SKILLEMALL.ai
GitHub ↗ RU Sign in

DC gdpr-breach-sentinel-oliver-schmidt-prietz

Elite incident response and legal compliance guidance for data breaches under GDPR Articles 33 & 34. Use when: (1) User reports a data breach or security incident — including "is this even a personal data breach?" triage, (2) User asks about breach notification obligations or deadlines, (3) User mentions "72 hours", Art. 33, Art. 34, or notification requirements, (4) Discussion involves security incidents affecting personal data, (5) User needs breach risk assessment using ENISA methodology, (6) User mentions "Data Breach" or "Incident" or "Data Leakage" or "Ransomware" or "Exfiltration", (7) User needs to determine Controller vs Processor obligations, (8) Cross-border breach scenarios requiring Lead SA determination, (9) User needs a mitigation playbook or immediate response recommendations, (10) User needs audit-ready breach documentation (.docx) or an EDPB-template-aligned breach notification / evidence file — including follow-up and withdrawal notifications, (11) Breach involves an AI system requiring AI Act Art. 73 serious incident screening.

lawve-ai/awesome-legal-skills Agent Skills author: lawve-ai 14 files body ≈ 9 624 tokens Open the sourcegithub.com↗ analyzed 77 min ago

Elite incident response and legal compliance guidance for data breaches under GDPR Articles 33 & 34.

As a process C 58/100 · Has gaps — weak spots: when it triggers, inputs and preconditions, execution cost

ProcedureWordInfrastructureLegaltype and topics are labelled automatically from the skill text
Runs in: Claude / Claude Code ChatGPT / Codex Gemini CLI Cursor GitHub Copilot / VS Code Qwen Code Kimi Code CLI Z.ai (GLM) DeepSeek (Deep Code) Mistral Vibe LangChain (deepagents) OpenClaw Goose OpenCode
JSON
Technical rating
D
73/100
safety, quality, tests
Safety 60%
82
Quality 40%
59
Run on models
none yet
Process rating
C
58/100
Has gaps
Inputs and preconditions w 11
0
When it triggers w 12
20
Running it twice w 4
30
the three weakest of ten parameters · all ten

How to improve

  1. Shorten the description to 1024 characters.
  2. The SKILL.md body is over 5,000 tokens: move reference detail into references/ and load it when needed.
For the model run — optional
  • A spec.yaml with trigger phrases and assertions — a behaviour contract for CI; `skilltest init` writes a template.

Guard findings · 18

✓ No critical or high findings

Medium and low: 18
  • low Risky intent intent-offensive-security references/edpb-cases.md:7
    Offensive-security / dual-use content (legitimate for authorised testing; review intended use)
    ## Ransomware Cases (01-04)
  • low Risky intent intent-offensive-security references/edpb-cases.md:9
    Offensive-security / dual-use content (legitimate for authorised testing; review intended use)
    ### Case 01: Ransomware with Proper Backup
  • low Risky intent intent-offensive-security references/edpb-cases.md:10
    Offensive-security / dual-use content (legitimate for authorised testing; review intended use)
    **Scenario:** Small manufacturing company, ransomware encrypts employee data (30 employees), backup restored within hours, no evidence of exfiltration.
  • low Risky intent intent-offensive-security references/edpb-cases.md:22
    Offensive-security / dual-use content (legitimate for authorised testing; review intended use)
    ### Case 02: Ransomware without Proper Backup
  • low Risky intent intent-offensive-security references/edpb-cases.md:23
    Offensive-security / dual-use content (legitimate for authorised testing; review intended use)
    **Scenario:** Agricultural company, ransomware encrypts business data including customer/supplier info, no backup, data lost.
  • low Risky intent intent-offensive-security references/edpb-template-evidence-file.md:78
    Offensive-security / dual-use content (legitimate for authorised testing; review intended use)
    | **Nature of the incident** (taxonomy, pick all that fit) | a) abuse of access privileges by employee · b) encrypted device / ransomware · c) hacking / malware · d) phishing / social engineering · e)
  • low Risky intent intent-offensive-security references/edpb-template-evidence-file.md:142
    Offensive-security / dual-use content (legitimate for authorised testing; review intended use)
    Inventory — dated copies of: a) communication to data subjects · b) risk assessment · c) research/forensic report (cyber incidents) · d) ransomware note · e) phishing message · f) internal breach-noti
  • low Risky intent intent-offensive-security references/enisa-methodology.md:26
    Offensive-security / dual-use content (legitimate for authorised testing; review intended use)
    RANSOMWARE
  • low Risky intent intent-offensive-security references/enisa-methodology.md:170
    Offensive-security / dual-use content (legitimate for authorised testing; review intended use)
    **Worked bridge example** (continuing Example 1, ransomware with backup, SE = 3.75 HIGH):
  • low Risky intent intent-offensive-security references/enisa-methodology.md:173
    Offensive-security / dual-use content (legitimate for authorised testing; review intended use)
    > Key facts: hospital ransomware; health data of 5,000 patients encrypted by attacker; backup restored within 24h; no exfiltration evidence so far, but forensic review incomplete.
  • low Risky intent intent-offensive-security references/enisa-methodology.md:237
    Offensive-security / dual-use content (legitimate for authorised testing; review intended use)
    ### Example 1: Ransomware with Backup
  • low Risky intent intent-offensive-security references/enisa-methodology.md:238
    Offensive-security / dual-use content (legitimate for authorised testing; review intended use)
    - **Scenario:** Hospital ransomware, 5000 patients, health data encrypted, backup restored in 24h
  • low Risky intent intent-offensive-security references/mitigation-playbook.md:36
    Offensive-security / dual-use content (legitimate for authorised testing; review intended use) (detector / deny-list definition)
    **Containment & Forensics:** System isolation, credential revocation, evidence preservation, IOC sweeps, access log audits, attack vector analysis, lateral movement assessment
    detector
  • low Risky intent intent-offensive-security references/templates.md:802
    Offensive-security / dual-use content (legitimate for authorised testing; review intended use)
    | d | Ransomware note | ☐ | | |
  • low Risky intent intent-offensive-security SKILL.md:4
    Offensive-security / dual-use content (legitimate for authorised testing; review intended use) (quoted — discussed, not commanded)
    Elite incident response and legal compliance guidance for data breaches under GDPR Articles 33 & 34. Use when: (1) User reports a data breach or security incident — including "is this even a personal
    quoted
  • low Risky intent intent-offensive-security SKILL.md:70
    Offensive-security / dual-use content (legitimate for authorised testing; review intended use)
    For rapid preliminary orientation on common scenarios (lost encrypted device, misdirected email, ransomware, phishing), use the decision trees in [references/enisa-methodology.md](references/enisa-met
  • low Risky intent intent-offensive-security SKILL.md:82
    Offensive-security / dual-use content (legitimate for authorised testing; review intended use) (documentation table row)
    | 3 | **Breach Type** | "Which types of breach apply? Select ALL that apply: Confidentiality (data disclosed), Integrity (data altered), Availability (data lost/inaccessible), or **Still Under Investi
    table
  • low Risky intent intent-offensive-security SKILL.md:300
    Offensive-security / dual-use content (legitimate for authorised testing; review intended use)
    - Ransomware: Cases 01-04

Files scanned: 14. Evidence is masked. Grey chips explain why severity was lowered.

Against the Agent Skills spec

  • error description-long description is 1064 chars, limit 1024
  • warning body-long SKILL.md body ≈ 9624 tokens (recommended < 5000); move details to references/

Process rating: all ten parameters 58/100

  • 0Inputs and preconditions. Does not say what the process needs to start
  • 20When it triggers. No condition that starts the skill
  • 30Running it twice. 4 mutating operations with no state check
  • 40Execution cost. Instruction body is 9624 tokens: crowds the task out of the window
  • 60Tools and files. Uses tools (web) that frontmatter does not declare
  • 60Result and completion. Output format stated, no completion criterion
  • 85Steps. 112 steps, 3 vague phrases
  • 100Failures and branches. 7 branches, has a failure section
  • 100Consistency. Name and required fields are in place
  • 100Progress reporting. Reports progress
  • medium Safety rules and hard prohibitions inside a skill: they belong in the system prompt, here they protect nothing
  • low 20 top-level sections: this looks like several domains in one skill

Everything here is measured from the skill text rather than judged by a model, so the numbers are checkable. A parameter weighs more when it is a more common reason for the process to stall.

Quality signals

  • +4Description does not say when NOT to use the skill (false activations)
  • +3Description length 1063: 120–800 characters recommended
  • +2Single-language instructions
  • +5Description quotes 7 example trigger phrases
  • +4Structure: 48 headings
  • +3Step-by-step instructions: 112 items
  • +3Output format is stated explicitly
  • +4Has examples (4 code blocks)
  • +4Reference files are cited in the instructions (10 of 10)
  • +1License stated

Quality base 70; lint remarks subtract, signals add up to 100. Result: 59.