CtrlK
BlogDocsLog inGet started
Tessl Logo
SkillPublic

gdpr-test-patterns

Use when a product processing EU or California personal data needs GDPR or CCPA/CPRA readiness tests: data subject access, erasure, portability and objection, consent and withdrawal, data residency, 72-hour breach notice, data minimization, and CCPA rights including Global Privacy Control.

Quality

89%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide
SecuritybySnyk

Passed

No findings from the security scan

The canonical home for this skill is testland/gdpr-test-patterns

SKILL.md
Quality
Evals
Security

Quality

Content

78%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A well-structured reference skill: executable per-Article test patterns, a sequenced procedure with a modeled feedback loop, and correct use of a one-level-deep companion file for the CCPA catalog. The main improvements are tightening the GDPR background primer and making the code samples fully self-contained and runnable.

Suggestions

Fix the code samples' minor executability gaps so they are copy-paste ready: define `user` in `test_consent_revocable`, define `EU_REGIONS` in the Art. 44-50 test, and replace the non-runnable `response.headers['X-Processing-Time'] < timedelta(days=30)` comparison with an actual elapsed-time assertion (actionability).

Add an explicit verification checkpoint to the 'How to use' steps, e.g. 'run the new tests and confirm they fail against the current implementation before wiring into CI', to complete the red/green feedback loop (workflow_clarity).

Trim the Overview's general GDPR background (in-force date, fine amounts) to one clause, keeping only the non-obvious scope note that the regulation applies regardless of processor location (conciseness).

DimensionReasoningScore

Conciseness

The body is dominated by lean, earning content — per-Article test code, a 7-step procedure, and two tight tables — but the Overview pads with facts Claude already knows ("GDPR (General Data Protection Regulation, in force 2018-05-25)... fines up to €20M or 4% of global annual turnover"). This is efficient-with-minor-trimmable-explanation, matching anchor 4 rather than the every-token-earns-its-place anchor 5.

4 / 5

Actionability

Provides concrete, near copy-paste pytest/Django test code for each Article plus a specific 7-step procedure and worked example, but with minor gaps: `user` is undefined in `test_consent_revocable`, `EU_REGIONS` is never defined, and `response.headers['X-Processing-Time'] < timedelta(days=30)` compares a header string to a timedelta so it would not run as written. That places it at 'mostly executable with minor gaps' rather than fully copy-paste ready.

4 / 5

Workflow Clarity

The 'How to use' section gives a clear 7-step sequence with a CI-wiring validation step and the worked example models an explicit fail → fix → re-run-green feedback loop, plus the anti-patterns table acts as a checklist. However, the authoring workflow itself has no explicit 'run the tests and verify they fail/pass' checkpoint — validation is implicit in CI wiring — so it sits at anchor 4 rather than 5.

4 / 5

Progressive Disclosure

The SKILL.md is a well-sectioned overview-plus-core-catalog, and the California analogue is appropriately split into a real, verified bundle file (references/ccpa.md) that is clearly signaled with markdown links in both the Overview and References sections, exactly one level deep. This matches the clear-overview/well-signaled-one-level-references anchor.

5 / 5

Total

17

/

20

Passed

Description

95%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A strong description with an explicit 'Use when' clause, concrete triggering conditions for both EU and California regimes, and a comprehensive list of the rights under test. Its only weakness is that it names the test areas as nouns without stating what the skill actually delivers (a per-Article test-pattern catalog).

DimensionReasoningScore

Specificity

Enumerates eight-plus concrete test areas ("data subject access, erasure, portability and objection, consent and withdrawal, data residency, 72-hour breach notice, data minimization"), but these are nouns describing rights rather than explicit actions the skill performs; the actual deliverable (per-Article test patterns) is never stated, a minor gap that keeps it below the comprehensive anchor 5.

4 / 5

Completeness

Explicitly answers both questions: an explicit trigger clause ("Use when a product processing EU or California personal data needs GDPR or CCPA/CPRA readiness tests") and a concrete, enumerated 'what' (the colon-delimited list of rights and test areas). Matches the anchor that requires both what and when with concrete trigger phrases.

5 / 5

Trigger Term Quality

Covers the natural terms a user would say verbatim — "GDPR", "CCPA/CPRA", "EU or California personal data", "erasure", "data residency", "72-hour breach notice", "consent", "Global Privacy Control" — including synonyms across both regulatory regimes. It fits the comprehensive-synonyms anchor and is clearly above the 'a few natural terms missing' anchor 4.

5 / 5

Distinctiveness Conflict Risk

Occupies a clear niche (privacy-rights readiness testing) with distinct regulatory triggers (GDPR Articles, CCPA/CPRA sections, GPC, 72-hour breach notice) that no generic skill would claim, so conflict risk is minimal.

5 / 5

Total

19

/

20

Passed

Validation

100%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 16 / 16 Passed

Validation for skill structure

No warnings or errors.

Repository

testland/qa

Path

plugins/qa-compliance/skills/gdpr-test-patterns/SKILL.md

Reviewed

Table of Contents

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.