Results for “risk-elimination”

Identifies, assesses, and mitigates risks at every phase of a development pipeline.

Identify and prioritize risks by impact and controllability. Use for risk management, project planning, and strategic decision support.

Conduct a defensible cybersecurity risk assessment using the NIST SP 800-30 Rev 1 methodology, from scoping and threat identification to risk determination and communication.

Prioritize assumptions using an Impact × Risk matrix and suggest targeted experiments for each.

Use when evaluating potential risks before making decisions, starting initiatives, or implementing changes. This skill provides a structured risk assessment framework for identifying, analyzing, and responding to risks across all domains.

Detect insider threat behavioral indicators including unusual data access, off-hours activity, mass file downloads, privilege abuse, and resignation-correlated data theft.

`analysis-agent`/`task-agent`/`review-agent`: use for recurrence guards on known defects, incidents, or escaped failures; skip speculative risk without a prior failure mechanism.

Calculate portfolio risk metrics including VaR, CVaR, Sharpe, Sortino, and drawdown analysis. Use when measuring portfolio risk, implementing risk limits, or building risk monitoring systems.

Red-team a PRD, roadmap, or strategy by attacking its load-bearing assumptions before reality does, ranking failure modes by impact, likelihood, and cheapness to test.

Run a pre-mortem risk analysis on a PRD or launch plan, categorizing risks as Tigers (real problems), Paper Tigers (overblown concerns), and Elephants (unspoken worries), then classifying by urgency and creating action plans.

Use `review-agent` for a high-risk Engineering Brief when a critical path, architecture boundary, material risk, or multiple downstream tasks need deeper design evidence. Skip ordinary work without those signals.

在启动高风险项目或重要决策前，需要预先识别潜在失败点以增强心理韧性和方案鲁棒性时

Conducts HIPAA risk analysis per 45 CFR §164.308(a)(1) following OCR guidance methodology. Covers threat identification, vulnerability assessment, likelihood and impact determination, risk scoring, and mitigation planning for electronic protected health information. Keywords: HIPAA risk analysis, OCR guidance, threat assessment, vulnerability, risk management, ePHI.

`analysis-agent`/`task-agent`/`review-agent`: use for changed assets, trust boundaries, reachable abuse paths, impact, or control placement; skip without a security delta.

`analysis-agent`/`task-agent`/`review-agent`: use for release identity, compatibility, exposure, stop, rollback, or recovery; skip pipeline-only and no-release work.

`analysis-agent`/`task-agent`/`review-agent`: use to recommend a risk-to-test evidence portfolio and omissions; skip test implementation, fixed-command, and release-verdict work.

Map product assumptions by risk, confidence, evidence, and next validation step.

Monitor portfolio risk, R-multiples, and position limits. Creates hedging strategies, calculates expectancy, and implements stop-losses. Use PROACTIVELY for risk assessment, trade tracking, or portfolio protection.

Guides blue-team threat hunting and detection engineering with hypothesis-driven workflows, Sigma/YARA rule creation, SIEM query design, and validation using Atomic Red Team in authorized environments.

Mixup: Beyond Empirical Risk Minimization

Review docs, tool output, skills, and memory candidates for prompt-injection risk.

Cleans credit risk data and screens variables for pre-loan modeling through an 11-step pipeline covering missing rate calculation, IV/PSI filtering, null importance denoising, and correlation removal.

Ranks any list of impediments and their countermeasures using a value-stream scoring model (ROI, Cost to Implement, Ease of Deployment, Risk Factor) and a fixed prioritization formula.

Provides a structured risk scoring methodology for Data Protection Impact Assessments aligned with ENISA threat taxonomy and ISO 29134. Covers likelihood and severity assessment, risk matrix construction, inherent vs residual risk calculation, and risk appetite thresholds per EDPB WP248rev.01 guidance. Keywords: risk scoring, DPIA risk matrix, likelihood, severity, ENISA, ISO 29134, residual risk, risk appetite.

Run a pre-mortem risk analysis on a PRD or launch plan. Categorizes risks as Tigers (real problems), Paper Tigers (overblown concerns), and Elephants (unspoken worries), then classifies as launch-blocking, fast-follow, or track. Use when preparing for launch, stress-testing a product plan, or identifying what could go wrong.

Executes containment strategies to stop active adversary operations and prevent lateral movement during a confirmed security breach, using network segmentation, endpoint isolation, credential revocation, and access control modifications.

Plans and facilitates tabletop exercises simulating ransomware incidents to test organizational readiness, decision-making, and communication procedures.

Stress-test a feature idea for an existing product by surfacing risky assumptions across Value, Usability, Viability, and Feasibility using multi-perspective devil's advocate thinking.

Proactively hunt for adversary abuse of legitimate system binaries (LOLBins) to execute malicious payloads while evading detection.

Apply bottom-up and top-down role mining techniques to discover optimal RBAC roles from existing user-permission assignments, reducing role explosion and enforcing least privilege.

Recommend model families and validation strategy based on data, constraints, and objective. Use when: (1) choosing algorithms, (2) balancing bias/variance, (3) planning benchmark baselines. NOT for: final legal/compliance sign-off.

Run a trademark clearance search before adopting a new brand name, mark, or logo and risk-rate it clear, caution, or high-risk with a proceed/modify/abandon recommendation.

Performs privilege escalation assessments on compromised Linux and Windows systems to identify paths from low-privilege access to root or SYSTEM-level control.

OWASP Top 10 + Supabase-first hardening burndown. Use when "security audit plan", "OWASP audit", "hardening plan", or "security burndown". App-layer auth flows → audit-auth-flows. Table RLS → plan-rls-audit. Key rotation → plan-secrets-audit. App LLM attacks → audit-llm-security.

Design leakage-safe feature engineering strategies for tabular/time-series datasets. Use when: (1) preparing model-ready features, (2) selecting transformations and encodings, (3) documenting feature lineage. NOT for: model serving or infra provisioning.