Total 50,524 skills, Security & Compliance has 1973 skills
Showing 12 of 1973 skills
Apply when reviewing or designing security-sensitive boundaries in VTEX IO apps. Covers public versus private exposure, trust assumptions at route and integration boundaries, sensitive data handling, validating what crosses the app boundary, and avoiding leakage across accounts, workspaces, users, or integrations. Use for route hardening, data exposure review, or evaluating whether a service boundary is too permissive.
Scaled Access integration. Manage data, records, and automate workflows. Use when the user wants to interact with Scaled Access data.
Burp Suite integration. Manage data, records, and automate workflows. Use when the user wants to interact with Burp Suite data.
Analyze contract fundamentals including formation requirements (offer, acceptance, consideration), essential clauses, and common risk areas. Use this skill when the user needs to review a contract, understand contract terms, identify risky clauses, or draft contract provisions — even if they say 'review this agreement', 'what should I watch out for in this contract', or 'is this clause standard'.
Rust security skill for supply chain safety and memory-safe development. Use when auditing dependencies with cargo-audit, enforcing policies with cargo-deny, reviewing RUSTSEC advisories, writing memory-safe FFI patterns, or integrating fuzzing and Miri into a security review pipeline. Activates on queries about cargo-audit, cargo-deny, RUSTSEC advisories, supply chain security, Rust CVEs, safe FFI, or fuzzing for security.
Investigates hypotheses that MEV activity (bundles, searchers, same-block ordering) temporally overlaps or co-occurs with launch-phase rug signals—using public txs, bundle IDs, and clustering with explicit confidence. Use when the user asks about MEV plus rug coordination, launch sniper bundles, Jito or Flashbots overlap with dev exits, or joint profit-flow case studies—not for alleging collusion without evidence, harassing addresses, or live interference.
Educational map of behavioral risk screening—volume, velocity, and transit-style heuristics at address and transaction level. Use when the user asks about suspicious pattern detection, structuring-like activity, rapid fund movement, or AML-style behavior rules—not for tuning systems to evade monitoring or for legal conclusions.
Educational map of risk exposure screening—typical risk indicator taxonomies, exposure value and percentage, address-level vs transaction-level engines, and common template families (entity label, multi-hop interaction, blacklist). Use when the user asks how commercial screening tools reason about labeled addresses, tainted flows, or deposit vs withdrawal checks—not for legal sanctions determinations or substituting a vendor’s live rules.
Mitigation patterns for privileged-access and governance-adjacent DeFi failures, anchored on the public Drift Protocol incident analysis in Chainalysis’s blog—social engineering, Solana durable nonces, oracle and collateral abuse, multisig governance, and operational monitoring. Use when hardening signer processes, reviewing admin surfaces, or teaching post-incident lessons—not for designing exploits or attributing actors without evidence.
DORA (EU 2022/2554) digital operational resilience compliance automation for financial entities. Assesses readiness against all 5 DORA pillars, classifies ICT incidents, validates third-party risk management, and generates resilience testing plans. Use for DORA compliance assessments, ICT risk management, incident classification, third-party ICT oversight, and digital operational resilience testing.
Use when the user explicitly requests security best practices guidance, a security review or report, or secure-by-default coding help for Python, JavaScript or TypeScript, or Go code.
Use when protecting Xiaohongshu account from unauthorized access, preventing account theft, recovering compromised accounts, or implementing security measures to safeguard account and follower base