Results for “statement-of-applicability”

Expert ISO 27001 compliance assistant for security and compliance teams. Use this skill whenever a user asks about ISO 27001 or ISO/IEC 27001, including any of the following: gap analysis, auditing, compliance assessments, control checklists, policy writing, document generation, Statement of Applicability (SoA), risk assessment, risk registers, risk treatment plans, Annex A controls, ISMS implementation, clause requirements, certification readiness, transitioning from 2013 to 2022, control implementation guidance, incident response policies, access control policies, supplier security, or any information security management system (ISMS) topic. Trigger even if the user doesn't say "skill" — any ISO 27001 or ISMS question should use this skill.

Use to build PNAS's Data Availability Statement and deposition plan — mandatory deposition of data in an approved repository at submission, accession numbers/DOIs, public + archived code, and materials sharing. "Available on request" is not sufficient for primary data.

Use to build Science's data, code, and materials availability — mandatory deposition in approved repositories, accession numbers, a compliant data-availability statement, and materials/reagent sharing.

Drafts cognovit promissory notes with confession of judgment provisions, gated by mandatory jurisdictional enforceability research, usury compliance, and statutory disclosure requirements. Advises on alternatives where cognovit clauses are prohibited. Use when drafting cognovit notes, confession of judgment instruments, or loan documents requiring waiver-of-defense provisions.

Validates Claude Ads contracts, bundles, scores, runs, capabilities, repositories, and releases with deterministic checks and recovery steps.

Claims-based authorization for agents and operations. Grant, revoke, and verify permissions for secure multi-agent coordination. Use when: permission management, access control, secure operations, authorization checks. Skip when: open access, no security requirements, single-agent local work.

Verify a completed implementation against the original instructions, a declarative source document, an issue brief, or an optional MoonSpec feature packet, plus AGENTS.md repo guidance and required tests. Use when the user asks to run or reproduce `/moonspec.verify`, perform a final read-only implementation check, audit unit and integration test evidence, classify requirement coverage, or decide whether more code or test work is needed.

Redige acao declaratoria pelo rito comum: interesse limitado a declaracao (CPC 19 - existencia, inexistencia ou modo de ser de relacao juridica; autenticidade ou falsidade de documento), admissibilidade ainda que ja ocorrida a violacao do direito (CPC 20). Declaratoria positiva x negativa; declaratoria incidental. Use quando o operador disser acao declaratoria, declarar inexistencia de debito, declarar relacao juridica, declaratoria de nulidade, ou quero que o juiz declare.

Reconcile canonical declarative documents under docs/ with verified implementation discoveries after a FULLY_IMPLEMENTED moonspec-verify verdict. Use when an orchestration run must decide whether verified discoveries show the owning canonical document is impossible, unclear, or inconsistent, apply the smallest correct doc update, or escalate ambiguous authority conflicts and deliberate divergences instead of editing.

Guides through implementing application whitelisting on Windows using AppLocker, from inventory and rule creation to audit-mode deployment and enforcement.

Verify implementation matches change artifacts. Use when the user wants to validate that implementation is complete, correct, and coherent before archiving.

Use to sign off a QA period for audit or governance — stating what is being attested to, on what evidence, and with which limitations. Trigger for "sign off the QA period", "attest to our quality results", "monthly QA governance pack", "certify the quality figures", or being asked to confirm quality was assured for a period.

Drafts formal responses to governmental Notices of Violation, covering acknowledgment, factual timeline, legal defenses, mitigation, and proposed corrective action. Use when responding to environmental enforcement actions, regulatory citations, compliance violations, or governmental NOVs from agencies including EPA, OSHA, state environmental departments, or local code enforcement.

Design, implement, test, and maintain SIEM detection rules mapped to MITRE ATT&CK across Splunk, Elastic, and Sentinel platforms.

Verify implemented work meets acceptance criteria — run tests, check PHPCS, validate Blade output, lando phpunit, lando phpcs, lando yarn test, Playwright tests, accessibility check, post-implementation verification, done criteria validation, checklist review, verification phase

Executes GDPR Article 20 data portability requests, covering machine-readable format requirements (JSON, CSV, XML), direct controller-to-controller transfer mechanisms, and scope limitations to data provided by the subject on consent or contract basis. Activate for portability, data export, Art. 20, data transfer queries.

Maneja exibicao de documento ou coisa — contra a PARTE (CPC 396-400: pedido 397, resposta em 5 dias 398, recusa nao admitida 399, presuncao de veracidade se recusa ilegitima 400) ou contra TERCEIRO (CPC 401-404: citacao em 15 dias, audiencia especial 402, deposito/apreensao 403, escusas 404) — e a arguicao de FALSIDADE documental (CPC 430-433: suscitada na contestacao/replica/15 dias da juntada 430, motivos e meios 431, exame pericial 432, coisa julgada se questao principal 433; onus da prova 429). Use quando o operador disser exibicao de documento, obrigar a apresentar documento, incidente de falsidade, documento falso nos autos, parte esconde documento, exibicao de coisa.

Map requirements to the most suitable VueUse composable and apply correct usage patterns for concise, maintainable Vue.js/Nuxt features.

Applies the Sarbanes-Oxley Act to assess financial-reporting integrity and IT general controls, mapping executive certification and internal-control areas to auditable evidence for public companies.

Implements tasks from an OpenSpec change, tracking progress and pausing for clarification when needed.

Drafts a CCPA/CPRA-compliant privacy policy covering all required statutory disclosures under Cal. Civil Code §§ 1798.100–1798.199. Use when drafting or updating a California privacy policy, CCPA compliance notice, or consumer privacy disclosure for a business meeting CCPA applicability thresholds.

Use this skill when a driver does not meet federal medical standards and needs to apply for a variance. Covers application steps, required documentation, and review timeline.

Verify feature, bug, UI, API, mobile, security, or deployment work against acceptance criteria.

Accessibility audit skill for scanning, fixing, and verifying WCAG 2.2 Level A and AA compliance across React, Next.js, Vue, Angular, Svelte, and plain HTML codebases. Use when auditing accessibility, fixing a11y violations, checking color contrast, generating compliance reports, or integrating accessibility checks into CI/CD pipelines.

Federal acquisition compliance auditor for the active Theseus workspace, backed by live FAR/DFARS text via the vendored `ecfr` MCP. USE WHEN the user asks to audit FAR/DFARS clause coverage, validate that cited clauses actually exist in eCFR (catch fabricated or typo'd numbers), check whether a cited clause has been amended since the solicitation issued, validate regulatory references (NIST SP, DAFI, MIL-STD), check that every "shall" requirement has a deliverable, find missing compliance artifacts, audit proposal_instruction ↔ evaluation_factor coverage (UCF Section L↔M or non-UCF equivalent — FAR 16 task orders, FOPRs, BPA calls, OTAs), or "are we compliant with the proposal instructions?". Cross-references the workspace's clause / regulatory_reference / requirement / deliverable / compliance_artifact entities against live eCFR and flags gaps with severity. Format-agnostic. DO NOT USE FOR drafting compliant prose (use proposal-generator) or extracting clauses (Theseus pipeline does that automatically).

Speckit Implement Agent

中文求职经历酥化技能：根据目标岗位把真实经历重组为清晰的岗位定位、简历要点、项目亮点和 HR 开场白；当用户输入“/asu”“我要酥化”或要求包装经历时使用。

Assess software supply chain security by generating SBOMs, scanning dependencies, auditing CI/CD pipelines, analyzing container images, and verifying vulnerability reachability.

Skill for the Observability area of paddock. 105 symbols across 26 files.

Identify and exploit Insecure Direct Object Reference vulnerabilities during authorized penetration tests by manipulating object identifiers in API requests and URLs.

Exploit Active Directory Certificate Services (AD CS) misconfigurations, specifically ESC1. By requesting a certificate based on a overly permissive template that allows the enrollee to supply a Subject Alternative Name (SAN), an attacker can impersonate highly privileged users (like Domain Admins) and seamlessly escalate privileges across the entire AD environment.

Enforces running verification commands and confirming output before claiming work is complete, fixed, or passing, ensuring evidence precedes any success claims.

Scaffolds a per-task verification skill for a repo, including a dev-local launcher, a browser driver, and a verification SOP that spawns a sub-agent to drive the app and produce proof.

Validate whether an OSS tool is worth building through staged namespace, existing-solution, and feasibility review