2.7K skills · sorted by relevance
Assess cybersecurity risks using NIST SP 800-30 Rev 1 by examining threats, weaknesses, likelihood, and business impact. Produce a ranked risk register, a structured record of risks and recommended responses, with a summary for leadership.
Supports medical device risk management from planning through post-market review using ISO 14971:2019. Helps identify hazards, evaluate risks, select and verify controls, assess remaining risks, and maintain records as new information arrives.
Conduct a defensible cybersecurity risk assessment using the NIST SP 800-30 Rev 1 methodology: prepare scope and a risk model, identify threat sources and threat events, identify vulnerabilities and predisposing conditions, determine likelihood and impact, compute risk, and communicate results as a prioritized risk register. Use when an organization needs an actual risk *assessment* (not a maturity score), when a control framework (CSF, ISO 27001, RMF, SOC 2, PCI) requires a documented risk analysis as input, when leadership asks "what are our top risks and how bad are they", when assessing risk for a new system or major change, or when building a risk register from scratch. This is the methodology that feeds framework selection, ATO packages, and treatment decisions. Keywords: risk assessment, NIST 800-30, threat modeling, likelihood and impact, risk register, risk analysis, threat sources, vulnerabilities, risk determination, qualitative risk, risk matrix, residual risk, risk treatment.
The English summary is being prepared. Showing the original description.
Guides privacy audit risk assessment including risk universe development, inherent and residual risk scoring, control effectiveness evaluation, risk-based audit planning, heat map generation, risk appetite alignment, and audit prioritization by risk exposure. Covers the full audit risk assessment cycle from scoping through ongoing monitoring. Keywords: audit risk assessment, risk universe, inherent risk, residual risk, control effectiveness, risk-based audit planning.
The English summary is being prepared. Showing the original description.
World-Class Risk Management Playbook. Use for: business continuity planning (BCP), disaster recovery (DR), scenario planning, fraud prevention & detection, reputational risk management, geopolitical risk assessment, insurance & risk transfer, crisis communication, enterprise risk management (ERM), risk registers, BIA, RTO/RPO, ISO 22301, ISO 31000, COSO ERM, NIST CSF, DORA, operational resilience, three lines of defence, risk appetite, internal controls, segregation of duties, synthetic identity fraud, deepfake fraud, AML/CFT, KYC, sanctions screening, social listening, vendor risk, geopolitical exposure mapping, parametric insurance, cyber insurance, D&O, KRIs, risk dashboards. Trigger when discussing ANY risk management, business continuity, disaster recovery, fraud prevention, reputational risk, geopolitical risk, insurance strategy, crisis management, operational resilience, or enterprise risk topic. If in doubt, use this skill.
The English summary is being prepared. Showing the original description.
Automate 21risk operations through Rube MCP, a connection for agent tools. The skill discovers available actions, checks the service connection, and uses current input requirements to carry out requested tasks.
Automate 21risk operations through Rube MCP, a connection for agent tools. The skill discovers available actions, checks the service connection, and uses current input requirements to carry out requested tasks.
Calculate portfolio risk and performance measures, including potential losses, declines from past peaks, and returns relative to risk. Use multiple indicators to support risk limits, position sizing, and ongoing monitoring.
Identify risks in projects, vendors, processes, and decisions, then rank them by likelihood and impact. Produce a prioritized risk register, a structured list of risks with practical mitigation actions, responsible owners, and current status.
Provides a structured risk scoring methodology for Data Protection Impact Assessments aligned with ENISA threat taxonomy and ISO 29134. Covers likelihood and severity assessment, risk matrix construction, inherent vs residual risk calculation, and risk appetite thresholds per EDPB WP248rev.01 guidance. Keywords: risk scoring, DPIA risk matrix, likelihood, severity, ENISA, ISO 29134, residual risk, risk appetite.
The English summary is being prepared. Showing the original description.
Map sensitive data across the systems you manage, explore what a compromised asset could expose, and maintain a risk register. Record likelihood, impact, owners, mitigations, and review dates to support ongoing security planning.
Risk analysis, regulatory risk assessment, competitive risk, macro risk, technology risk, litigation risk, financial risk assessment, enterprise risk, operational risk, geopolitical risk exposure
The English summary is being prepared. Showing the original description.
Assess legal risks in contracts and business matters by rating impact and likelihood. Organize risk levels, mitigation options, documentation, and criteria for involving senior legal staff or outside counsel.
"Enterprise risk management (ERM) framework layer — integrates COSO ERM 2017 (five components, 20 principles), ISO 31000, three-lines model, risk appetite, risk heatmap, and key risk indicators (KRI) into a complete governance playbook covering structure through culture. Use for ERM implementation, risk-system build, risk mapping, risk-appetite statement drafting, three-lines setup, CRO role design, or Taiwan FSC corporate-governance evaluation response. Triggers: 『ERM 導入』『風險管理框架』『COSO』『風險地圖』『風險胃納』『KRI』『CRO 職責』『三道防線』『風險委員會』『ISO 31000』『風險熱圖』『風險治理』. For 師大／政大／陽交 EMBA risk-management/governance/audit cases. Complements Asgard `algo-risk-*` (Altman Z, Benford, credit, VaR) with the framework/governance layer. 獨董挑選/董事會組成/IPO 治理: use `biz-corporate-governance`.".
The English summary is being prepared. Showing the original description.
Knowledge base from the DoD Risk, Issue, and Opportunity (RIO) Management Guide for Defense Acquisition Programs (OUSD R&E, Sep 2023 incl. Change 2.2). Use for the defense-acquisition mechanics of program risk management: the RIO definitions (risk/issue/opportunity), the five-step risk process (plan-identify-analyze-mitigate-monitor), 1-5 likelihood/consequence scoring and the 5x5 risk matrix, the four mitigation options (accept/avoid/transfer/control), burn-down plans, issue management (probability=1), opportunity management toward should-cost, cross-program/interface risk, tailoring RIO to the six AAF acquisition pathways (UCA/MTA/MCA/Software/DBS/Services), specialized methods (RMF, MBCRA/Cyber Table Top, Agile metrics, FMECA, ITRA/DTRAM), and institutionalizing RIO via the PRMP, boards (RMB/JRMB/ROMB/RWG), tools, tiered roles, and WBS/IMP/IMS/EVM/TPM integration. This is the DoD-acquisition complement to nasa-risk (general CRM/RIDM theory) and dau-se-guidebook (the SE process frame). Does NOT teach general risk theory from scratch, and defers specialized risk regimes (system safety/ESOH, HSI, detailed cyber/RMF, spectrum) to their own DoD instructions and the relevant packs.
The English summary is being prepared. Showing the original description.
Organize EU AI Act compliance work with references to Articles and Annexes. Classify AI systems by risk, plan conformity assessments that check regulatory requirements, prepare technical documentation checklists, and map obligations and deadlines to organizational roles.
Create a detailed legal risk assessment for a feature that needs closer review. Describe potential harm, likelihood, severity, and safeguards, then compare practical options and recommend a path in a standalone document for decisionmakers.
Structured legal risk assessment with 5x5 Severity x Likelihood matrix. Use for risk scoring, risk registers, escalation decisions, and risk memos.
The English summary is being prepared. Showing the original description.
Determines whether a technology qualifies as an AI system under Art. 3(1) of the EU AI Act and classifies its risk tier (prohibited, high-risk, GPAI with systemic risk, limited risk, minimal risk). This skill should be used when the user asks to "classify an AI system under the AI Act", "determine the AI Act risk tier", "check if something is an AI system", "assess prohibited practices", "check high-risk classification", "determine Art. 6 exception applicability", or mentions "KI-Verordnung", "Risikoklassifizierung", Art. 5, Annex III, or GPAI systemic risk.
The English summary is being prepared. Showing the original description.
Check the current status of the Strait of Hormuz — shipping transit data, oil price impact, stranded vessels, insurance risk levels, diplomatic developments, and global trade impact. Use this skill whenever the user asks about the Strait of Hormuz, Hormuz chokepoint, Persian Gulf shipping risk, oil transit disruption, war risk premium in the Gulf, Middle East shipping routes, tanker traffic through Hormuz, oil supply chain risk, or geopolitical risk affecting energy markets. Triggers include: "Hormuz status", "Strait of Hormuz", "is Hormuz open", "shipping through the Gulf", "oil chokepoint", "Persian Gulf tanker traffic", "war risk premium", "Hormuz crisis", "energy supply chain risk", "oil transit disruption", "Middle East shipping", any mention of Hormuz or Persian Gulf in context of oil, shipping, or geopolitical risk.
The English summary is being prepared. Showing the original description.
Cyber Risk Quantification engineer for CyberRadar. Implements FAIR (Factor Analysis of Information Risk) methodology, Monte Carlo simulation for loss distribution modeling, financial impact quantification in multi-currency (SAR, USD, EUR, GBP), loss exceedance curves, risk treatment ROI calculation, insurance premium optimization, and board-ready financial risk reporting. Transforms qualitative risk assessments into monetary terms for executive decision-making. Triggers on: CRQ, FAIR, Monte Carlo, financial impact, loss modeling, risk quantification, cyber insurance, risk treatment ROI, financial risk.
The English summary is being prepared. Showing the original description.
Decomposes portfolio risk with factor attribution, idiosyncratic risk, and marginal contribution to risk analysis. Use when decomposing portfolio risk, attributing risk sources, or analyzing factor risk contribution.
The English summary is being prepared. Showing the original description.
Identify, score, and mitigate delivery risks for a program or release. Use when the user says "risk review", "what could go wrong", "risk register", "delivery risks for this release", "program risk assessment", "identify blockers before they hit", or wants to pressure-test a plan before committing - even if they don't say "risk review". Based on "The Phoenix Project" by Kim, Behr & Spafford (unplanned work, fragile systems, single points of failure) and "The Art of Project Management" by Scott Berkun (scoping risk, milestone pressure, hidden assumptions).
The English summary is being prepared. Showing the original description.
Work a primary-prevention patient through the 2026 ACC/AHA multisociety dyslipidaemia guideline CPR framework — Calculate (10-year and 30-year PREVENT-ASCVD), Classify (low / borderline / intermediate / high), Personalize (demographic, clinical, biomarker, and reproductive risk enhancers), and Reclassify (coronary artery calcium scoring where appropriate). Use when a clinician asks how to assess ASCVD risk for primary prevention, who needs a statin, borderline risk patient what to do, intermediate risk should I start a statin, risk enhancers to look for, premature family history of ASCVD how does it change risk, pregnancy-related risk factors, PCOS and cardiovascular risk. Grounded in the 2026 ACC/AHA multisociety dyslipidaemia guideline.
The English summary is being prepared. Showing the original description.