Results for “risk-prevention”

Use when evaluating potential risks before making decisions, starting initiatives, or implementing changes. This skill provides a structured risk assessment framework for identifying, analyzing, and responding to risks across all domains.

Run a pre-mortem risk analysis on a PRD or launch plan. Categorizes risks as Tigers (real problems), Paper Tigers (overblown concerns), and Elephants (unspoken worries), then classifies as launch-blocking, fast-follow, or track. Use when preparing for launch, stress-testing a product plan, or identifying what could go wrong.

Run a pre-mortem risk analysis on a PRD or launch plan, categorizing risks as Tigers (real problems), Paper Tigers (overblown concerns), and Elephants (unspoken worries), then classifying by urgency and creating action plans.

在启动一个重要项目或关键行动之前，用于主动识别和防范风险

Identifies, assesses, and mitigates risks at every phase of a development pipeline.

Monitor portfolio risk, R-multiples, and position limits. Creates hedging strategies, calculates expectancy, and implements stop-losses. Use PROACTIVELY for risk assessment, trade tracking, or portfolio protection.

Ranks any list of impediments and their countermeasures using a value-stream scoring model (ROI, Cost to Implement, Ease of Deployment, Risk Factor) and a fixed prioritization formula.

Identify and prioritize risks by impact and controllability. Use for risk management, project planning, and strategic decision support.

Conduct a defensible cybersecurity risk assessment using the NIST SP 800-30 Rev 1 methodology, from scoping and threat identification to risk determination and communication.

Creates safety alert decks with hazard stripes, tiered cards, and policy code blocks for incident reviews and risk communication.

Use when making changes to existing systems to ensure those changes don't break existing functionality. This skill provides procedures for identifying at-risk areas, adding regression tests, and validating changes don't cause unintended side effects.

Plans and facilitates tabletop exercises simulating ransomware incidents to test organizational readiness, decision-making, and communication procedures.

Identify, assess, and mitigate project risks across technical, scope, dependency, and timeline categories using a structured register and escalation rules.

Use to monitor support conversations for conduct risk — pressure, mis-selling, unfair outcomes, obstruction and misleading statements — as distinct from whether the answer matched policy. Trigger for "monitor for mis-selling", "conduct risk in our support conversations", "are agents pressuring customers", "customers being obstructed from cancelling", conduct surveillance, or a conduct finding raised by second line.

Calculate portfolio risk metrics including VaR, CVaR, Sharpe, Sortino, and drawdown analysis. Use when measuring portfolio risk, implementing risk limits, or building risk monitoring systems.

Use `review-agent` for a high-risk Engineering Brief when a critical path, architecture boundary, material risk, or multiple downstream tasks need deeper design evidence. Skip ordinary work without those signals.

Run a structured churn-save play for an at-risk account to diagnose root cause and reverse the decision.

Red-team a PRD, roadmap, or strategy by attacking its load-bearing assumptions before reality does, ranking failure modes by impact, likelihood, and cheapness to test.

Proactively hunts for Advanced Persistent Threat activity using hypothesis-driven searches across endpoint telemetry, network logs, and memory artifacts.

`analysis-agent`/`task-agent`/`review-agent`: use for recurrence guards on known defects, incidents, or escaped failures; skip speculative risk without a prior failure mechanism.

Identify risky assumptions for a new product idea across 8 risk categories including go-to-market, strategy, and team.

Broad risk assessment — key-person, technical, regulatory, competitive, financial, and execution risks beyond product/market

在启动高风险项目或重要决策前，需要预先识别潜在失败点以增强心理韧性和方案鲁棒性时

Map product assumptions by risk, confidence, evidence, and next validation step.

风险管理核心skill套件 — CVaR实时风控、动态仓位管理（风控版）。对标Bridgewater全天候策略、PIMCO风控体系的工程化实现。

Mixup: Beyond Empirical Risk Minimization

Review docs, tool output, skills, and memory candidates for prompt-injection risk.

Security controls for RAG. Indirect prompt-injection via retrieved documents, PII detection/redaction (Microsoft Presidio, AWS Comprehend), multi-tenant isolation, ACL-aware retrieval with row-level/metadata filtering, data-leakage prevention, jailbreak hardening on retrieved context, GDPR right-to-be-forgotten in vector DBs. USE WHEN: user mentions "prompt injection RAG", "indirect prompt injection", "PII redaction", "Presidio", "ACL RAG", "row-level security", "multi-tenant RAG isolation", "GDPR vector DB", "right to be forgotten", "jailbreak", "data leakage RAG" DO NOT USE FOR: hallucination detection - use `rag-guardrails`; tenancy scaling patterns - use `rag-production`; audit tracing schema - use `rag-observability`

Analyzes prompts for safety, bias, security vulnerabilities, and effectiveness, providing detailed improvement recommendations with frameworks, testing methodologies, and educational content.

Build and run a third-party/vendor risk management program aligned to NIST SP 800-161 and NIST CSF 2.0: inventory, tier, assess, contract, monitor, and offboard vendors.

Proactively hunt for threats by analyzing IOCs, detecting behavioral anomalies in telemetry, and prioritizing signals mapped to MITRE ATT&CK.

Plan and execute authorized vishing (voice phishing) pretext calls to assess employee susceptibility to social engineering and evaluate security awareness controls.

Triages security incidents by classifying type, assigning severity based on business impact, enriching with threat intelligence, and routing to appropriate response teams using NIST SP 800-61r3 and SANS PICERL frameworks.

Plan and execute authorized spearphishing simulations for red team engagements, covering pretext development, payload creation, infrastructure setup, campaign execution, and post-campaign analysis.