Results for “risk-review”

Use this when reviewing a feature, service, API, auth design, integration, job system, or deployment plan for security weaknesses, unsafe trust assumptions, input risks, or privilege issues.

Launches four parallel read-only sub-agents to review a git diff or file scope for regressions, security risks, performance issues, and contract gaps, then aggregates findings into a prioritized fix path.

Audits a codebase for production readiness using local evidence, scoring ship/block risk and listing concrete fixes without sending repo data to external services.

Conduct systematic access reviews and certifications to ensure users have appropriate access rights aligned with their roles, covering review campaign design, reviewer selection, risk-based prioritization, and remediation tracking for compliance with SOX, HIPAA, and PCI DSS.

Host security hardening and risk-tolerance configuration for SolanaOS deployments. Use when a user asks for security audits, firewall/SSH/update hardening, risk posture, exposure review, SolanaOS cron scheduling for periodic checks, or version status checks on a machine running SolanaOS (laptop, workstation, Pi, VPS).

Host security hardening and risk-tolerance configuration for OpenClaw deployments. Use when a user asks for security audits, firewall/SSH/update hardening, risk posture, exposure review, OpenClaw cron scheduling for periodic checks, or version status checks on a machine running OpenClaw (laptop, workstation, Pi, VPS).

AI-powered Claude Code skill that performs deep code review using formal logic and reasoning frameworks to detect bugs, anti-patterns, and security risks beyond what linters catch.

Use to review how an outsourcer, BPO or vendor handles your customer data and meets your conduct obligations, using evidence from the work rather than from their questionnaire answers. Trigger for "review our BPO's data handling", "vendor risk assessment for our outsourcer", "are our partners compliant", third-party oversight, outsourcing due diligence, or a supplier audit of a support vendor.

Pressure-tests medical-device QMS work with six traceability-obsessed questions before internal audits, regulatory reviews, or product launches.

Audits Rust codebases for safe/unsafe boundary issues, memory safety in unsafe blocks, concurrency hazards, panic-induced DoS, FFI safety, and async runtime mistakes.

Performs security-focused differential review of code changes (PRs, commits, diffs), adapting analysis depth to codebase size and generating comprehensive markdown reports.

Conducts systematic security code reviews to identify exploitable vulnerabilities, reporting only high-confidence findings after researching the codebase.

Conduct a defensible cybersecurity risk assessment using the NIST SP 800-30 Rev 1 methodology, from scoping and threat identification to risk determination and communication.

Security Craft

Pressure-tests an ISMS with six sample-driven questions to prepare for ISO 27001 internal, certification, or surveillance audits.

Security Review

Review this PR or diff for quality, security, and maintainability. Use when reviewing pull requests, examining a named change set, or the user asks for a code review of current work. Repo-wide anti-patterns → audit-code-quality. Bulk transform semantics → audit-codemod-safety.

Use this when reviewing code changes for correctness, maintainability, security-sensitive logic, boundary separation, and likely regressions across any supported runtime or framework.

Run a comprehensive security review on code

Reviews code, diffs, or PRs for correctness, regressions, security, architecture, maintainability, and test gaps.

Analyzes code for logical errors, race conditions, security vulnerabilities, and algorithmic flaws using structured reasoning across 9 risk categories.

Review a code file or directory and produce an evidence-backed GitHub or Jira issue proposing bug fixes, performance improvements, modularity improvements, DRY refactors, file splitting, reusable helpers, and architecture-alignment work. Use when a user asks for a code review, technical-debt proposal, refactor proposal, quality audit, bug-risk review, architecture-alignment review, or issue creation. This skill proposes work; it does not modify code.

Use this skill for auth boundaries, input validation, secrets, RLS, injection risks, destructive-action review. Trigger when the task involves security work related to Security Hardening, production implementation, audits, debugging, strategy, or validation.

Reviews and hardens GitHub Actions workflows against injection, privilege escalation, supply-chain, and token-scoping risks that pattern matchers miss.

Use to draw a defensible sample of support conversations for QA review, an audit or a manual analysis, so the results generalise to the population rather than to whatever was easy to pull. Trigger for "which tickets should we review", "how do we pick a sample", "is our QA sampling representative", stratified or risk-based sampling, review coverage design, or a finding based on a handful of hand-picked tickets.

Use this skill for SBOM, SCA, lockfile review, provenance, package integrity, supply-chain risk. Trigger when the task involves security work related to Supply Chain SBOM SCA, implementation, audits, debugging, strategy, or validation.

Audits OAuth 2.0 permissions across identity providers to identify over-privileged third-party integrations, excessive API scopes, and unused token grants, enforcing least-privilege access.

Composite skill — full security pass across secrets, dependencies, code paths, and OWASP risks. Chains security-audit (broad) + socket-audit (npm supply chain) + semgrep (pattern scan) + code-security (code review for vulns) in parallel, reconciles into one severity-ranked report with remediation plan. Use quarterly per active repo or before any release of security-sensitive code.

Audit a repository, vet and prioritize evidence-backed findings, write drift-aware implementation plans, delegate bounded work, and independently verify results. Use when asked to improve, audit, modernize, harden, review, plan fixes for, or systematically reduce risk in a codebase. Use native isolated agents for implementation; use OpenRouter/free only for narrow advisory audit slices under its safety limits.

Expert SOC 2 compliance assistant covering all five Trust Services Criteria (Security/CC, Availability/A, Confidentiality/C, Processing Integrity/PI, Privacy/P). Use this skill whenever a user mentions SOC 2, Trust Services Criteria, SOC 2 Type 1 or Type 2, audit readiness, compliance gaps, control documentation, evidence collection, vendor risk questionnaires, or anything related to AICPA service organization controls. Trigger even for adjacent topics like "we need to get audited", "a customer asked for our security report", "writing an information security policy", or "preparing for an audit". Covers gap analysis, policy writing, control documentation, audit evidence preparation, and vendor risk reviews for organizations at any maturity level — from first-time startups to seasoned compliance teams.