CtrlK
BlogDocsLog inGet started
Tessl Logo
SkillPublic

cloak

Engineering privacy and data governance: PII detection, data flow mapping, consent patterns, GDPR/CCPA-compliant implementation, DPIA. Use when privacy-by-design is needed.

Quality

80%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide
SecuritybySnyk

Passed

No findings from the security scan

Fix and improve this skill with Tessl

tessl review fix ./cloak/SKILL.md
SKILL.md
Quality
Evals
Security

Quality

Content

67%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A well-structured orchestrator skill with clear workflow phases, strong routing tables, and disciplined reference signaling. Its main weaknesses are redundancy (duplicated collaboration/routing blocks and inline regulation detail that duplicates a referenced file) and the absence of an explicit verify-fix-retry feedback loop.

Suggestions

Remove the duplicated collaboration content: the CAPABILITIES_SUMMARY/COLLABORATION_PATTERNS/BIDIRECTIONAL_PARTNERS HTML comment block restates the Collaboration table and Overlap Boundaries almost verbatim — keep one representation.

Move the detailed Regulation Quick Reference table (ADMT dates, penalty figures, per-article deadlines) into reference/privacy-regulations.md and keep a one-line pointer, since the body itself warns not to restate deadlines from memory.

Add an explicit feedback loop to the workflow: when VERIFY finds unaddressed gaps or PII in logs/errors, state that the agent returns to REMEDIATE and re-verifies before completing.

DimensionReasoningScore

Conciseness

The body is dense and assumes domain competence, but it carries real duplication: the ~30-line HTML comment block (COLLABORATION_PATTERNS / BIDIRECTIONAL_PARTNERS) restates the Collaboration table and Overlap Boundaries nearly verbatim, "vs Canon" appears twice, and the inline Regulation Quick Reference table restates date-sensitive details the body itself says belong in reference/privacy-regulations.md. This fits "mostly efficient but could be tightened" rather than the minor-trimming level above.

3 / 5

Actionability

Guidance is concrete and directive: a six-phase workflow table with per-phase required actions and files to read, subcommand dispatch with non-negotiables ("recall ≥95%", GPC visible confirmation), a severity scale, classification tables, and regulation article citations. It falls short of fully copy-paste-ready only because all code-level remediation examples are deferred to reference files.

4 / 5

Workflow Clarity

DISCOVER → CLASSIFY → MAP → ASSESS → REMEDIATE → VERIFY is clearly sequenced with per-phase key rules and an explicit VERIFY checkpoint ("Privacy checklist validation; confirm no PII in logs/errors; test DSAR flows"), but no error-recovery feedback loop is stated for when VERIFY finds remaining gaps, keeping it below the top anchor.

4 / 5

Progressive Disclosure

The Reference Map, per-recipe "Read First" column, and output-routing "Read next" column clearly signal one-level-deep references, and the overview/detail split is deliberate. The detailed Regulation Quick Reference table is inline content that belongs in its already-referenced privacy-regulations.md, which is a minor placement gap rather than the ideal split of the top anchor.

4 / 5

Total

15

/

20

Passed

Description

83%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A strong description: specific, third-person, and explicitly niched with an explicit Use-when clause. The main gaps are a trigger clause narrower than the capability list and a few missing natural synonyms (data protection, DSAR, data deletion).

DimensionReasoningScore

Specificity

"PII detection, data flow mapping, consent patterns, GDPR/CCPA-compliant implementation, DPIA" lists five concrete capabilities, matching the comprehensive-coverage anchor; no major domain pillar is missing for a one-line description.

5 / 5

Completeness

Both a clear "what" (the capability list) and an explicit "Use when privacy-by-design is needed" clause are present, but the single narrow "when" condition does not cover the five stated capability areas, so a user saying "GDPR audit" or "PII leak" is not explicitly triggered.

4 / 5

Trigger Term Quality

Natural keywords like "PII", "GDPR", "CCPA", "consent", and "DPIA" are present, but common user phrasings such as "data protection", "DSAR", "data deletion", or "right to be forgotten" are absent, so coverage is good rather than comprehensive.

4 / 5

Distinctiveness Conflict Risk

"Engineering privacy and data governance" with GDPR/CCPA/PII/DPIA triggers carves a clear niche that is distinct from general security or broad compliance skills, with minimal realistic overlap.

5 / 5

Total

18

/

20

Passed

Validation

100%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 16 / 16 Passed

Validation for skill structure

No warnings or errors.

Repository

simota/agent-skills

Path

cloak/SKILL.md

Reviewed

Table of Contents

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.