Ansvar AI docs
    ansvar.eu →

    Agent skills

    A skill is a single markdown file you give your AI agent once. It carries a complete compliance workflow — which gateway tools to call, in what order, with which arguments, and the grounding rules that make the output citable — so the agent applies it in every conversation without you pasting instructions. Skills are the packaged form of Instruct your agent: the same cite-or-refuse discipline, plus a task-specific method.

    The files are free to download and licensed CC BY 4.0. Running the compliance skills needs the gateway connector and an Ansvar account; the engineering practice skills further down need neither. Start with Using Ansvar, the routing skill: it carries the grounding method alone — route, scope, fetch, cite, refuse — and exists because a model without it answers compliance questions from training data whenever nobody says “Using Ansvar” in the message. Installed once, it makes routing the standing instruction instead of a per-message reminder. The task skills below assume its method and each add a deep, task-specific workflow. The Using Ansvar, CRA, and Incident Reporting skills use only tools available on every plan, and the calls each one instructs were verified against production on a free-tier connection before publication. The Regulatory Threat Model skill runs the STRIDE workflow, which every plan can start within its monthly allowance — one run on Free, two on Solo, five on Premium; the LINDDUN privacy analysis it offers second needs Premium.

    Available skills

    Using Ansvar — the routing skill

    “Using Ansvar: do we need a DPIA for this feature, and which Swedish rules add to the GDPR here?”

    • The install-once form of the routing habit: standing instructions that route bare compliance questions through the connector instead of letting the model answer from training data — no per-message reminder. Built for the models that otherwise skip the connector.
    • Scopes every search to a jurisdiction or framework, reduces the question to legal key terms in the language of the law being searched, and climbs the broadened-search ladder before treating anything as unanswered.
    • Quotes from fetched provision text with a source URL on every claim, and re-validates citations reused from earlier conversations.
    • Refuses rather than invents: when the served sources do not answer, it names the searches it ran and says so.

    Get it: SKILL.md (the file itself) · ready-made ZIP (for the claude.ai skill upload).

    CRA Vulnerability & Reporting Obligations

    “Using Ansvar: what does the EU Cyber Resilience Act mean for our product — and what does this CVE trigger legally?”

    • Determines CRA scope and product classification from the served regulation and implementing-act text, never from a category guess.
    • Branches the duties by role — manufacturer, importer, distributor, open-source steward — and fetches the application and transitional dates before calling any duty live.
    • Joins live CVE, CISA-KEV, and EPSS intelligence to the CRA's actively-exploited-vulnerability test, applied limb by limb.
    • Walks the full Article 14 reporting ladder — early warning, notification, final report, user communications — quoting deadlines verbatim with their trigger events.

    Get it: GitHub repository (canonical, with README and license) · SKILL.md (the file itself).

    Incident Reporting Navigator (EU)

    “Using Ansvar: we have an incident. Who must we notify, in which member state, and by when?”

    • Screens one incident across NIS2, GDPR, DORA, and the CRA — per legal entity, with each entity's own roles and timestamps.
    • Checks every duty was actually in force for the incident before reporting it, keyed to the duty's own trigger time.
    • Resolves the receiving authority per regime and member state from served national law — Dutch, German, and other transpositions — or says plainly that the name is unresolved.
    • Produces a deadline table in which every duty, authority, and date carries an official-publisher citation.

    Get it: GitHub repository (canonical, with README and license) · SKILL.md (the file itself).

    Regulatory Threat Model

    “Using Ansvar: we shipped an app fast with an AI coding agent. What can go wrong, and what does the law actually require us to check?”

    • Runs a STRIDE threat model and a LINDDUN privacy threat analysis from a plain-language system description — no document upload required.
    • Checks the system's dependencies against live CVE, CISA KEV, and EPSS data.
    • Maps the findings to the regulatory obligations that apply — GDPR Art. 25/32, NIS2 Art. 21, the Cyber Resilience Act, the AI Act — cited to the served legal text.
    • Marks a requirement unresolved instead of guessing when none of the enrichment passes returns a citation.
    • Runs the STRIDE threat model within every plan's monthly allowance — 1 run on Free, 2 on Solo, 5 on Premium. The LINDDUN privacy analysis needs Premium.

    Get it: GitHub repository (canonical, with README and license) · SKILL.md (the file itself).

    ISO Standards Expert

    “Using Ansvar: what does ISO/IEC 27001 require for a risk treatment plan, and what should ours contain?”

    • Fetches licensed clause text per standard — SS-EN ISO/IEC 27001:2023, 27002:2022, 27005:2024, 42001:2026 and SS-ISO/SAE 21434:2021 — through the ISO Standards add-on, purchasable on any plan including Free.
    • Quotes every excerpt verbatim with the SIS copyright notice and source URL; its own analysis is labelled as analysis, never blended into the standard's text.
    • Serves selected parts only, never the complete standard — and reports an unevaluated-scope list when the licence coverage ceiling withholds a fetch, instead of papering over the gap.
    • Without an add-on it answers ISO 27001-shaped questions from the free Secure Controls Framework cross-reference, labelled as such on every result.

    Get it: GitHub repository (canonical, with README and license) · SKILL.md (the file itself).

    Engineering practice skills

    Not every skill needs the gateway. The affect pack is the engineering practice we run on our own agents: at the end of any substantial coding, review, or audit task, the agent files exactly one finding — or an explicit null — through the lens of a specific emotion. Frustration finds what's broken; embarrassment for the user finds what works but shouldn't ship; protectiveness finds the load-bearing weirdness a cleanup pass would delete. No account, no connector, nothing to configure.

    Agent Affect Skills — whine, cringe, protect

    “What did your agent notice that it had no channel to tell you?”

    • agent-whine — one structured complaint per task: friction, hidden coupling, specs that contradict themselves. The subjective tone is the signal, and a complaint that turns out to be wrong still marks where a competent reader got confused.
    • agent-cringe — pictures one specific person using what just changed and reports where it works but you'd want to look away, with the smallest concrete fix.
    • agent-protect — defends code that looks wrong but must not change, naming the concrete failure if someone deletes it naively.
    • agent-affect-checkin — runs all three as one end-of-task pass; the single skill to wire into review and audit agents.

    Get it: GitHub repository (canonical, with README and license) · the files themselves: check-in · whine · cringe · protect.

    Install

    Claude (claude.ai): upload the skill as a ZIP via the Skills section in Settings. Turn on code execution in Settings first — the Skills upload only appears once it is on. Using Ansvar has a ready-made ZIP above — download it and upload it as-is; for the other skills, zip the skill folder yourself. For the compliance skills, add the gateway under Settings → Connectors if you have not already:

    https://gateway.ansvar.eu/mcp

    Claude Code: place the folder under .claude/skills/ in your project, with the gateway configured as an MCP server.

    ChatGPT, Copilot, Gemini, and other MCP clients: attach SKILL.md as standing instructions for the conversation or project, with the gateway connected — or start smaller: the dedicated setup guides for supported clients each carry the routing pack (the compact instruction block the Using Ansvar skill packages) and say where that client keeps standing instructions. Client-by-client setup is in Setup.

    Why these are safe to rely on

    • Nothing from model memory. Every legal claim the agent makes is fetched from official publisher text at answer time and cited with a source URL. Where the sources do not answer, the skill instructs the agent to say so — a connector failure is never converted into a legal conclusion.
    • Reviewed before publication. Each compliance skill went through a two-round adversarial legal-accuracy review with live EUR-Lex cross-checking before release.
    • Re-verified nightly. The exact calls the CRA, Incident Reporting, Regulatory Threat Model, ISO, and Using Ansvar skills instruct are pinned in the gateway's production verification battery and re-checked against the live service every night — if serving ever drifts from what a published skill expects, we find out before you do.