486 skills · sorted by relevance
Analyze catastrophe modeling systems for natural disaster exposure, PML estimation, and reinsurance optimization. Use when: 'assess cat model', 'evaluate disaster exposure', 'review PML calculations', 'audit reinsurance program', 'check exposure data quality', 'analyze hurricane/earthquake risk models', 'evaluate Oasis or RMS setup'.
The English summary is being prepared. Showing the original description.
Tests APIs for excessive data exposure where endpoints return more data than the client application needs, relying on the frontend to filter sensitive fields. The tester intercepts API responses and analyzes them for leaked PII, internal identifiers, debug information, or sensitive business data that the UI does not display but the API transmits. This maps to OWASP API3:2023 Broken Object Property Level Authorization. Activates for requests involving API data leakage testing, excessive data e...
The English summary is being prepared. Showing the original description.
Diagnoses bias, anomalies, and strange-looking results on a specific PostHog experiment. Covers empty / 0-exposure experiments, sample ratio mismatch, identity fragmentation, multi-variant exposure, uneven-split exclusion bias, significance traps (peeking, A/A, Bayesian vs Frequentist), PostHog-vs-SQL discrepancies, and surprises after mid-run edits. Symptom-driven dispatch to the right diagnostic. TRIGGER when: user asks 'is my experiment biased?' or 'why 0 exposures?', references the bias banner, says a variant looks strange / wrong / off, sees significance flipping, notices PostHog numbers disagreeing with their SQL, sees an A/A test showing significance, or reports surprises after mid-run edits. DO NOT TRIGGER when: creating a new experiment (use creating-experiments), only configuring rollout (use configuring-experiment-rollout) or metrics (use configuring-experiment-analytics), or only asking lifecycle questions (use managing-experiment-lifecycle).
The English summary is being prepared. Showing the original description.
Configures the analytics side of a PostHog experiment — exposure criteria (default `$feature_flag_called` vs custom exposure events), primary and secondary metrics, the supported metric types (count, sum, ratio with `math` and `math_property`, retention with `retention_window_start` and `start_handling`), multivariate user handling ("Exclude" vs "First seen variant"), and how to read results once the experiment is live. Use when the user adds or edits a primary or secondary metric (e.g. "add a secondary metric tracking 'downloaded_file' per user"), sets up a ratio metric (e.g. "revenue from purchase_completed / pageviews"), sets up a retention metric (e.g. "$pageview → uploaded_file, 7-day window"), configures custom exposure (e.g. "only count users who hit /checkout"), changes multivariate handling, or asks "who is in the analysis?", "how do I measure impact?", "is this winning?", "what's the confidence level?", or "should I ship?".
The English summary is being prepared. Showing the original description.
Tag a thesis's implicit macro bets — the macro variables its bull case is secretly levered to (AI capex, rates, FX, China decoupling, memory/HBM cycle, energy, regulation) with direction and magnitude. Use when user says "macro exposure", "what macro is [TICKER] betting on", "macro bets", or "rate exposure for [TICKER]".
The English summary is being prepared. Showing the original description.
Explore UN Comtrade data for strategic commodities such as oil, gas, gold, and semiconductors. Filter by country or product to identify trading partners, compare trade values and weights, and flag sharp year-over-year changes.
Model how disruption at a major shipping passage could affect a country's oil or gas supply. Review estimated product deficits, oil reserve cover, and data limitations, with gas results presented as scenarios based on assumed route exposure.
Test REST, GraphQL, and gRPC APIs with Strix using schemas, credentials, and example data. Investigate authorization flaws, excessive data exposure, and other API risks, then verify findings with requests that reproduce the issue.
Guide authorized API security assessments from endpoint discovery to documented findings. Use a staged workflow to examine authentication, access permissions, input handling, data exposure, and request limits across REST, GraphQL, WebSocket, and SOAP APIs.
Investigate prompt injection in sandboxed security challenges by tracing how untrusted text changes an agent’s decisions or tool calls. Build a minimal reproduction and preserve evidence showing where external content crosses into trusted instructions or actions.
Review concrete code for exploitable security defects, including missing access checks, unsafe input handling, and exposed secrets. Report verified issues with file locations, reachable attack paths, severity, and suggested fixes.
Review GitHub Actions workflows for unsafe input handling, excessive token permissions, exposed secrets, and changeable action references. Get findings grouped by issue type, with severity ratings, exact YAML locations, and concrete fixes to review.
Audit GitHub Actions workflows and CI/CD configurations for supply chain risks. Use Python and YAML parsing to identify unpinned actions, unsafe event expressions, excessive permissions, dependency confusion, and potential exposure of secrets in build pipelines.
Investigate suspected data theft from AWS S3 by comparing access logs, GuardDuty findings, and Macie classifications. Identify unusual bulk downloads and transfers across accounts, assess sensitive data exposure, and build automated detection rules.
Test whether API users can read or change fields beyond their permissions. Examine responses for sensitive data, inject extra request fields to check unauthorized updates, and use explicit lists of allowed fields to guide fixes.
Investigate domains, IP addresses, and certificates linked to suspected attackers using public sources. This skill guides passive research and relationship mapping to support phishing investigations, external exposure reviews, and threat intelligence reports.
Audit Terraform infrastructure definitions and planned changes for excessive permissions, public exposure, and missing encryption. Use security scanners and custom rules to produce actionable findings and add automated checks before cloud infrastructure is deployed.
Assess exposure of Windows secrets protected by DPAPI, the operating system’s data protection service, during authorized security tests. Guide examination and decryption of saved credentials and browser data using available user sessions, credentials, or backup keys.
Check AWS S3 buckets and IAM roles against documented compliance rules. Identify public exposure, missing tags, and overly broad permissions, trace changes through audit logs, and prepare remediation requests for human review without applying fixes.
Summarize litigation matters from a shared log, including risk levels, upcoming deadlines, stale records, and estimated financial exposure. Flag overdue tasks, incomplete conflict checks, and other gaps that need a legal team's attention.
Assess server-side template injection, where user input is interpreted as template code. Identify template engines, evaluate information exposure and code execution risks, and organize evidence alongside detection and prevention measures.
Assess AWS, Azure, and GCP environments by identifying identities, permissions, and paths to broader access or data exposure. Covers cloud storage, secrets, cross-account trust, and CI/CD, the automated systems used to build and deploy software.
Plan AI-assisted ad creative production, testing, budget allocation, and measurement across advertising platforms. It provides workflows for comparing messages, adapting assets to each channel, and refreshing ads when repeated exposure starts to reduce performance.
Check an OpenClaw environment for risky settings, unsafe skills, known software vulnerabilities, and privacy exposure. It combines local checks with optional online threat lookups and also supports reviewing individual skills before installation.