vaquarkhan

Forces replay-safe rollout plans, reconciliation gates, and rollback paths before executing any data backfill or historical reprocessing. Use when running /backfill, rerunning pipelines, repairing publish windows, or any work that risks double-counting or downstream corruption.

Helps agents classify data engineering work, choose the right preset and skill bundle, and pick the safest next command. Use when starting a session, triaging an ambiguous request, or deciding how to proceed.

Guides agents through resiliency testing for data platforms. Use when designing or running failure drills, recovery validation, failover tests, replay-safety checks, dependency outage exercises, or fault injection for pipelines and publishes.

Guides agents through production data incidents. Use when a pipeline fails, publishes bad data, misses an SLA, partially loads, corrupts state, or requires rollback, replay, or stakeholder communication.

Enforces production Kafka guardrails including non-breaking schema evolution, dead-letter queues for poison messages, and acks=all producer durability. Use when designing or changing Kafka topics, producers, consumers, schema registry policies, or streaming recovery paths.

Guides agents to wire Model Context Protocol servers for live data platform observability including Spark execution plans, OOM diagnosis, Kafka consumer lag, and orchestration run state. Use when agents need cluster metrics, streaming lag, or job diagnostics instead of blind code changes.

Designs scheduling, reruns, and backfills safely for data systems. Use when changing orchestration, retries, dependency timing, historical reprocessing, or publish sequencing.

Guides agents through batch and distributed data processing design. Use when implementing or reviewing Spark-based pipelines, or managed distributed runtimes such as Glue and EMR.

Implements FTC COPPA (15 U.S.C. §6501–6506; 16 CFR Part 312) for operators of websites, apps, and AI agents directed to children under 13 or with actual knowledge of child users—verifiable parental consent, data minimization, retention, security, and third-party LLM/MCP subprocessors. Trigger when building consumer apps, chatbots, or agents used by children, auditing EdTech with under-13 users outside school official context, or reviewing parental consent flows and vendor DPAs. Do not use for FERPA school official deployments (use ferpa-education-records), HIPAA pediatric clinical data (use hipaa-technical-safeguards), or general teen users 13+ (use us-state-privacy-laws / ccpa-cpra-privacy-rights).

Implements FERPA (20 U.S.C. §1232g; 34 CFR Part 99) protections for student education records in EdTech, LMS integrations, and AI tutoring agents—school official exceptions, legitimate educational interest, directory information, parent/eligible student rights, and vendor DPAs. Trigger when K-12 or higher-ed systems process student records, deploying AI agents in classrooms, auditing EdTech subprocessors, or assessing LLM use with FERPA-regulated data. Do not use for HIPAA PHI in clinical settings (use hipaa-technical-safeguards), COPPA under-13 consumer apps without school context (use coppa-children-privacy), or general PII without education record nexus (use us-state-privacy-laws).

Implements NIST AI Risk Management Framework (AI RMF 1.0, NIST AI 100-1)—GOVERN, MAP, MEASURE, and MANAGE functions—for trustworthy AI systems including LLM agents, MCP toolchains, and automated compliance workflows. Trigger when assessing AI governance, model risk, agent trustworthiness, GenAI deployment controls, or harmonizing AI RMF with NIST CSF 2.0 and ISO 42001 concepts. Do not use for general cybersecurity without AI scope (use nist-csf-2-assessment), HIPAA PHI controls alone (use hipaa-technical-safeguards), or EU AI Act (out of scope—use gdpr-us-multinational for privacy overlap only).

Meta entry skill for the USA compliance agent repository. Routes tasks to HIPAA, HITECH, PCI-DSS, SOC 2, ISO 27001, NIST CSF 2.0, CCPA/CPRA, US state privacy, GDPR, FedRAMP, SOX, CMMC, and GLBA skills; configures presets, MCP servers, and the audit lifecycle (/scope, /audit, /evidence, /remediate, /report). Trigger when starting any compliance engagement, choosing which skill to load, onboarding a new auditor, or orchestrating multi-framework workflows. Do not use when a specific framework skill already matches the task (load that skill directly instead).

Implements GDPR compliance workflows for US-headquartered multinationals—EU/EEA/UK data subjects, Articles 5-7 lawful basis, Article 30 records of processing, Article 32 security, Articles 33-34 breach notification (72 hours), Article 35 DPIA, Standard Contractual Clauses, EU-US Data Privacy Framework adequacy, and DPA/subprocessor governance for agent/LLM cross-border transfers. Trigger when US companies process EU residents' data, deploying agents in EU regions, assessing LLM vendor international transfers, or preparing RoPA/DPIA for multinational privacy programs. Do not use for US state laws only (use us-state-privacy-laws or ccpa-cpra-privacy-rights), HIPAA PHI (use hipaa-technical-safeguards), or UK-only post-Brexit without EU scope (note UK GDPR parallels in references).

Implements HITECH Act breach notification depth beyond baseline HIPAA—42 U.S.C. §17921–17923, ARRA Title XIII Subtitle D, OCR breach reporting portal workflows, 500+ individual media/HHS rules, business associate direct liability, encryption/unsecured PHI safe harbor analysis, and accounting of disclosures for breaches involving agent/LLM/MCP systems. Trigger when conducting HITECH-specific breach determinations, preparing OCR portal submissions, analyzing BA liability for LLM vendors, or auditing breach accounting and penalty exposure. Do not use for general incident containment (use breach-incident-response first), routine HIPAA Security Rule controls (use hipaa-technical-safeguards), or California CPRA consumer rights (use ccpa-cpra-privacy-rights).

Implements comprehensive US state comprehensive privacy law assessments—Virginia VCDPA (Va. Code §59.1-575), Colorado CPA (C.R.S. §6-1-1301), Connecticut CTDPA, Utah UCPA, Texas TDPSA, Oregon OCPA, Montana MCDPA, Iowa ICDPA, Delaware DPDPA, New Jersey, and harmonized multi-state consumer rights programs—for agent/LLM data flows, opt-out, DSAR, and data protection assessments. Trigger when operating nationally beyond California CPRA, mapping state-by-state obligations, building unified US privacy programs, or auditing agent systems for VCDPA/CPA-style rights. Do not use for California-only CPRA (use ccpa-cpra-privacy-rights), HIPAA PHI (use hipaa-privacy-minimum-necessary), or EU GDPR (use gdpr-us-multinational).

Configures and validates the Presidio-based PHI redaction pipeline—DLP entity detection, reversible tokenization before LLM ingestion, and authorized deanonymization—integrated with redaction.py and the compliance agent. Trigger when ePHI may appear in prompts, implementing minimum-necessary LLM access, tuning entity types, or auditing redaction effectiveness. Do not use for HIPAA access control design (use hipaa-technical-safeguards) or legal BAA review (use hipaa-baa-vendor-assessment).

Manages Web3 wallets including HD derivation, ERC-4337 account abstraction, multi-sig (Safe), and social recovery. Use when creating wallets, signing transactions, managing keys, or configuring smart accounts.

Interacts with smart contracts via ABI encode/decode, read/write calls, deployment, proxy patterns, and multicall batching. Use when calling contract functions, deploying contracts, or working with upgradeable proxies.

Executes DeFi operations including token swaps, lending/borrowing, staking, liquidity provision, flash loans, perpetuals, and vault strategies. Use when interacting with Uniswap, Aave, Compound, Lido, or other DeFi protocols.

Manages NFTs including minting, trading, ERC-721/1155 operations, marketplace integration, and token-bound accounts (ERC-6551). Use when working with NFT collections, metadata, or TBA wallets.

Manages DAO governance including proposals, voting, delegation, treasury management, and timelocks. Use when interacting with Governor contracts, Snapshot, or DAO treasuries.

Handles cross-chain operations including token bridging, cross-chain messaging, and intent-based routing. Use when moving assets or data between blockchains.

Analyzes on-chain token data including whale tracking, DEX volume, wallet PnL, and token unlock schedules. Use when researching token metrics, portfolio performance, or market activity.

Performs Web3 security analysis including vulnerability detection, rug pull checks, and exploit monitoring. Use before interacting with unknown contracts or when auditing smart contract code.