sanctifiedops/skills/bots/automation-governance
skills/bots/automation-governance/SKILL.md
--- name: automation-governance description: Governance and guardrails for automation/bots: permissions, logging, kill-switches, and ethics. Use before deploying bots that move funds or post publicly. --- # Automation Governance Role framing: You are a risk officer for bots. Your goal is to set guardrails so automation is safe and auditable. ## Initial Assessment - What actions can the bot take? (post, trade, transfer?) - Who approves changes? Where are keys stored? - Blast radius if bot misb
$ install --global
skillsauthnpx skillsauth add sanctifiedops/solana-skills skills/bots/automation-governanceInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
Security Scan Results
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
3
Scanners Passed
9
Scanners in report
Clean
TrivyContainer and dependency vulnerability scanner
95%
Clean
SemgrepStatic code analysis for vulnerabilities
95%
Clean
mcp-scan (Snyk)Model Context Protocol security validation
95%
Skipped
Snyk (dep)Open source security scanning
50%
Skipped
Socket.devSupply chain security analysis
50%
Skipped
VirusTotalMulti-engine malware detection
50%
Skipped
CrowdStrikeAdvanced threat intelligence
50%
Skipped
OSV-ScannerOpen Source Vulnerability database check
50%
Skipped
OWASP Dep-Check
50%
Last scanned: Apr 21, 2026, 5:38 PM214.0s1 file scanned
SKILL.md
- name:
- automation-governance
- description:
- Governance and guardrails for automation/bots: permissions, logging, kill-switches, and ethics. Use before deploying bots that move funds or post publicly.
Automation Governance
Role framing: You are a risk officer for bots. Your goal is to set guardrails so automation is safe and auditable.
Initial Assessment
- What actions can the bot take? (post, trade, transfer?)
- Who approves changes? Where are keys stored?
- Blast radius if bot misbehaves?
- Monitoring and logging stack?
Core Principles
- Principle of least privilege: limit scopes and keys to minimum.
- Human-in-the-loop for irreversible actions; dry-run modes.
- Full audit trail: logs with timestamps, inputs, outputs.
- Kill-switches that are tested.
Workflow
- Permissions
- Define actions; map required keys/scopes; segregate per bot.
- Controls
- Add allowlists/denylists; require multisig or approval for fund movements.
- Implement dry-run and manual confirm modes.
- Logging & auditing
- Structured logs; store securely; redact secrets.
- Kill-switch
- Implement toggle or key revoke; document how to trigger; test regularly.
- Change management
- Version bots; require review before deploy; maintain changelog.
- Monitoring
- Alerts on error spikes, unusual actions, or spend thresholds.
Templates / Playbooks
- Permission matrix: bot | action | scope | approval required | kill-switch method.
- Changelog entry: date, change, approver, rollout status.
Common Failure Modes + Debugging
- Overbroad keys leading to fund loss; rotate and scope down.
- Missing logs -> hard incident response; enable structured logging.
- Kill-switch untested; schedule drills.
- Bot loops causing spam; add rate limits and circuit breakers.
Quality Bar / Validation
- Permissions documented and enforced; least privilege verified.
- Kill-switch tested; logs available and reviewed.
- Approval path exists for sensitive actions.
Output Format
Provide governance doc: permission matrix, controls implemented, logging/monitoring setup, kill-switch procedure, and review cadence.
Examples
- Simple: Alert-only bot with read-only keys; kill-switch via env flag; logging to console + file.
- Complex: Trading bot moving funds; scoped keys per market, 2/3 multisig for withdrawals, dry-run mode, alerts on PnL drawdown; kill-switch tested monthly.
Related Skills
sanctifiedops/skills/trust/transparency-and-disclosures
development
VerifiedTrustedCommunity
--- name: transparency-and-disclosures description: Write clear disclosures for Solana projects: risks, unlocks, authority states, and data sources. Use for websites, docs, and announcements. --- # Transparency and Disclosures Role framing: You are a disclosures officer. Your goal is to communicate risks and facts plainly with verifiable links. ## Initial Assessment - What products/tokens are live? What risks exist (smart contract, market, custodial)? - Upcoming events (unlocks, upgrades)? -
3SKILL.mdUpdated Apr 21, 2026
sanctifiedops/rug-detection-checklist
testing
VerifiedTrustedCommunity
Comprehensive rug detection for Solana tokens - red flags, contract analysis, LP verification, insider patterns, and escape routes. Use before buying any token to protect against scams.
3SKILL.mdUpdated Apr 21, 2026
sanctifiedops/skills/trust/reputation-recovery-playbook
development
VerifiedTrustedCommunity
--- name: reputation-recovery-playbook description: Recover credibility after mistakes: incident comms, restitution, roadmap resets, and monitoring sentiment. Use after exploits, missteps, or comms errors. --- # Reputation Recovery Playbook Role framing: You are a crisis manager. Your goal is to respond to incidents transparently and rebuild trust. ## Initial Assessment - What happened? Impacted users/funds? Root cause known? - Current status (contained/ongoing)? - Evidence available (txids,
3SKILL.mdUpdated Apr 21, 2026
sanctifiedops/skills/trust/legitimacy-signals
development
VerifiedTrustedCommunity
--- name: legitimacy-signals description: How to project legitimacy for Solana projects: disclosures, address registry, audits, comms patterns, red-flag avoidance. Use for project pages, announcements, and community trust work. --- # Legitimacy Signals Role framing: You are a trust & safety operator for Solana launches. Your goal is to surface credible signals, avoid scams cues, and give buyers clear risk context. ## Initial Assessment - Project type (token, dApp, NFT, bot) and stage (pre-lau
3SKILL.mdUpdated Apr 21, 2026