Results for “controls”

Expert ISO 27701 Privacy Information Management System (PIMS) compliance advisor. Use this skill whenever a user asks about ISO/IEC 27701:2025, ISO/IEC 27701:2019, privacy information management, PIMS certification, PII controller or processor obligations, privacy risk assessment, Statement of Applicability for privacy, privacy by design, data subject rights, DPIA, records of processing activities, transitioning from ISO 27701:2019, GDPR alignment with ISO 27701, or any privacy management system topic. Also trigger for questions about Annex A.1 (controller controls), A.2 (processor controls), A.3 (shared security controls), or implementing a standalone PIMS without ISO 27001. When in doubt, use this skill — it covers the full ISO 27701 lifecycle from gap assessment through certification.

The English summary is being prepared. Showing the original description.

Expert SOX IT General Controls (ITGC) advisor for finance, internal audit and IT compliance teams. Covers the four ITGC domains external auditors test for SOX 404 — access to programs and data, program changes, computer operations, and program development — plus scoping in-scope systems from the financial statements, designing risk-and-control matrices (RCMs), writing control narratives and test scripts, evaluating deficiencies (control deficiency vs significant deficiency vs material weakness under AS 2201 and Reg S-X), drafting remediation plans, SOX 404(a)/404(b) applicability and filer status, IPO readiness timelines, and COSO 2013 alignment. Use this skill whenever a user mentions SOX, ITGC, IT general controls, 404(a)/404(b), ICFR, material weakness, user access reviews, segregation of duties in IT, change management controls for financial systems, SOX testing or walkthroughs, PCAOB audits, or quarterly compliance for financial reporting systems.

The English summary is being prepared. Showing the original description.

Expert ISO 27701 Privacy Information Management System (PIMS) compliance advisor. Use this skill whenever a user asks about ISO/IEC 27701:2025, ISO/IEC 27701:2019, privacy information management, PIMS certification, PII controller or processor obligations, privacy risk assessment, Statement of Applicability for privacy, privacy by design, data subject rights, DPIA, records of processing activities, transitioning from ISO 27701:2019, GDPR alignment with ISO 27701, or any privacy management system topic. Also trigger for questions about Annex A.1 (controller controls), A.2 (processor controls), A.3 (shared security controls), or implementing a standalone PIMS without ISO 27001. When in doubt, use this skill — it covers the full ISO 27701 lifecycle from gap assessment through certification.

The English summary is being prepared. Showing the original description.

Extract component metadata from a Figma design system and generate production-ready QML controls. Use this skill whenever someone wants to turn Figma components into QML files — whether they say "generate components from Figma", "create QML controls based on a design system", "convert Figma components to QML", "build the component library", "extract button/input/checkbox from Figma", or anything similar. Requires design-tokens.json and QML design system singletons to already exist (from the token extraction skill). Uses Figma MCP to inspect components one at a time and maps variants, states, sizing, and token usage to idiomatic Qt Quick Controls 2 patterns. Trigger this skill at the component generation step of any QML design-system workflow.

The English summary is being prepared. Showing the original description.

Use when reviewing, designing, or modifying Java enterprise systems that may support EU Digital Markets Act gatekeeper-platform concerns, core platform services, interoperability, business-user data access, consent-dependent data combination, ranking, self-preferencing, advertising transparency, or anti-circumvention controls. This should trigger for requests such as Review a Java platform for DMA controls; Design interoperability and business-user data access evidence; Add ranking, consent, preference, or anti-circumvention audit controls; Assess gatekeeper-platform engineering evidence before production release. Part of Plinth Toolkit

The English summary is being prepared. Showing the original description.

Use when reviewing, designing, or modifying Java enterprise systems that may support EU Market Abuse Regulation concerns, market surveillance, suspicious order and transaction reports, insider dealing controls, unlawful disclosure controls, market manipulation detection, inside information disclosure workflows, insider-list evidence, PDMR transaction notifications, alert explainability, model or rule provenance, reviewer decisions, or compliance escalation. This should trigger for requests such as Review a Java trading surveillance system for MAR controls; Design suspicious order and transaction monitoring evidence; Add alert explainability and reviewer-decision audit trails; Assess AI-assisted market-abuse detection before production release. Part of Plinth Toolkit

The English summary is being prepared. Showing the original description.

Use when you need to answer "which attacker techniques do our controls actually stop, and how well?", "what controls should I have for this threat?", or "what telemetry should I collect to detect it?" — joining a customer's or your own security control baseline to ATT&CK techniques using a public, versioned evidence base of 9,545 control-to-technique mappings from six sources. Produces four ranked lists (addressed strongly, addressed weakly, real gaps, and techniques no control anywhere addresses). Use for control gap analysis, security programme prioritisation, board reporting on coverage, or the Resistance Strength side of a FAIR risk assessment. Invoke after /threat-actor-profiling or /lookup-liberty91 has produced a technique list.

The English summary is being prepared. Showing the original description.

Use this skill when the risk register and the statement of applicability were written separately and may not agree, and the team asks "do our risks link to our controls", "traceability between risk treatment and the SoA", "why is this control applicable", "the auditor could not trace a risk to a control", "check our risk treatment plan against the SoA" or "orphan controls". Checks in both directions that every treated risk points to controls and actions, and every applicable control traces back to a risk or obligation, then writes a traceability matrix and a list of orphans and contradictions with proposed fixes.

The English summary is being prepared. Showing the original description.

Build end-to-end tests that operate Windows desktop apps through pywinauto and Windows UI Automation, an interface for accessing screen controls. Covers stable element selection, waits, failure screenshots, test isolation, and CI setup for native applications.

• Building automated tests for Windows desktop workflows
• Diagnosing intermittent GUI test failures
• Adding stable identifiers to screen controls

Review Laravel authentication, permissions, database operations, forms, APIs, and production settings for security weaknesses. Use implementation examples to address unsafe input handling, exposed secrets, session risks, and insufficient access controls.

• Reviewing login and permission controls
• Checking database queries and input validation
• Reviewing forms for forged requests and unsafe scripts

Build or review NestJS backends with clear module boundaries, request validation, access controls, and consistent error handling. The skill guides TypeScript service structure, environment configuration, database integration, and testing for production use.

• Structuring a new NestJS API
• Adding request validation and access controls
• Reviewing error handling and environment settings

Build and review React and Next.js interfaces for keyboard use and screen readers, tools that read content aloud. Apply practical patterns for form labels, error messages, accessible controls, and focus movement.

• Making form labels and errors accessible
• Reviewing keyboard controls for dropdowns
• Managing focus when modals open and close

Design continuous agent workflows with quality checks, evaluations, and recovery controls. Helps choose a loop pattern for the task and define how to pause, audit, narrow scope, and retry when work stalls or fails.

• Choosing a loop pattern for ongoing agent work
• Combining quality checks and evaluations
• Recovering from repeated failures or stalled progress

Integrate x402, an HTTP payment protocol, so agents can pay for APIs or services. Configure task and session budgets, approved recipients, and wallets with privately managed keys, using integration paths for Base, X Layer, or Solana.

• Enable an agent to pay for a paid API
• Set task and session spending limits
• Restrict payment recipients, networks, and assets

Add a live adjustment panel to an HTML page so viewers can explore colors, text sizes, spacing, themes, and motion. Changes appear immediately and are saved in the browser for the next visit.

• Fine-tune a landing page’s colors and spacing
• Demonstrate brand or design system variations
• Add adjustable appearance controls to a standalone demo

Set spending limits, token quotas, and rate limits, which restrict requests over time. Review current consumption and apply controls per API key or globally to manage AI costs across providers.

• Set spending limits for AI usage
• Assign token quotas per API key
• Review and update global rate limits

Review password fields for security and ease of use. Check autocomplete settings, accessible visibility controls, strength indicators, and password manager support, then verify relevant browser and HTTP behavior in an environment resembling production.

• Reviewing login and registration forms
• Checking password manager compatibility
• Improving accessible password visibility controls

Review website animations against users’ reduced motion preferences, a setting that requests less movement. Check flashing content, scrolling effects, alternative transitions, pause controls, and advance warnings, and identify changes needed in rendered pages and interactive states.

• Checking support for reduced motion settings
• Reviewing flashing content frequency
• Finding alternatives to scrolling effects

Scan links within the same domain for the nofollow attribute, a setting used to qualify links for search engines. List affected pages, link text, and destinations, then guide removal or changes based on the intended purpose.

• Auditing nofollow attributes on internal links
• Reviewing links in navigation, headers, and footers
• Finding nofollow applied broadly by templates

Check whether sticky headers, banners, or chat widgets hide controls reached with the keyboard. Review tab order, zoomed views, and mobile layouts, then suggest spacing or scrolling changes that keep the focused control and its indicator visible.

• Checking keyboard navigation around sticky headers
• Testing pages with cookie banners and chat widgets open
• Reviewing overlap in zoomed and mobile layouts

Review websites for content accidentally hidden by ad blockers. Identify problematic HTML class names and IDs, test affected pages with uBlock Origin, and suggest specific names that preserve the visibility and function of notices, banners, and consent controls.

• Investigating notices hidden by ad blockers
• Checking cookie consent controls for accidental hiding
• Reviewing HTML class names and IDs for blocking patterns

Review buttons for missing or unclear names, including controls that contain only icons. Add text or labels that explain each action to screen reader users, and replace buttons used for page navigation with links.

• Finding buttons without descriptive names
• Labeling icon-only buttons for screen readers
• Checking whether navigation controls should be links

Review rotating slideshows for accessibility and guide fixes to pause controls, keyboard navigation, and screen reader announcements. Check the rendered HTML and ensure the carousel respects users who request reduced motion in their device settings.

• Review pause controls for autoplay slideshows
• Check carousel navigation using only a keyboard
• Review screen reader announcements of slide changes

Review ARIA roles, labels that tell assistive technology what page elements do, and correct invalid values. Prefer standard HTML controls where suitable, then check keyboard behavior, focus movement, and screen reader output to verify the changes.

• Finding invalid or misspelled ARIA role values
• Replacing custom widgets with standard HTML controls
• Reviewing accessibility in shared UI components