Copy this prompt into the AI assistant you're using.
Follow https://skillsmp.com/skill-install/prompt.md to install Agent Skills from https://github.com/CraftOS-dev/craftbot-agent-bundles.Loading the repository README…
Showing 40 of 155 collected skills.
AI governance program — EU AI Act (Regulation 2024/1689; bans Feb 2025; GPAI obligations Aug 2025; high-risk obligations effective August 2, 2026; penalties up to €35M / 7% global revenue) + NIST AI Risk Management Framework 1.0 + ISO/IEC 42001:2023 AI…
Design + maintain AML program per BSA + FinCEN + OFAC + FATF + 6AMLD + MiCA. Five BSA pillars (CIP / CDD / EDD / TM / SAR-CTR). Sanctions screening cadence per risk tier. SAR (30 days) + CTR (next business day) filing via FinCEN BSA E-Filing. Crypto Travel…
Breach notification matrix — GDPR Art. 33 (72h to SA) + Art. 34 (data subjects if high risk); UK GDPR (ICO 72h); US state laws (50 + DC + PR + USVI via NCSL); HIPAA §§164.404-408 (60-day individual + 500+ media + HHS portal); SEC 8-K Item 1.05 (4 business…
Handle Data Subject Access Requests (GDPR Art. 15-22) + Data Subject Rights requests (CCPA / CPRA / state privacy laws). Cover identity verification, lawful denial grounds, response packet assembly, GPC (Global Privacy Control) signal handling, "Do Not Sell…
Integrate KYC vendors — Sumsub (14k+ doc types; crypto-native; MiCA + FinCEN aligned), Persona (customizable workflows), Jumio (enterprise ID-doc + facial liveness; 5k doc types / 200 countries), Onfido (Entrust subsidiary), Trulioo (global ID + KYB), Veriff,…
Data classification scheme + DLP (Data Loss Prevention) deployment. Sensitivity labels (Public / Internal / Confidential / Restricted). 2026 SOTA tools — Microsoft Purview (M365-native + consolidated DLP + DSPM + insider risk + AI), Nightfall AI (API-first…
Retention schedule per data category × jurisdiction × purpose × legal hold. GDPR Art. 5(1)(e) storage limitation + CCPA + state law + sector retention (HIPAA 6yr; FINRA 17a-4 supervisory; SOX 5-7yr; PCI auth data 1yr). Automated deletion via OneTrust…
Continuous SOC 2 monitoring + multi-framework GRC automation via Vanta, Drata, Secureframe, Sprinto, or Thoropass. Map AICPA TSP 100 Trust Services Criteria, set up automated evidence collection, coordinate auditors, manage findings, bridge between Type II…
Build + maintain GDPR core artifacts — Article 30 Records of Processing Activities (ROPA), Article 35 Data Protection Impact Assessment (DPIA), Legitimate Interests Assessment (LIA per Art. 6(1)(f)), and Transfer Impact Assessment (TIA post-Schrems II) for…
Perform HIPAA Security Rule risk analysis (45 CFR §164.308(a)(1)(ii)(A)) per NIST SP 800-66 Rev. 2 (2024). Execute the HHS Security Risk Assessment Tool. Author Business Associate Agreements (BAAs) per §164.504(e) using HHS sample provisions. Cover…
Incident response plan + playbooks aligned to NIST SP 800-61 Rev. 3 (April 2025; first update since 2012) + NIST CSF 2.0 six functions (Govern, Identify, Protect, Detect, Respond, Recover). Per-scenario playbooks (ransomware, BEC, data breach, ATO, insider,…
Prepare for ISO/IEC 27001:2022 certification — ISMS structure (mandatory clauses 4-10), Statement of Applicability (SoA) against 93 Annex A controls in 4 themes, risk assessment + treatment (ISO 27005), internal audit + management review, Stage 1 + Stage 2 +…
Reduce PCI DSS v4.0 scope via tokenization (Stripe / Braintree / Adyen / Spreedly), iframe / hosted-fields, P2PE-validated POS. Pick the right SAQ (A / A-EP / B / B-IP / C / C-VT / D) based on acceptance channel. Plan v4.0 future-dated requirements (effective…
Coordinate annual pen tests + bug bounty programs via HackerOne, Bugcrowd, Cobalt (PtaaS), Synack (vetted researchers + AI), Intigriti (EU), YesWeHack (EU/APAC). Define scope (web/mobile/API/infra/social/red-team), severity scale (CVSS 4.0), SLAs (triage +…
Multi-vector phishing simulation program — email (80%+), SMS (smishing), voice (vishing), QR code (quishing — surging 2026), AI-generated deepfake (CEO fraud, vendor impersonation, NEW 2026). Monthly minimum at org level; weekly for critical roles. Difficulty…
Author the SOC 2 + ISO 27001 + HIPAA + PCI baseline policy library — Information Security, Access Control, Change Management, Incident Response, BCP/DR, Vendor Management, Acceptable Use, Data Classification, Cryptography, Asset Management, Risk Management,…
Quarterly regulatory horizon brief — DORA (effective Jan 17, 2025; 2026 enforcement ramping), NIS2 (transposition Oct 17, 2024; 2026 active enforcement), EU AI Act (bans Feb 2025; GPAI Aug 2025; high-risk Aug 2, 2026), EU Data Act (Sept 12, 2025), EU Cyber…
Build + maintain risk register per NIST SP 800-30 + ISO/IEC 27005:2022 + FAIR (Factor Analysis of Information Risk; quantitative). Fields per risk: ID, description, asset, threat, vulnerability, inherent likelihood × impact, controls, residual likelihood ×…
Real-time sanctions + PEP + adverse media screening via ComplyAdvantage (AI real-time, proprietary DB), Refinitiv World-Check, Dow Jones Watchlist, LexisNexis Bridger XG. Transaction monitoring rule engine + ML anomaly detection. Crypto-specific Chainalysis…
Security awareness training programs via KnowBe4 (largest content library), Hoxhunt (behavioral / adaptive), SoSafe (EU NIS2 + GDPR), Living Security (board-level HRM), Proofpoint (DLP combo), Arsen (2026 deepfake / voice sim leader), Curricula (Huntress),…
Third-party risk management lifecycle — sourcing+selection (RFP security questions, SOC 2 request), due diligence + tiering, contracting (DPA, BAA, SCC, security addendum, audit rights), onboarding (least-privilege, baseline scan), continuous monitoring…
TPRM platform integration — BitSight (Forrester 2026 Wave Leader; outside-in cyber risk intelligence), SecurityScorecard (outside-in ratings), UpGuard (TPRM + ASM + data-leak detection combined), Vanta Vendor Risk (integrated with compliance automation),…
Answer + send vendor security questionnaires — CAIQ v4 (Cloud Security Alliance — 261 Qs across 17 CCM domains), SIG (Shared Assessments — Lite ~125Q / Core ~700Q / Plus ~1100Q), SOC 2 report sharing under NDA, ISO 27001 cert + SoA. SOTA workflow: maintain…
Vulnerability management two-track stack — app-sec (Snyk + GitHub Advanced Security + Semgrep + Checkmarx) + infra VM (Tenable One / Qualys VMDR / Rapid7 InsightVM). Cloud-native CNAPP (Wiz / Orca / Lacework). OSS fallback (OpenVAS / Nuclei / Trivy / Grype /…
Whistleblower program design + operation per EU Whistleblower Directive 2019/1937 + SOX 806 + Dodd-Frank + state laws. Internal + external reporting channels, confidentiality + non-retaliation, 7-day acknowledgment + 3-month response. 2026 SOTA: NAVEX…
Audit the back catalog — find top-N evergreen episodes by listens; repurpose via Castmagic into LinkedIn / X / blog derivatives; re-audiogram via Headliner; Buffer cascade. Use when episodes 12+ months old still get listens but stop getting promoted, or when…
Intelligent Document Processing (IDP) for high-volume mixed-format docs — Hyperscience (enterprise + handwriting), Rossum (invoice-to-ERP), AWS Textract (FORMS + TABLES + QUERIES), Azure Document Intelligence (prebuilt invoice / receipt / ID / tax / contract…
Summarize long contracts (MSA, customer T&C, 100+ page agreements) and extract named clauses (parties, term, fees, indemnity, IP, LoL, governing law, termination) using long-context LLMs (Claude Sonnet 4.5+, Gemini 2.0 Pro), CLM AI (Evisort, LinkSquares,…
Archive executed contracts with full audit chain — Certificate of Completion (DocuSign / Adobe Sign / PandaDoc), SHA-256 hashing, OpenTimestamps blockchain proof, version history, retention policy. Build evidentiary-grade chains for litigation, audits, and…
Generate 1000s of personalized documents from CSV / JSON / DB rows using DocSpring (hosted batch PDF), PDFmonkey (alt hosted), docxtemplater / python-docx-template + WeasyPrint / LibreOffice (FOSS pipeline). Worker queue (Celery / BullMQ / Sidekiq) + S3…
Integrate with CLM platforms — Ironclad (enterprise workflow + AI clause discovery), ContractWorks (SMB repository + e-sign), Lexion (DocuSign-owned pre-execution workflow), LinkSquares (AI post-execution analysis), Evisort (clause search), Concord, Agiloft,…
Execute conditional doc assembly via Documate (FOSS / hosted), HotDocs (legal-industry standard), and Docassemble (Python-extensible OSS) interview engines. If-then clause insertion driven by interview answers — jurisdiction-specific clauses, product-mix…
Generate track-change Word redlines + AI clause suggestions — Spellbook (Word add-in), Robin AI, Harvey AI, Ironclad AI Assist, DraftWise, programmatic via python-docx + redlines lib. Pre-canned redline playbooks (vendor-favorable → customer-favorable). Use…
Author reusable, conditional-logic contract templates (MSA, NDA, employment, vendor, customer T&C, DPA, AUP, BAA, SLA) anchored to Bonterms / Common Paper / YC / NVCA canonical templates. Variable fields + conditional clauses + version control +…
Build and validate accessible PDFs — PDF/UA (ISO 14289), tagged PDF, WCAG 2.2 AA — using veraPDF (FOSS validator), PAC 2024 (free GUI), Adobe Acrobat Pro DC accessibility checker, axe / pa11y for HTML; conversion via Word styles → Tagged PDF, Pandoc,…
Track document funnel analytics — sent → opened → viewed → signed — via native dashboards (PandaDoc, Proposify, Qwilr, DocuSign Insights), DocuSign Connect webhooks → PostHog / Mixpanel / Amplitude, custom dashboards. Track view-time per section, drop-off,…
Orchestrate multi-stage approval routing for documents — legal → finance → exec → counterparty sign — using native CLM/e-sign workflows (PandaDoc, DocuSign, Ironclad) or external orchestrators (n8n, Zapier, Make.com). Slack/Teams in-message approvals,…
Insert dynamic pricing tables, variable line items, discount logic, optional / required items, and per-row formulas into proposals and contracts — PandaDoc pricing tables, Proposify quote builder, Qwilr interactive blocks, or custom Jinja2/Mustache +…
E-signature compliance — UETA (US state), ESIGN Act (US federal), eIDAS Regulation 910/2014 + eIDAS 2.0 / EUDI Wallet (EU), UK Electronic Communications Act, plus industry overlays (21 CFR Part 11 FDA, HIPAA, CMMC, FedRAMP). Pick signature tier (SES / AES /…
Build e-signature pipelines on DocuSign eSignature REST API (dominant 2026 platform), Adobe Sign / Acrobat Sign (Adobe ecosystem), Dropbox Sign / HelloSign (SMB), PandaDoc, SignNow. Envelope creation, recipient routing, signature tabs, webhook (Connect)…
Repository README source: README.md
Read the source README