Results for “compliance”

Information Security Management System (ISMS) audit expert for ISO 27001 compliance verification, security control assessment, and certification support. Use when the user mentions ISO 27001, ISMS audit, Annex A controls, Statement of Applicability (SOA), gap analysis, nonconformity management, internal audit, surveillance audit, or security certification preparation. Helps review control implementation evidence, document audit findings, classify nonconformities, generate risk-based audit plans, map controls to Annex A requirements, prepare Stage 1 and Stage 2 audit documentation, and support corrective action workflows.

Audits and enforces web interface standards covering accessibility, performance, UX, and code quality from Vercel Engineering's Web Interface Guidelines. Use this skill when reviewing UI code, checking accessibility compliance, auditing design implementations, running pre-merge frontend checks, or when someone asks to "review my UI", "check accessibility", "check my site", "audit design", or "is this component correct". Apply proactively when writing form elements, interactive components, images, animations, or anything that users directly touch — these guidelines prevent common mistakes before they reach production.

Drafts inspection-ready GMP standard operating procedures for regulated manufacturing. Covers document control, role accountability, process controls, deviation/CAPA handling, and records management aligned to FDA CGMP (21 CFR 210/211), Part 11, ICH Q7/Q9/Q10, WHO GMP, PIC/S, and EU GMP. Use when creating or overhauling a GMP SOP, preparing for audits or inspections, or building compliance-ready procedures. Trigger: GMP, SOP, CGMP, 21 CFR 210, 21 CFR 211, Part 11, ICH Q7, ICH Q9, ICH Q10, WHO GMP, PIC/S, EU GMP.

Cloud security posture assessment for AWS, Azure, and GCP. Tests IAM privilege escalation paths, public storage exposure, serverless attack surface, database exposure, logging gaps, container registry security, and cloud-specific attacks. Both authenticated (with cloud credentials) and unauthenticated (external) modes. Uses nuclei cloud templates, Prowler, ScoutSuite, manual IMDS/metadata probing, and deep AWS/Azure/GCP CLI enumeration. Produces: cloud architecture diagram, attack path map, findings per category, compliance mapping (SOC 2, PCI DSS 4.0, HIPAA, CIS), PoCs for confirmed exploits. Chains into /gh-export for issue filing.

Expert CSRD (Corporate Sustainability Reporting Directive, EU 2022/2464) compliance advisor. Use this skill whenever a user asks about CSRD, European Sustainability Reporting Standards (ESRS), double materiality assessment, sustainability reporting obligations, ESG disclosure, CSRD scope and thresholds, value chain reporting, XBRL digital tagging, third-party assurance, CSRD gap assessments, CSRD implementation timelines, ESRS E1–E5 environmental standards, ESRS S1–S4 social standards, ESRS G1 governance, CSRD vs GRI/TCFD/SASB alignment, or any EU corporate sustainability reporting question. Trigger even if the user only mentions "ESG reporting Europe", "sustainability disclosure EU", or "non-financial reporting".

Expert ITAR compliance advisor for US defense contractors, exporters, and manufacturers. Use this skill for any question about 22 CFR Parts 120-130, the United States Munitions List (USML), DDTC registration, export license applications (DSP-5/73/94), Technical Assistance Agreements (TAA), Manufacturing License Agreements (MLA), brokering regulations (Part 129), deemed export rules for foreign nationals, technology control plans, voluntary disclosures, violation mitigation, jurisdiction determination (ITAR vs EAR), or US Munitions List category scoping. Trigger even if the user doesn't say "skill" — any ITAR or US defense export control question should use this skill.

When the user wants to plan, build, or optimize SMS or MMS marketing — including welcome flows, abandoned cart texts, post-purchase, win-back, promotional sends, or transactional/auth SMS. Also use when the user mentions "SMS marketing," "text message campaigns," "SMS sequence," "SMS automation," "abandoned cart text," "post-purchase SMS," "Klaviyo SMS," "Postscript," "Attentive," "Twilio," "A2P 10DLC," "TCPA," "SMS compliance," "short code," "toll-free SMS," "MMS campaign," "should I do SMS," or "SMS vs email." For email sequences, see emails. For SMS copy framing, see copywriting. For opt-in popups that capture phone numbers, see popups.

Use this skill when the user asks anything that touches US Department of Transportation (DOT) or Federal Motor Carrier Safety Administration (FMCSA) regulation for commercial motor vehicles (CMVs) — including who's regulated, MC vs DOT number differences, operating authority, BOC-3 process agents, MCS-150 biennial updates, intrastate vs interstate distinctions, exemptions, or pointing to the right CFR section. Cite the actual regulation when answering. Don't guess; if you're not sure which Part applies, ask the user to clarify the operation type (for-hire vs private, passenger vs property, intra vs interstate, hazmat, gross weight rating).

Expert CMMC 2.0 (Cybersecurity Maturity Model Certification) advisor for US defense contractors and subcontractors in the Defense Industrial Base (DIB). Use this skill whenever a user asks about CMMC 2.0, CMMC Level 1, Level 2, or Level 3, DoD cybersecurity compliance, NIST SP 800-171, CUI (Controlled Unclassified Information) protection, System Security Plan (SSP), Plan of Action & Milestones (POA&M), C3PAO assessments, DIBCAC audits, self-assessment, SPRS score, or any requirement under DFARS 252.204-7012 or 7021. Also trigger for: "CMMC gap analysis", "CMMC readiness", "FCI protection", "CUI scoping", "CMMC practices", "DoD contract cybersecurity", "defense supply chain security", or "prime contractor flow-down requirements".

Model, simulate, and optimize Serializer/Deserializer (SerDes) systems — serial and parallel links — using MATLAB SerDes Toolbox. Design NRZ and PAM-N links (PAM3 through PAM16) — explore equalization architectures (FFE, CTLE, DFE), sweep or optimize parameters with genetic algorithms, and characterize channels from loss models, S-parameter files, or crosstalk scenarios. Process captured waveforms through equalization chains, build eye diagrams, and decompose jitter. Deliver IBIS-AMI models for Tx, Rx, Redriver, or Retimer by exporting to Simulink and compiling .ami/.ibs/.dll/.so files. Covers the full arc from initial design exploration and parameter optimization to compliance testing and compiled model validation, including custom datapath blocks for nonstandard equalization.

Drafts litigation-ready U.S. pre-suit demand letters that function as settlement instruments and defensible future exhibits. Enforces element-driven narratives, verified authority, damages methodology, and ethics guardrails. Use this skill when the user mentions demand letter, pre-suit demand, breach and cure notice, settlement demand, insurance policy-limits demand, Stowers demand, FDCPA collection letter, notice of intent to file, cease and desist demand for payment, or pre-litigation correspondence. Also trigger when the user asks about FRE 408 framing, contractual notice compliance, statutory pre-suit prerequisites, evidence preservation notices, or quantifying damages for a demand package. Skill includes 14 verified real-letter exemplars referenced from `references/ARCHETYPE-INDEX.md`.

TLS/SSL configuration audit. Tests protocol versions (SSLv2/3, TLS 1.0/1.1/1.2/1.3), cipher strength and ordering, certificate chain validation (intermediates, CT logs, OCSP stapling, pinning), known vulnerabilities (POODLE, BEAST, CRIME, Heartbleed, ROBOT, DROWN, Ticketbleed, GOLDENDOODLE), session management (ticket reuse, resumption, fixation), renegotiation attacks, TLS 1.3-specific issues (0-RTT replay, PSK modes, downgrade), HSTS deep analysis (preload, subdomains, bypass), and certificate revocation (CRL, OCSP responder, stapled response freshness). Compliance-mapped to PCI DSS 4.0 (full Section 4), NIST SP 800-52r2, and FedRAMP. Uses testssl.sh, sslscan, sslyze, openssl, nmap NSE scripts, and nuclei SSL templates. Multi-port scanning across 20+ TLS-bearing services.

Expert ISO 27701 Privacy Information Management System (PIMS) compliance advisor. Use this skill whenever a user asks about ISO/IEC 27701:2025, ISO/IEC 27701:2019, privacy information management, PIMS certification, PII controller or processor obligations, privacy risk assessment, Statement of Applicability for privacy, privacy by design, data subject rights, DPIA, records of processing activities, transitioning from ISO 27701:2019, GDPR alignment with ISO 27701, or any privacy management system topic. Also trigger for questions about Annex A.1 (controller controls), A.2 (processor controls), A.3 (shared security controls), or implementing a standalone PIMS without ISO 27001. When in doubt, use this skill — it covers the full ISO 27701 lifecycle from gap assessment through certification.

Discover OPC UA servers and create client connections in MATLAB using opcuaserverinfo, opcua, connect, setSecurityModel, and certificate trust functions. Use when discovering OPC UA servers on the network, connecting to OPC UA servers, authenticating with username/password or certificates, configuring security modes, handling certificate trust errors, fixing hostname mismatch warnings, troubleshooting connection failures or empty discovery results, or inspecting an OPC UA certificate (.der or .pem) for compliance issues. Trigger on: opcuaserverinfo, OPC UA discovery, find OPC UA servers, LDS setup, opcua, opc.ua.Client, connect OPC UA, OPC UA client, OPC UA security, OPC UA certificate trust, OPC UA certificate inspection, setSecurityModel, opc.ua.trustServerCertificate, opc.ua.exportClientCertificate, Industrial Communication Toolbox, OPC UA server connection, OPC UA server discovery.

Federal Organizational Conflict of Interest (OCI) sweeper backed by FAR Subpart 9.5 (9.501-9.508) and the active Theseus workspace knowledge graph. USE WHEN the user asks about OCI risk on a bid, organizational conflicts, incumbent conflicts, biased ground rules, unequal access to information, impaired objectivity, or any pre-bid OCI due diligence. Pulls `company`, `incumbent`, `subcontractor`, `customer`, `program_office`, and prior-contract relationships from the workspace KG, classifies each potential conflict into one of the three FAR 9.505 classes (biased ground rules, unequal access, impaired objectivity), and emits a structured findings envelope with mitigation recommendations (firewall, NDA, recusal, novation). DO NOT USE FOR FAR clause coverage audit (use `compliance-auditor`), proposal prose (use `proposal-generator`), competitor research (use `competitive-intel`), or pricing (use `price-to-win`).

Turn a weak/cheap "Flash" model into a "Pro" performer by wrapping HKUDS UpSkill — captures agent session failures, has a strong Teacher model analyze them and draft a skill, then validates it against the weak Student model in a closed Ralph Loop (up to 3 rounds) before storing it for automatic reuse. Use when the user wants to install UpSkill, run `/upskill-init`, `/upskill-configure`, `/upskill-build`, `/upskill-run`, `/upskill-list`, `/upskill-status`, `/upskill-mode`, `/upskill-model`, `/upskill-remove`, or `/upskill-uninstall`, wants a cheap model to perform closer to a Pro model without switching, or wants a good session (success or failure) distilled into a validated skill. Triggers on: upskill, up-skill, flash to pro, teacher student distillation, ralph loop skill validation, distill agent failures into skills. Routes skill-quality ratcheting to `skill-autoresearch`, scaffolding to `write-a-skill`, and spec-compliance rewrites to `skill-standardization`.

Reverse-engineers a federal RFP we received — given the SOW/PWS and evaluation criteria already in the Theseus KG, reconstructs the CO's hidden decision tree (upstream `sow-pws-builder` 6 scope blocks + 3 intake answers), surfaces hot buttons, ghost language, discriminator hooks, missing-section signals, and CPFF-form / Section-5 / QASP / Key-Personnel traps. USE WHEN the user asks "what scope decisions did the CO already make?", "reverse engineer this RFP", "what hot buttons are hiding in this PWS?", "where are the discriminator hooks?", "did they pick CPFF completion or term form?", "anything suspiciously missing?", or any variant of decoding CO intent. Pulls `requirement`, `deliverable`, `proposal_instruction`, `evaluation_factor`, `clause`, `performance_standard` from the active workspace KG and emits a JSON envelope feeding `proposal-generator`. DO NOT USE FOR proposal prose (`proposal-generator`), pricing (`price-to-win`), clause audit (`compliance-auditor`), or sub SOW (`subcontractor-sow-builder`).

Federal Other Transaction (OT) prototype bid strategist for 10 USC 4021 research and 10 USC 4022 prototype/4022(f) production-follow-on agreements. USE WHEN the user asks to "build an OT bid", "respond to this OT solicitation", "estimate should-cost for an OT prototype", "is this milestone price reasonable", "compare 4022(d) cost-share paths", "team with an NDC to avoid 1/3 cost share", "OT price-to-win", or "TRL milestone phasing" — any milestone-based prototype scoping, OT cost stack, or 4022(d) cost-share strategy question. Reconstructs the AO's TRL phasing from the active workspace KG, picks the 4022(d) path that minimizes our exposure, builds a per-milestone cost stack from BLS OEWS + GSA CALC+ + GSA Per Diem, and emits a JSON envelope handed to `proposal-generator`. DO NOT USE FOR FAR-based contracts (`price-to-win`/`proposal-generator`), incumbent research (`competitive-intel`), FAR clause audit (`compliance-auditor`), or prime-to-sub SOW drafting (`subcontractor-sow-builder`).

Drafts a federally-defensible SOW or PWS the prime issues to a subcontractor / teaming partner — same FAR 37.102(d) / 37.602 / 16.601(c)(2) / 16.306(d) discipline a contracting officer applies, opposite seat. USE WHEN the user asks to "write a SOW for our sub", "draft a PWS for [Partner]", "build the teaming-partner statement of work", "convert this SOO into a sub SOW", "we need a SOW the sub will sign", or any variant of authoring a downstream work statement. Walks the upstream 3-phase tree (acquisition intake → 6 scope blocks → 14-section assembly), pulls scope from the active Theseus KG (requirements, deliverables, work_scope_items, performance_standards), enforces FAR 37.102(d) "no FTEs in body", emits a chat-only staffing handoff for the prime's cost build, writes Markdown for `renderers` → .docx. DO NOT USE FOR prime proposal prose (`proposal-generator`), reverse-engineering an RFP (`rfp-reverse-engineer`), pricing the sub (`price-to-win`), or clause audit (`compliance-auditor`).