Fähigkeiten risk-control-engineer

📦

risk-control-engineer

Name: risk-control-engineer
Author: zl2023github

Inhaltsrevision r2 Mittleres Risiko ⚡ Enthält Skripte⚙️ Externe Befehle

Build Fraud Detection and Risk Controls

Fraud teams need practical methods to identify abuse, test controls, and monitor drift. This skill guides risk analysis, rules, models, backtesting, and real-time system design.

Unterstützt: Claude Codex Code(CC)

⚠️ 50 Schlecht

Maintain this Skill? Claim it ⚠️ 50 Schlecht

Mit meinem Agent installieren

Kopieren Sie diese Anfrage in Ihren Agent. Sie enthält die maßgebliche Skill-Seite und das Manifest.

Agent-Anfrage

Review the Skillstore skill "risk-control-engineer" from https://skillstore.io/skills/zl2023github-risk-control-engineer.md and its manifest at https://skillstore.io/api/skills/zl2023github-risk-control-engineer/manifest. Verify the artifact. You may proceed after verification, subject to the environment's own policy.

Ihr Agent sollte weiterhin seinen Plan anzeigen und alle von der Sicherheitsrichtlinie verlangten Bestätigungen anfordern.

Agent-lesbare Ressourcen

Verwenden Sie diese Links, wenn ein KI-Agent, Crawler oder Skript sauberen Kontext benötigt, statt die vollständige Seite zu lesen.

Markdown-Detailseite GET /skills/zl2023github-risk-control-engineer.md Signiertes manifest GET /api/skills/zl2023github-risk-control-engineer/manifest Signiertes lockfile GET /api/skills/zl2023github-risk-control-engineer/lockfile

Testen

„risk-control-engineer“ wird verwendet. Assess coupon abuse during a new-user promotion.

Erwartetes Ergebnis:

Primary risks: account farming, device reuse, proxy registration, and coordinated redemption.
Prioritized controls: device-account velocity, payment-link analysis, staged rewards, and targeted review.
Validation: measure incremental fraud capture, legitimate-user impact, review load, and repeat attacker adaptation.

„risk-control-engineer“ wird verwendet. Plan a backtest for account-takeover rules.

Erwartetes Ergebnis:

Use an out-of-time holdout to preserve event order and prevent leakage.
Report recall, precision, false-positive rate, review volume, and estimated prevented loss.
Compare thresholds under documented investigation costs and customer impact limits.

„risk-control-engineer“ wird verwendet. Design monitoring for a production fraud model.

Erwartetes Ergebnis:

Monitor score distribution, PSI, approval rate, rejection rate, review rate, delayed fraud labels, latency, and feature freshness with defined owners.

Sicherheitsaudit

Mittleres Risiko

v4 • 23.7.2026 Versionsbericht öffnen

The Python rule-engine example performs dynamic evaluation of rule text and is a confirmed code-execution risk. The 21 command alerts, two reconnaissance alerts, and entropy alert are false positives caused by Markdown fences, graph variables, and multilingual text. Two additional control-quality defects could hide rule failures or misstate backtest performance.

Gescannte Dateien

455

Analysierte Zeilen

Prüfelemente

Falschmeldungen ignoriert

Bestätigte Sicherheitsbedenken (2)

Mittel

SKILL.md:286-293

Rule Evaluation Fails Open

The rule engine catches every evaluation error and returns false. Invalid or malicious conditions can silently bypass controls instead of producing a review or rejection.

The broad exception handler directly converts every rule evaluation failure into a non-match. This behavior is explicit in the example.

Mittel

SKILL.md:387-392

Backtest Metrics Misstate Control Performance

The capture rate measures fraud prevalence instead of captured fraud, while the false-positive rate uses all labeled rows as its denominator. Decisions based on these metrics may weaken fraud controls.

The formulas visibly omit rule outcomes from capture rate and do not normalize false positives by legitimate cases. Standard confusion-matrix definitions confirm both errors.

Elemente der Fähigkeitsprüfung (1)

Dies sind echte lokale Fähigkeiten, die für diese Fähigkeit erwartet werden können; daher müssen sie überprüft werden, werden jedoch nicht als bestätigtes bösartiges Verhalten gezählt.

Hoch

SKILL.md:291

Dynamic code evaluation with eval()

return bool(eval(condition, {\"__builtins__\": {}}, allowed_vars))

The rule engine evaluates condition text through eval with feature values as locals. Removing builtins does not prevent malicious expressions from traversing Python objects, so untrusted rules can execute unintended code.

Risikofaktoren

Geprüft von: codex Audit-Verlauf anzeigen →

Diesen Bericht teilen & zitieren

Teile den versionierten Bewertungsbericht, das neutrale Badge, die Einbettungskarte und Zitate. Skillstore berichtet Nachweise, ohne zu entscheiden, ob dieser Skill sicher ist.

Versionsbericht öffnen

Berichtslink kopieren

https://skillstore.io/skills/zl2023github-risk-control-engineer/audits/4?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown-Badge

[![Skillstore security assessment](https://skillstore.io/badges/skills/zl2023github-risk-control-engineer/security.svg)](https://skillstore.io/skills/zl2023github-risk-control-engineer?utm_source=security_passport_badge)

HTML-Badge

<a href="https://skillstore.io/skills/zl2023github-risk-control-engineer?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/zl2023github-risk-control-engineer/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Einbettungskarte

<iframe src="https://skillstore.io/embed/skills/zl2023github-risk-control-engineer.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

Wissenschaftliche Zitate (APA · BibTeX · CFF)

APA-Zitat

zl2023github. (2026). risk-control-engineer security audit report (audit version 4) [Author version unspecified]. Skillstore. https://skillstore.io/skills/zl2023github-risk-control-engineer/audits/4

BibTeX-Zitat

@techreport{zl2023github-zl2023github-risk-control-engineer-2026,
  author = {zl2023github},
  title = {risk-control-engineer security audit report (audit version 4)},
  institution = {Skillstore},
  year = {2026},
  number = {4},
  url = {https://skillstore.io/skills/zl2023github-risk-control-engineer/audits/4},
  note = {Author version unspecified}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "risk-control-engineer security audit report (audit version 4)"
version: "unspecified"
type: report
authors:
  - name: "zl2023github"
date-released: "2026-07-23"
url: "https://skillstore.io/skills/zl2023github-risk-control-engineer/audits/4"
identifiers:
  - type: other
    value: "skillstore:zl2023github-risk-control-engineer:audit:4"
    description: "Skillstore immutable audit report identifier"

Skillstore-Score

Warum dieser Score Evidenzvertrauen: Mittel

Architektur

Wartbarkeit

Inhalt

Gemeinschaft

Spezifikationskonformität

Was Sie erstellen können

Assess a New Abuse Scenario

Map likely attacks, affected workflows, evidence, control gaps, and prioritized defenses for a new product flow.

Plan Model and Rule Backtests

Define features, temporal validation, evaluation metrics, thresholds, and cost assumptions for candidate controls.

Design Real-Time Decisioning

Create a scalable architecture for streaming features, rule evaluation, model inference, case review, monitoring, and rollout.

Diese Prompts ausprobieren

Identify Fraud Risks

Analyze fraud risks for [business flow]. List attack paths, affected users, existing control gaps, and prioritized defenses.

Design Risk Rules

Design rules for [scenario] using [available fields]. Include rule IDs, conditions, actions, priorities, conflicts, and measurable review criteria.

Create a Backtest Plan

Create a backtest plan for [dataset] and [rules]. Define temporal splits, metrics, cost assumptions, leakage checks, and threshold selection.

Architect Real-Time Controls

Design a real-time fraud platform for [QPS] and [latency target]. Cover data flows, feature storage, decisioning, monitoring, resilience, and rollout.

Bewährte Praktiken

Validate rules and model thresholds on time-separated data before production rollout.
Combine deterministic rules, model scores, lists, and human review with explicit decision precedence.
Release controls gradually and monitor fraud capture, customer impact, review volume, latency, and drift.

Vermeiden

Do not execute untrusted rule expressions with eval or another general-purpose interpreter.
Do not optimize only for fraud capture while ignoring false positives, review capacity, and customer impact.
Do not use future information, random temporal splits, or post-decision fields during validation.

Häufig gestellte Fragen

What fraud scenarios does this skill cover?

It covers registration abuse, fake transactions, promotion abuse, account takeover, payment fraud, malicious automation, content abuse, and coordinated fraud.

Can it train a production fraud model?

It provides development templates and evaluation guidance. Production training still requires governed data, reproducible pipelines, security review, and domain validation.

Does it analyze CSV or database exports?

It can guide field mapping and analysis when data is provided. Data access and execution depend on the host tool and user permissions.

Can the sample rule engine process untrusted rules?

No. Its eval-based condition handling is unsafe and must be replaced with a constrained parser before handling untrusted rules.

Which evaluation metrics are recommended?

Use precision, recall, false-positive rate, review rate, prevented loss, customer impact, latency, and drift measures such as PSI.

Does this skill replace fraud analysts or legal review?

No. Analysts must validate assumptions, investigate cases, approve thresholds, and review privacy, fairness, legal, and operational impacts.

Entwicklerdetails

Autor

zl2023github

Lizenz

MIT

Skillstore-Revision

Versionshinweis

Der Autor hat keine Version angegeben.

Repository

https://github.com/zl2023github/software-engineer-skills/tree/main/software-engineering/risk-control-engineer

Ref.

88a8e9a07f4c54ab105c1c41b6267c287146b07b

Aktualität der Wartung

26.7.2026

Nutzung

2 Downloads · 1 Aufrufe

Dateistruktur

📄 SKILL.md