Results for “third-party-risk”

Expert DORA (Regulation (EU) 2022/2554 — Digital Operational Resilience Act) compliance advisor for EU financial entities. Use this skill whenever a user asks about DORA compliance, ICT risk management frameworks, ICT incident classification or reporting, threat-led penetration testing (TLPT), ICT third-party risk management, Register of Information, contractual provisions with ICT providers, ICT concentration risk, oversight of critical ICT third-party service providers (CTPPs), or any DORA RTS/ITS obligation. Also trigger for: "DORA gap analysis", "DORA readiness", "Art. 6 ICT risk framework", "Art. 17 incident reporting", "Art. 26 TLPT", "Art. 28 third-party policy", "Art. 30 contractual provisions", "Register of Information CIR 2024/2956", "critical TPSP designation", "DORA vs NIS2", "DORA simplified framework", or EBA/ESMA/EIOPA digital resilience guidance.

CI security scanning: secrets, deps, SAST, triage, expiring exceptions

Identify, assess, and mitigate project risks across technical, scope, dependency, and timeline categories using a structured register and escalation rules.

Triages security incidents by classifying type, assigning severity based on business impact, enriching with threat intelligence, and routing to appropriate response teams using NIST SP 800-61r3 and SANS PICERL frameworks.

Assess cloud infrastructure for security misconfigurations, IAM privilege escalation paths, S3 public exposure, open security group rules, and IaC security gaps across AWS, Azure, and GCP with MITRE ATT&CK mapping.

Review protected asset policy and risky local data surfaces.

Security Craft

Agent profile for PPC and paid-growth risk review before changing ads, budgets, bidding, tracking, or landing pages.

Provides third-party license attributions for software components included in the product.

Discover and exploit broken link hijacking vulnerabilities by identifying references to expired domains, decommissioned cloud resources, and dead external services that can be claimed by an attacker.

Terceiro agente do Time de Migração. Propõe estratégias de migração com trade-offs explícitos, considerando brief, paradigma e apetite. Recomenda uma estratégia mas deixa a escolha como decisão humana. Produz migration_strategy.md, risk_register.md e cutover_plan.md. Ativação: /reversa-strategist (geralmente invocado por /reversa-migrate).

Applies ABA Model Rules of Professional Conduct to enforce attorney-client privilege, ethics walls, and conflict-of-interest patterns in legal workflows.

Vendor privacy risk tiering methodology for processor management. Covers scoring factors including data volume, sensitivity, transfer locations, certifications, breach history, and control maturity with weighted risk calculation and tier assignment.

Use to quantify the revenue exposed by unresolved support failures, complaints and escalations without inflating the number. Trigger for "how much revenue is at risk", "what are these support failures costing us", "revenue behind our open escalations", building a business case for fixing a support problem, or a revenue-at-risk figure that looks too large to believe.

Use this skill when selecting a Consortium/Third-Party Administrator (C/TPA) for drug + alcohol testing program management. Covers what services they provide, what to look for, and red flags.

Quantifies the business and regulatory impact of a potential data breach by inventorying sensitive data, tracing data flows, scoring exposure vectors, and estimating regulatory fines using law-sourced figures.

Analyzes .NET project code coverage and CRAP (Change Risk Anti-Patterns) scores to identify risk hotspots, methods blocking coverage gains, and prioritize where to add tests.

Audits Rust codebases for safe/unsafe boundary issues, memory safety in unsafe blocks, concurrency hazards, panic-induced DoS, FFI safety, and async runtime mistakes.

Scan Model Context Protocol servers and tool metadata for poisoning, SSRF, and unauthenticated exposure.

Provides a structured risk scoring methodology for Data Protection Impact Assessments aligned with ENISA threat taxonomy and ISO 29134. Covers likelihood and severity assessment, risk matrix construction, inherent vs residual risk calculation, and risk appetite thresholds per EDPB WP248rev.01 guidance. Keywords: risk scoring, DPIA risk matrix, likelihood, severity, ENISA, ISO 29134, residual risk, risk appetite.

Use when a product needs third-party integrations such as payments, email, analytics, AI providers, storage, or internal services. Trigger on requests to plan integration boundaries, provider selection, failure handling, or sync strategies.

Detect and test for OWASP API3:2023 Broken Object Property Level Authorization vulnerabilities including excessive data exposure and mass assignment attacks.

Builds a 3D volatility surface for any optionable ticker, mapping implied volatility across strike price and time to expiration to identify cheap, expensive, or anomalous options.

Analyze CloudTrail, GuardDuty, Macie, and VPC Flow Logs to detect unauthorized bulk downloads and cross-account data transfers from AWS S3.

Guides authorized Active Directory security research covering Kerberos attacks, AD CS vulnerabilities, BloodHound path analysis, NTLM relay, and domain privilege escalation techniques.

Access 31 pay-per-use tools for quantum security, agent safety, research, data, and earn on Base, paid via x402 protocol.

Test for Server-Side Request Forgery vulnerabilities by probing cloud metadata endpoints, internal network services, and protocol handlers through user-controllable URL parameters.

Use to monitor support conversations for conduct risk — pressure, mis-selling, unfair outcomes, obstruction and misleading statements — as distinct from whether the answer matched policy. Trigger for "monitor for mis-selling", "conduct risk in our support conversations", "are agents pressuring customers", "customers being obstructed from cancelling", conduct surveillance, or a conduct finding raised by second line.

Audit server-side paid-media measurement, including tag management, conversion APIs, event taxonomy, deduplication, consent, hashing, data quality, and observability.

Investigates insider threat incidents involving employees, contractors, or trusted partners who misuse authorized access to steal data, sabotage systems, or violate security policies. Combines digital forensics, user behavior analytics, and HR/legal coordination to build an evidence-based case.

Conduct authorized red team initial access using EvilGinx3 adversary-in-the-middle phishing to capture session tokens and bypass multi-factor authentication.

Identify and exploit SSRF vulnerabilities to access internal services, cloud metadata, and restricted network resources during authorized penetration tests.