth
Reviewed

Table of Contents

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.