技能 risk-control-engineer
📦
risk-control-engineer
内容修订 r2 中风险 ⚡ 包含脚本⚙️ 外部命令
Build Fraud Detection and Risk Controls
Fraud teams need practical methods to identify abuse, test controls, and monitor drift. This skill guides risk analysis, rules, models, backtesting, and real-time system design.
支持: Claude Codex Code(CC)
使用我的智能体安装
将此请求复制给你的智能体，其中包含权威 Skill 页面和清单。
智能体请求
Review the Skillstore skill "risk-control-engineer" from https://skillstore.io/skills/zl2023github-risk-control-engineer.md and its manifest at https://skillstore.io/api/skills/zl2023github-risk-control-engineer/manifest. Verify the artifact. You may proceed after verification, subject to the environment's own policy.你的智能体仍应展示其计划，并按安全策略请求必要确认。
Agent 可读资源
当 AI Agent、爬虫或脚本需要干净上下文，而不是读取完整页面时，请使用这些链接。
测试它
正在使用“risk-control-engineer”。 Assess coupon abuse during a new-user promotion.
预期结果:
- Primary risks: account farming, device reuse, proxy registration, and coordinated redemption.
- Prioritized controls: device-account velocity, payment-link analysis, staged rewards, and targeted review.
- Validation: measure incremental fraud capture, legitimate-user impact, review load, and repeat attacker adaptation.
正在使用“risk-control-engineer”。 Plan a backtest for account-takeover rules.
预期结果:
- Use an out-of-time holdout to preserve event order and prevent leakage.
- Report recall, precision, false-positive rate, review volume, and estimated prevented loss.
- Compare thresholds under documented investigation costs and customer impact limits.
正在使用“risk-control-engineer”。 Design monitoring for a production fraud model.
预期结果:
Monitor score distribution, PSI, approval rate, rejection rate, review rate, delayed fraud labels, latency, and feature freshness with defined owners.
安全审计
中风险v4 • 2026/7/23 打开版本化报告
The Python rule-engine example performs dynamic evaluation of rule text and is a confirmed code-execution risk. The 21 command alerts, two reconnaissance alerts, and entropy alert are false positives caused by Markdown fences, graph variables, and multilingual text. Two additional control-quality defects could hide rule failures or misstate backtest performance.
1
已扫描文件
455
分析行数
1
复核项
0
已忽略误报
已确认安全问题 (2)
中
Rule Evaluation Fails Open
The rule engine catches every evaluation error and returns false. Invalid or malicious conditions can silently bypass controls instead of producing a review or rejection.
The broad exception handler directly converts every rule evaluation failure into a non-match. This behavior is explicit in the example.
中
Backtest Metrics Misstate Control Performance
The capture rate measures fraud prevalence instead of captured fraud, while the false-positive rate uses all labeled rows as its denominator. Decisions based on these metrics may weaken fraud controls.
The formulas visibly omit rule outcomes from capture rate and do not normalize false positives by legitimate cases. Standard confusion-matrix definitions confirm both errors.
能力复核项 (1)
这些是真实的本地能力，对此技能可能是预期行为，因此需要复核，但不会按已确认恶意行为计分。
高
Dynamic code evaluation with eval()
return bool(eval(condition, {\"__builtins__\": {}}, allowed_vars))
The rule engine evaluates condition text through eval with feature values as locals. Removing builtins does not prevent malicious expressions from traversing Python objects, so untrusted rules can execute unintended code.
风险因素
⚡ 包含脚本 (1)
⚙️ 外部命令 (21)
SKILL.md:59-69 SKILL.md:69-81 SKILL.md:81-89 SKILL.md:89-101 SKILL.md:101-111 SKILL.md:111-123 SKILL.md:123-131 SKILL.md:131-146 SKILL.md:146-183 SKILL.md:183-186 SKILL.md:186-216 SKILL.md:216-219 SKILL.md:219-263 SKILL.md:263-266 SKILL.md:266-304 SKILL.md:304-307 SKILL.md:307-355 SKILL.md:355-358 SKILL.md:358-394 SKILL.md:394-397 SKILL.md:397-425
审计者: codex 查看审计历史 →
分享与引用此报告
分享版本化评估报告、中性徽章、嵌入卡片和引用。Skillstore 只报告证据，不判断该 Skill 是否安全。
复制报告链接
https://skillstore.io/skills/zl2023github-risk-control-engineer/audits/4?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_reportMarkdown 徽章
[](https://skillstore.io/skills/zl2023github-risk-control-engineer?utm_source=security_passport_badge)HTML 徽章
<a href="https://skillstore.io/skills/zl2023github-risk-control-engineer?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/zl2023github-risk-control-engineer/security.svg" alt="Skillstore security assessment" loading="lazy"></a>嵌入卡片
<iframe src="https://skillstore.io/embed/skills/zl2023github-risk-control-engineer.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>学术引用 (APA · BibTeX · CFF)
APA 引用
zl2023github. (2026). risk-control-engineer security audit report (audit version 4) [Author version unspecified]. Skillstore. https://skillstore.io/skills/zl2023github-risk-control-engineer/audits/4BibTeX 引用
@techreport{zl2023github-zl2023github-risk-control-engineer-2026,
author = {zl2023github},
title = {risk-control-engineer security audit report (audit version 4)},
institution = {Skillstore},
year = {2026},
number = {4},
url = {https://skillstore.io/skills/zl2023github-risk-control-engineer/audits/4},
note = {Author version unspecified}
}CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "risk-control-engineer security audit report (audit version 4)"
version: "unspecified"
type: report
authors:
- name: "zl2023github"
date-released: "2026-07-23"
url: "https://skillstore.io/skills/zl2023github-risk-control-engineer/audits/4"
identifiers:
- type: other
value: "skillstore:zl2023github-risk-control-engineer:audit:4"
description: "Skillstore immutable audit report identifier"
Skillstore 评分
评分依据 证据置信度: 中 55
架构
85
可维护性
87
内容
65
社区
91
规范符合性
你能构建什么
Assess a New Abuse Scenario
Map likely attacks, affected workflows, evidence, control gaps, and prioritized defenses for a new product flow.
Plan Model and Rule Backtests
Define features, temporal validation, evaluation metrics, thresholds, and cost assumptions for candidate controls.
Design Real-Time Decisioning
Create a scalable architecture for streaming features, rule evaluation, model inference, case review, monitoring, and rollout.
试试这些提示
Identify Fraud Risks
Analyze fraud risks for [business flow]. List attack paths, affected users, existing control gaps, and prioritized defenses.
Design Risk Rules
Design rules for [scenario] using [available fields]. Include rule IDs, conditions, actions, priorities, conflicts, and measurable review criteria.
Create a Backtest Plan
Create a backtest plan for [dataset] and [rules]. Define temporal splits, metrics, cost assumptions, leakage checks, and threshold selection.
Architect Real-Time Controls
Design a real-time fraud platform for [QPS] and [latency target]. Cover data flows, feature storage, decisioning, monitoring, resilience, and rollout.
最佳实践
- Validate rules and model thresholds on time-separated data before production rollout.
- Combine deterministic rules, model scores, lists, and human review with explicit decision precedence.
- Release controls gradually and monitor fraud capture, customer impact, review volume, latency, and drift.
避免
- Do not execute untrusted rule expressions with eval or another general-purpose interpreter.
- Do not optimize only for fraud capture while ignoring false positives, review capacity, and customer impact.
- Do not use future information, random temporal splits, or post-decision fields during validation.
常见问题
What fraud scenarios does this skill cover?
It covers registration abuse, fake transactions, promotion abuse, account takeover, payment fraud, malicious automation, content abuse, and coordinated fraud.
Can it train a production fraud model?
It provides development templates and evaluation guidance. Production training still requires governed data, reproducible pipelines, security review, and domain validation.
Does it analyze CSV or database exports?
It can guide field mapping and analysis when data is provided. Data access and execution depend on the host tool and user permissions.
Can the sample rule engine process untrusted rules?
No. Its eval-based condition handling is unsafe and must be replaced with a constrained parser before handling untrusted rules.
Which evaluation metrics are recommended?
Use precision, recall, false-positive rate, review rate, prevented loss, customer impact, latency, and drift measures such as PSI.
Does this skill replace fraud analysts or legal review?
No. Analysts must validate assumptions, investigate cases, approve thresholds, and review privacy, fairness, legal, and operational impacts.
开发者详情
作者
zl2023github许可证
MIT
Skillstore 修订
r2
版本提示
作者未声明版本。
引用
88a8e9a07f4c54ab105c1c41b6267c287146b07b
维护新鲜度
2026/7/26
使用量
2 次下载 · 1 次浏览
文件结构
📄 SKILL.md