Skills risk-control-engineer
๐Ÿ“ฆ

risk-control-engineer

Content revision r2 Medium Risk โšก Contains scriptsโš™๏ธ External commands

Build Fraud Detection and Risk Controls

Fraud teams need practical methods to identify abuse, test controls, and monitor drift. This skill guides risk analysis, rules, models, backtesting, and real-time system design.

Supports: Claude Codex Code(CC)
โš ๏ธ 50 Poor

Install with my Agent

Copy this request to your Agent. It includes the canonical Skill page and manifest.

Agent request
Review the Skillstore skill "risk-control-engineer" from https://skillstore.io/skills/zl2023github-risk-control-engineer.md and its manifest at https://skillstore.io/api/skills/zl2023github-risk-control-engineer/manifest. Verify the artifact. You may proceed after verification, subject to the environment's own policy.

Your Agent should still show its plan and request any confirmation required by the security policy.

Test it

Using "risk-control-engineer". Assess coupon abuse during a new-user promotion.

Expected outcome:

  • Primary risks: account farming, device reuse, proxy registration, and coordinated redemption.
  • Prioritized controls: device-account velocity, payment-link analysis, staged rewards, and targeted review.
  • Validation: measure incremental fraud capture, legitimate-user impact, review load, and repeat attacker adaptation.

Using "risk-control-engineer". Plan a backtest for account-takeover rules.

Expected outcome:

  • Use an out-of-time holdout to preserve event order and prevent leakage.
  • Report recall, precision, false-positive rate, review volume, and estimated prevented loss.
  • Compare thresholds under documented investigation costs and customer impact limits.

Using "risk-control-engineer". Design monitoring for a production fraud model.

Expected outcome:

Monitor score distribution, PSI, approval rate, rejection rate, review rate, delayed fraud labels, latency, and feature freshness with defined owners.

Security Audit

Medium Risk
v4 โ€ข 7/23/2026 Open versioned report

The Python rule-engine example performs dynamic evaluation of rule text and is a confirmed code-execution risk. The 21 command alerts, two reconnaissance alerts, and entropy alert are false positives caused by Markdown fences, graph variables, and multilingual text. Two additional control-quality defects could hide rule failures or misstate backtest performance.

1
Files scanned
455
Lines analyzed
1
Review items
0
False positives ignored

Confirmed security concerns (2)

Medium
Rule Evaluation Fails Open
The rule engine catches every evaluation error and returns false. Invalid or malicious conditions can silently bypass controls instead of producing a review or rejection.
The broad exception handler directly converts every rule evaluation failure into a non-match. This behavior is explicit in the example.
Medium
Backtest Metrics Misstate Control Performance
The capture rate measures fraud prevalence instead of captured fraud, while the false-positive rate uses all labeled rows as its denominator. Decisions based on these metrics may weaken fraud controls.
The formulas visibly omit rule outcomes from capture rate and do not normalize false positives by legitimate cases. Standard confusion-matrix definitions confirm both errors.
Capability review items (1)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

High
Dynamic code evaluation with eval()
return bool(eval(condition, {\"__builtins__\": {}}, allowed_vars))
The rule engine evaluates condition text through eval with feature values as locals. Removing builtins does not prevent malicious expressions from traversing Python objects, so untrusted rules can execute unintended code.
Audited by: codex View Audit History โ†’
Share & cite this report

Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.

Open versioned report
Security Assessment

Copy report link

https://skillstore.io/skills/zl2023github-risk-control-engineer/audits/4?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown badge

[![Skillstore security assessment](https://skillstore.io/badges/skills/zl2023github-risk-control-engineer/security.svg)](https://skillstore.io/skills/zl2023github-risk-control-engineer?utm_source=security_passport_badge)

HTML badge

<a href="https://skillstore.io/skills/zl2023github-risk-control-engineer?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/zl2023github-risk-control-engineer/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Embed card

<iframe src="https://skillstore.io/embed/skills/zl2023github-risk-control-engineer.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>
Academic citations (APA ยท BibTeX ยท CFF)

APA citation

zl2023github. (2026). risk-control-engineer security audit report (audit version 4) [Author version unspecified]. Skillstore. https://skillstore.io/skills/zl2023github-risk-control-engineer/audits/4

BibTeX citation

@techreport{zl2023github-zl2023github-risk-control-engineer-2026, author = {zl2023github}, title = {risk-control-engineer security audit report (audit version 4)}, institution = {Skillstore}, year = {2026}, number = {4}, url = {https://skillstore.io/skills/zl2023github-risk-control-engineer/audits/4}, note = {Author version unspecified} }

CITATION.cff

cff-version: 1.2.0 message: "If you use this Skill, cite its author and this versioned security audit report." title: "risk-control-engineer security audit report (audit version 4)" version: "unspecified" type: report authors: - name: "zl2023github" date-released: "2026-07-23" url: "https://skillstore.io/skills/zl2023github-risk-control-engineer/audits/4" identifiers: - type: other value: "skillstore:zl2023github-risk-control-engineer:audit:4" description: "Skillstore immutable audit report identifier"

Skillstore Score

Why this score Evidence Confidence: Medium
55
Architecture
85
Maintainability
87
Content
65
Community
91
Spec Compliance

What You Can Build

Assess a New Abuse Scenario

Map likely attacks, affected workflows, evidence, control gaps, and prioritized defenses for a new product flow.

Plan Model and Rule Backtests

Define features, temporal validation, evaluation metrics, thresholds, and cost assumptions for candidate controls.

Design Real-Time Decisioning

Create a scalable architecture for streaming features, rule evaluation, model inference, case review, monitoring, and rollout.

Try These Prompts

Identify Fraud Risks
Analyze fraud risks for [business flow]. List attack paths, affected users, existing control gaps, and prioritized defenses.
Design Risk Rules
Design rules for [scenario] using [available fields]. Include rule IDs, conditions, actions, priorities, conflicts, and measurable review criteria.
Create a Backtest Plan
Create a backtest plan for [dataset] and [rules]. Define temporal splits, metrics, cost assumptions, leakage checks, and threshold selection.
Architect Real-Time Controls
Design a real-time fraud platform for [QPS] and [latency target]. Cover data flows, feature storage, decisioning, monitoring, resilience, and rollout.

Best Practices

  • Validate rules and model thresholds on time-separated data before production rollout.
  • Combine deterministic rules, model scores, lists, and human review with explicit decision precedence.
  • Release controls gradually and monitor fraud capture, customer impact, review volume, latency, and drift.

Avoid

  • Do not execute untrusted rule expressions with eval or another general-purpose interpreter.
  • Do not optimize only for fraud capture while ignoring false positives, review capacity, and customer impact.
  • Do not use future information, random temporal splits, or post-decision fields during validation.

Frequently Asked Questions

What fraud scenarios does this skill cover?
It covers registration abuse, fake transactions, promotion abuse, account takeover, payment fraud, malicious automation, content abuse, and coordinated fraud.
Can it train a production fraud model?
It provides development templates and evaluation guidance. Production training still requires governed data, reproducible pipelines, security review, and domain validation.
Does it analyze CSV or database exports?
It can guide field mapping and analysis when data is provided. Data access and execution depend on the host tool and user permissions.
Can the sample rule engine process untrusted rules?
No. Its eval-based condition handling is unsafe and must be replaced with a constrained parser before handling untrusted rules.
Which evaluation metrics are recommended?
Use precision, recall, false-positive rate, review rate, prevented loss, customer impact, latency, and drift measures such as PSI.
Does this skill replace fraud analysts or legal review?
No. Analysts must validate assumptions, investigate cases, approve thresholds, and review privacy, fairness, legal, and operational impacts.

Developer Details

License

MIT

Skillstore revision

r2

Version notice

The author did not declare a version.

Ref

88a8e9a07f4c54ab105c1c41b6267c287146b07b

Maintenance freshness

7/26/2026

Usage

2 downloads ยท 1 views

File structure

๐Ÿ“„ SKILL.md

More from zl2023github

View all
View all