Results for “trust-services-criteria”

Automates SOC 2 Type II audit preparation including gap assessment, evidence collection from cloud providers and identity systems, control testing validation, remediation tracking, and continuous compliance monitoring.

Expert SOC 2 compliance assistant covering all five Trust Services Criteria (Security/CC, Availability/A, Confidentiality/C, Processing Integrity/PI, Privacy/P). Use this skill whenever a user mentions SOC 2, Trust Services Criteria, SOC 2 Type 1 or Type 2, audit readiness, compliance gaps, control documentation, evidence collection, vendor risk questionnaires, or anything related to AICPA service organization controls. Trigger even for adjacent topics like "we need to get audited", "a customer asked for our security report", "writing an information security policy", or "preparing for an audit". Covers gap analysis, policy writing, control documentation, audit evidence preparation, and vendor risk reviews for organizations at any maturity level — from first-time startups to seasoned compliance teams.

Checks on-chain agent trustworthiness, discovers agents for tasks, profiles agents, looks up wallet/identity records, contacts or dispatches agents, and reads or writes hosted metadata via the 8K4 Protocol (ERC-8004).

Start, query, and stop a TAO inference microservice for a specific network architecture by delegating container execution to the appropriate platform skill.

Evaluates and selects Threat Intelligence Platform (TIP) products based on organizational requirements including feed integration capability, STIX/TAXII support, workflow automation, analyst interface, and total cost of ownership.

Guides organizations through implementing zero trust architecture in cloud environments following NIST SP 800-207 and Google BeyondCorp principles, covering identity-centric access controls, micro-segmentation, continuous verification, device trust assessment, and deploying Identity-Aware Proxy in AWS, Azure, and GCP.

Use to design VIP or tiered support programmes and to test whether higher tiers actually deliver better outcomes. Trigger for "VIP support programme", "service tiering", queue priority for premium customers, entitlement vs priority, tier inflation, or "does our enterprise tier get faster support".

Generates CA and service certificates, then configures mutual TLS authentication between microservices using Python's cryptography and ssl modules.

Deploy a Software-Defined Perimeter using the CSA v2.0 specification with Single Packet Authorization, mutual TLS, and SDP controller/gateway configuration to enforce zero trust network access.

TLS/SSL configuration audit. Tests protocol versions (SSLv2/3, TLS 1.0/1.1/1.2/1.3), cipher strength and ordering, certificate chain validation (intermediates, CT logs, OCSP stapling, pinning), known vulnerabilities (POODLE, BEAST, CRIME, Heartbleed, ROBOT, DROWN, Ticketbleed, GOLDENDOODLE), session management (ticket reuse, resumption, fixation), renegotiation attacks, TLS 1.3-specific issues (0-RTT replay, PSK modes, downgrade), HSTS deep analysis (preload, subdomains, bypass), and certificate revocation (CRL, OCSP responder, stapled response freshness). Compliance-mapped to PCI DSS 4.0 (full Section 4), NIST SP 800-52r2, and FedRAMP. Uses testssl.sh, sslscan, sslyze, openssl, nmap NSE scripts, and nuclei SSL templates. Multi-port scanning across 20+ TLS-bearing services.

Enforce identity verification, device compliance, and data protection for cloud-hosted services using CASB, SSPM, conditional access policies, OAuth app governance, and session controls.

Audit criteria, severity definitions, report JSON schema, and quality thresholds for wp-audit agents

Defines service level indicators, objectives, and agreements, calculates error budgets, and sets up Prometheus and Grafana monitoring for SLO compliance.

Assesses a project against all five SOC 2 Trust Service Criteria, producing a control-by-control PASS/PARTIAL/FAIL matrix with evidence references, remediation roadmap, and evidence collection checklist for audit readiness.

Use this when the system needs clear analysis of trusted versus untrusted execution contexts, external inputs, client/server boundaries, provider callbacks, or admin-level code paths. Trigger on requests about trust boundaries, attack surfaces, or where verification must happen.

Detects fake reviews, Sybil rings, rating manipulation, and reputation laundering in ERC-8004 agent ratings across 20+ blockchains using the TrustLayer API.

Implements service mesh with Istio or Linkerd, covering traffic management, mTLS, circuit breakers, and observability for microservices on Kubernetes.

Use this when reviewing a feature, service, API, auth design, integration, job system, or deployment plan for security weaknesses, unsafe trust assumptions, input risks, or privilege issues.

`analysis-agent`/`task-agent`/`review-agent`: use for provider-consumer compatibility of APIs, events, schemas, or behavior; skip without independent consumer/version risk.

Validates, tests, and scores the quality of skills within a claude-skills ecosystem using Python scripts that check structure, syntax, runtime, and multi-dimensional quality metrics.

Models threats for a service, feature, endpoint, integration, or architecture: assets, attackers, boundaries, flows, and abuse cases.

`analysis-agent`/`task-agent`/`review-agent`: use when a service split affects ownership, deployment, scaling, isolation, contracts, or data; skip without a split decision.

Implement continuous identity verification for zero trust using phishing-resistant MFA (FIDO2/WebAuthn), risk-based conditional access, and identity governance aligned with the CISA Zero Trust Maturity Model.

**SLO (Service Level Objective):** What we promise (99.9%)

Vendor privacy risk tiering methodology for processor management. Covers scoring factors including data volume, sensitivity, transfer locations, certifications, breach history, and control maturity with weighted risk calculation and tier assignment.

Triage customer support tickets/emails/chats into categories, priority, and next action; draft responses and create reproducible steps; use for Zendesk/Intercom/Help Scout exports or pasted threads.

Assess SSL/TLS server configurations using the sslyze Python library to evaluate cipher suites, certificate chains, protocol versions, HSTS headers, and known vulnerabilities like Heartbleed and ROBOT.

Register AI agents on Ethereum mainnet with a verifiable on-chain identity using ERC-8004, including bridging ETH, IPFS upload, and on-chain registration.

Register AI agents on Ethereum mainnet using ERC-8004 (Trustless Agents). Use when the user wants to register their agent identity on-chain, create an agent profile, claim an agent NFT, set up agent reputation, or make their agent discoverable. Handles bridging ETH to mainnet, IPFS upload, and on-chain registration.

Use this when reviewing or designing how secrets, API keys, service credentials, signing keys, tokens, and environment-specific credentials are stored, loaded, rotated, and kept out of untrusted runtimes.

Generates structured Given/When/Then acceptance criteria for a user story or feature slice. Use when translating product requirements into testable scenarios that cover the happy path, edge cases, error states, and non-functional expectations for engineering handoff and QA.

Audits technical SEO across nine categories including crawlability, indexability, security, URL structure, mobile, Core Web Vitals, structured data, JavaScript rendering, and IndexNow, producing a scored report with prioritized fixes.

Defines quality standards and validation checklists for agent workflows, Python tools, and documentation, including automated checks and pre-commit gates.

Provides a comprehensive security checklist and code patterns for authentication, input validation, secrets management, SQL injection prevention, XSS, CSRF, rate limiting, and sensitive data exposure.

Score the experience a new customer actually has, not just whether they activated. Grades the first 90 days on the moments that make someone feel taken care of, finds where the welcome goes cold, and hands back a scored audit with the specific fixes. Built for any post-sale team, customizable to your product and lifecycle. Trigger on "audit my onboarding", "score our onboarding experience", "why do new customers churn early", "grade our first 90 days", "where does onboarding go cold", "is our welcome any good", or any onboarding-quality question.