Claude Skills by VincentChuWaiChow

Use this skill when reviewing advertising pixels and event-tracking for personal-data leakage to third-party ad networks. Trigger when a user provides a tag-manager container, a Meta/TikTok/Google/LinkedIn pixel snippet, a conversion-event payload, a dataLayer specification, or asks whether their tracking pixels leak email, phone numbers, health, or financial data to ad platforms, or whether pixels on sensitive pages create a breach or HIPAA exposure.

Use this skill when reviewing access governance across a marketing technology stack — OAuth grants and connected apps, API keys and tokens, CRM and marketing-automation role assignments, and integration scopes. Trigger when a user provides an OAuth connected-app inventory, an integration scope list, a CRM/MAP role matrix, an API-key inventory, or asks whether their martech integrations are over-permissioned, whether stale connectors still hold live tokens, or how to apply least privilege to t...

Use this skill when reviewing ads.txt, app-ads.txt, and sellers.json files for a publisher or advertiser's programmatic supply chain to detect unauthorized resellers, domain-spoofing exposure, and SupplyChain Object gaps. Trigger when a user provides an ads.txt file, an app-ads.txt file, a sellers.json endpoint response, or asks whether their programmatic supply chain has unauthorized intermediaries, IVT exposure, domain-spoofing risk, or whether their supply chain declaration satisfies IAB T...

Route Microsoft Copilot and Copilot Studio governance requests to the narrowest specialist or team of specialists from the catalog. Use when you do not already know the specialist. Not for direct Copilot governance answers; Maestro classifies, dispatches, and synthesizes only. Dispatches single agent for focused tasks, parallel team (max 4) for multi-domain tasks. Never auto-dispatches live-guard agents — requires explicit human confirmation with blast-radius and rollback before routing to an...

Review Microsoft Copilot Studio agent governance and application lifecycle management health including authentication configuration, DLP policies for connectors and actions, environment strategy, solution-based ALM across dev/test/prod, content moderation, analytics and telemetry, human-handoff and approval boundaries, sharing and publishing controls, and compliance posture via Microsoft Purview. Use to detect ungoverned agent publishing, overly permissive connector grants, absent DLP enforce...

Review Dynamics 365 Commerce across omnichannel retail operations — Store Commerce POS, e-commerce storefront, call center channels, Commerce Scale Unit, channel management, product catalogs and assortments, pricing and discounts, inventory visibility, and store operations. Use to resolve channel inconsistency, pricing and discount errors, POS and inventory sync issues, and Commerce Scale Unit deployment gaps. Static review only; production channel and pricing configuration changes are escala...

Review Dynamics 365 Customer Insights — Data (CDP: data unification, segments, measures) and Customer Insights — Journeys (real-time marketing journeys, triggers, consent/compliance, channel orchestration) design and configuration. Enforces unified profile completeness, segment quality gates, consent model correctness, journey logic review, and compliance posture. Refuses to approve production journey publish, bulk outreach, or consent-model changes without evidence of consent compliance and ...

Review Dynamics 365 Customer Service and Contact Center operations across the case-to-resolution lifecycle — case management, unified routing, Omnichannel for Customer Service, queues, entitlements, service-level agreements (SLAs), knowledge management, and Copilot in Service. Use to improve case resolution time, routing accuracy, knowledge reuse, omnichannel consistency, and CSAT. Static review only; production routing-rule, SLA, and channel configuration changes are escalated.

Review Dynamics 365 data migration planning and go-live cutover readiness. Enforces mock migration evidence, data quality gates, staging table validation, reconciliation controls, cutover runbook completeness, rollback plan, and owner sign-off before production migration. Refuses to bless production cutover without reconciliation evidence and rollback plan. Production data migration is live-guard gated and requires escalation.

Review Dynamics 365 Field Service operations across the service-to-cash (now "service to deliver") lifecycle — work order management, Universal Resource Scheduling, schedule board and Resource Scheduling Optimization, bookable resources, technician mobile execution, asset and preventive maintenance, inventory/truck stock, and work-order-to-invoice billing. Use to improve first-time-fix rate, scheduling efficiency, and service revenue capture. Static review only; production scheduling-engine a...

Review Dynamics 365 Finance general ledger configuration, sub-ledger reconciliation, period-end and year-end close procedures, financial consolidation and elimination, posting profiles, tax setup, and financial reporting controls. Enforces reconciliation-before-close discipline, detects control gaps in posting configuration and period-close task coverage, and requires live-guard escalation before production period-close or posting-configuration changes. Refuses to approve a close process with...

Review Dynamics 365 Finance & Operations developer and extension engineering work — X++ extensions (not over-layering), Chain of Command, extension models, deployable packages, Azure DevOps and Lifecycle Services ALM, build and test automation, upgrade-safe customization, and performance. Detects unsafe customizations, upgrade blockers, fragile extensions, and ALM anti-patterns. Refuses to approve production deployable package deployment or schema changes without sandbox validation evidence a...

Review Dynamics 365 integration design and operations — dual-write (Finance & Operations to/from Dataverse bidirectional sync), virtual entities, table map configuration, initial sync planning, error handling and monitoring, master-data ownership, and Power Platform integration boundary. Detects ERP/CRM data inconsistency, dual-write drift, integration failures, and broken master-data ownership. Refuses to approve enabling or disabling dual-write table maps in production or initial sync runs ...

Mutating-runtime live-guard for updating one or more named fields on a single Dataverse row identified by table and record GUID, via the Dataverse Web API PATCH (data plane). Strictly scoped — one record, named fields only. Requires explicit written human approval token referencing the exact target, proposed change, and blast-radius. PREFLIGHT performs a dry-run diff before any write. Fully reversible — prior field values are captured and the inverse PATCH is the rollback. Gate-only; never au...

Live read-only Dataverse security posture discovery — enumerate security roles, team and business-unit assignments, application users, over-privileged System Administrator assignments, and SoD-relevant privilege combinations — then propose least-privilege role design with rollback plan. Phase A read-only-runtime only; no mutation. Operates on the Dataverse data plane via a custom read-only security role, never via the Power Platform management SPN path.

Route Dynamics 365 tasks to the narrowest D365 specialist from the catalog. Use when you do not already know the specialist. Not for direct D365 answers; Maestro classifies, dispatches, and synthesizes only. Dispatches single agent for focused tasks, parallel team (max 4) for multi-domain tasks. Enforces Success by Design gates and segregation-of-duties escalation. Never auto-dispatches live-guard agents — requires explicit human confirmation with blast-radius and rollback before routing to a...

Review Dynamics 365 Project Operations across the project-to-profit lifecycle — project contracts, project planning and scheduling, resource management and assignment, time and expense, project budgeting and cost control, billing and revenue recognition, and integration with Dynamics 365 Finance. Use to reduce project-based revenue leakage, improve resource utilization, correct billing method mismatches, and resolve revenue-recognition configuration errors. Static review only; production proj...

Review and advise on Dynamics 365 Sales revenue operations — pipeline and opportunity management, sales forecasting, lead qualification, sales accelerator configuration, CRM data hygiene, and sales insights. Detects pipeline trust gaps, forecast inaccuracy, CRM hygiene failures, and revenue leakage patterns. Refuses to approve live production forecast configuration or sales-process changes without live-guard escalation. Static review and advisory only.

Review Dynamics 365 Finance & Operations security role design, duty and privilege assignments, segregation of duties (SoD) conflict rules, user-role assignments, and audit evidence for least-privilege compliance. Enforces SoD conflict detection, security reports review, role layering analysis, and privileged access controls. Refuses to approve role changes that introduce SoD conflicts or bypass audit controls. Production role changes are live-guard gated and require escalation.

Review Dynamics 365 implementation governance against the Success by Design framework. Enforces the five Success by Design phases (Strategize, Initiate, Implement, Prepare, Operate), mandatory Solution Blueprint Review, fit-to-standard and fit-gap discipline, customization sprawl controls, FastTrack implementation gates, and go-live readiness evidence. Refuses to bless go-live without documented phase gate evidence and stakeholder sign-off. Production deployment is live-guard gated and requir...

Review Dynamics 365 Supply Chain Management master planning (Planning Optimization/MRP), inventory management accuracy, procurement and sourcing configuration, warehouse management setup, and production control parameters including BOMs and routes. Enforces data-accuracy-before-planning discipline, detects coverage-settings and BOM configuration gaps, and requires live-guard escalation before production master-planning parameter or item-coverage changes. Refuses to approve planning output wit...

Review Microsoft Fabric analytics engineering artifacts — Fabric Data Warehouse T-SQL design and anti-patterns, dimensional modeling (star schema, fact and dimension tables, relationships), semantic model design (Direct Lake vs Import vs DirectQuery selection, table layout, relationship cardinality), DAX measure correctness and optimization (iterators, filter context, variables, CALCULATE), data preparation and transformation quality, and reusable certified semantic models feeding Power BI re...

Review Microsoft Fabric data engineering artifacts — Lakehouse and OneLake design, medallion (bronze/silver/gold) architecture, Spark notebooks and Spark job definitions, Data pipelines and Dataflows Gen2, Delta/Parquet storage and OneLake shortcuts, Real-Time Intelligence (eventstreams, KQL databases, eventhouse), Direct Lake semantic-model source design, ingestion and orchestration patterns, Capacity Unit (CU) efficiency, and Git integration and deployment pipelines for engineering items. U...

Review Microsoft Fabric and Power BI business-insights governance — semantic model trust (shared/endorsed/certified models, Build permission), row-level and object-level security, workspace roles, OneLake catalog discoverability and lineage, sensitivity labels and Microsoft Purview DLP for Power BI, certified-dataset reuse, and capacity oversight. Use to fix metric mistrust, semantic-model sprawl, and inconsistent executive dashboards. Static review only; production workspace-role, RLS, and c...

Review Microsoft 365 backup posture and business continuity readiness — Microsoft 365 Backup coverage for Exchange Online, SharePoint, and OneDrive; retention-versus-backup distinction; ransomware recovery readiness; RPO and RTO targets; Backup Storage architecture; and third-party backup solution boundary guidance. Static review and advisory only; restore operations and backup-policy changes are live-guard gated.

Review Microsoft 365 Copilot readiness posture and data-exposure governance against the Microsoft Zero Trust 7-layer model. Covers oversharing assessment, SharePoint Advanced Management controls, Microsoft Purview sensitivity labels and DLP, Microsoft Graph permission scope, connector and plugin risk, and user permissions to data. Refuse to recommend Copilot enablement without a completed oversharing and permissions baseline. Prefer static review and advisory guidance; escalate live-tenant co...

Review Microsoft Defender XDR security operations (SecOps) posture — unified incident queue, alert correlation, advanced hunting with KQL, automated investigation and response (AIR), Defender for Office 365 / Endpoint / Identity / Cloud Apps signal, incident triage and severity assessment, containment and response runbooks, and integration with Microsoft Sentinel. Apply Zero Trust assume-breach. Cert anchor: SC-200 Security Operations Analyst Associate. Static review and advisory only; contai...

Review and advise on Exchange Online and SharePoint Online plus OneDrive information governance covering mailbox and site lifecycle, external and anonymous sharing controls, SharePoint Advanced Management (Restricted Content Discovery, site access reviews, data access governance reports), retention and records management via Microsoft Purview, oversharing remediation feeding Microsoft 365 Copilot readiness, and information architecture. Cert anchor MS-102. Static review and advisory only; ten...

Review Microsoft Entra identity posture, Conditional Access policy design, MFA coverage, Privileged Identity Management (PIM) configuration, access reviews, and least-privilege role assignments against the Zero Trust identity pillar. Static review and advisory only; designing or reviewing Conditional Access baselines, PIM eligible/active role assignments, and access review cadences. Refuse to weaken MFA or Conditional Access for convenience. Escalate live-tenant configuration changes to live-...

Review and advise on Microsoft Intune endpoint management posture covering device enrollment, compliance policies, configuration profiles, app protection (MAM) policies, Conditional Access device-compliance signal, Windows Autopilot, update rings, and endpoint security baselines. Applies Zero Trust device-health-as-signal principles. Static review and advisory only; production compliance-policy or Conditional Access-impacting changes and device wipe or retire actions are live-guard gated. Ref...

Review Microsoft 365 licensing posture and Enterprise Agreement optimization — SKU and plan fit analysis across E3, E5, F-SKUs and add-ons; group-based licensing assignment hygiene; unassigned and over-assigned license detection; true-up planning guidance; and cost-versus-capability analysis for EA, CSP, and MCA contract types. Advisory only; never make purchase commitments or guarantee savings. Group-based-licensing changes in production are live-guard gated.

Live read-only Microsoft Entra identity and Conditional Access posture discovery — enumerate CA policies, MFA coverage gaps, privileged role assignments and PIM configuration, risky sign-ins, and stale guest accounts — then propose least-privilege hardening steps with blast-radius assessment and rollback plan. Phase A read-only-runtime only; no mutation.

Mutating-runtime live-guard for applying ONE Microsoft Purview sensitivity label to ONE specified item (file/driveItem) via the Microsoft Graph assignSensitivityLabel action. Strictly scoped — one item, one label application. Requires explicit written human approval token referencing the exact item, proposed label, and blast-radius. PREFLIGHT reads the item's current label before any write. Fully reversible — prior label captured; re-apply prior label is the rollback. Gate-only; never auto-di...

Route Microsoft 365 tasks to the narrowest M365 specialist from the catalog. Use when you do not already know the specialist. Not for direct M365 answers; Maestro classifies, dispatches, and synthesizes only. Dispatches single agent for focused tasks, parallel team (max 4) for multi-domain tasks. Never auto-dispatches live-guard agents — requires explicit human confirmation with blast-radius and rollback before routing to any agent that changes live tenant configuration.

Review Microsoft Purview data security and compliance posture — sensitivity labels and information protection, Data Loss Prevention (DLP including Endpoint DLP and Adaptive Protection), data lifecycle and retention policies, Insider Risk Management, eDiscovery and legal hold, Audit (Premium), and Data Security Posture Management (DSPM) for AI oversharing. Cert anchor: SC-401 Information Security Administrator Associate (replaced SC-400 on 2025-05-31). Static review and advisory only; producti...

Review and advise on Microsoft Teams collaboration and communications governance covering Teams and Microsoft 365 group lifecycle and sprawl, external access and guest sharing controls, sensitivity labels on Teams and groups, meeting and messaging policies, phone and voice governance, and app permission policies. Cert anchor MS-700 Teams Administrator. Static review and advisory only; tenant-wide external-access or sharing-policy changes are live-guard gated. Refuses to weaken guest sharing o...

Review Microsoft 365 tenant governance posture — admin role and RBAC sprawl, service change and release governance via Message Center, organization-wide settings, Microsoft Secure Score governance actions, delegated admin and GDAP least-privilege configuration, and multi-workload policy coordination. Static review and advisory only; tenant-wide org settings and admin-role assignment changes are live-guard gated. Aligned to MS-102 governance domain.

Review Microsoft 365 and Copilot value realization — license-to-value, adoption measurement, and ROI. Covers Copilot Control System measurement and reporting, Copilot Analytics and the Copilot Dashboard, Adoption Score and AI adoption score, the Microsoft 365 Copilot readiness/usage reports, license assignment optimization, and FastTrack adoption guidance. Use to turn license spend into measurable productivity and business outcomes. Advisory only; never makes licensing purchase commitments.

Route Microsoft SaaS tasks to the right sub-maestro (m365-maestro-agent, d365-maestro-agent, power-platform-maestro-agent, copilot-governance-maestro-agent) or directly to a specialist. Use when you do not already know the specialist. Not for direct Microsoft answers; Maestro classifies, dispatches, and synthesizes only. Dispatches single sub-maestro or agent for focused tasks, parallel team (max 4) for multi-domain tasks. Refuses Azure IaaS and infrastructure tasks and deflects to azure-maes...

Review Power Automate cloud flow risk and governance — flow ownership and sharing (run-only vs co-owner), connector and DLP exposure, maker-vs-run-only security segmentation, error handling and retry/terminate patterns, monitoring and alerting, credential/connection lifecycle, and Center of Excellence auditing. Use to harden fragile, unowned, or over-privileged business-critical automations. Static review only; production DLP and flow-ownership changes are escalated.

Review Power Platform application lifecycle management health across managed and unmanaged solutions, Power Platform Pipelines, environment strategy (dev/test/prod), solution layering, connection references, environment variables, source control via Git integration, and deployment gates. Use to detect unhealthy ALM patterns, missing rollback paths, and ungoverned production deployments. Static review only; production pipeline and deployment-configuration changes are escalated.

Review and advise on Power Platform environment strategy, Data Loss Prevention (DLP) policy design, Dataverse security model, business unit hierarchy, security roles and teams, table/row/column-level permissions, connector governance, and Center of Excellence (CoE) alignment. Flags environment sprawl, weak DLP, unmanaged connectors, over-privileged Dataverse roles, insecure ad-hoc sharing, and misaligned business unit design. Static review only — no live tenant mutations. Escalates production...

Route Power Platform tasks to the narrowest specialist or team of specialists from the catalog. Use when you do not already know the specialist. Not for direct Power Platform answers; Maestro classifies, dispatches, and synthesizes only. Dispatches single agent for focused tasks, parallel team (max 4) for multi-domain tasks. Never auto-dispatches live-guard agents — requires explicit human confirmation with blast-radius and rollback before routing to any production environment deployment or t...

Flashlight skill for reviewing NetSuite account administration configurations aligned to the Administrator Professional certification (N16291GC10). T0 static review — no live account connection required, never Administrator role. TRIGGER when: user asks to review accounting preferences, tax nexus setup, currency management, user provisioning policy, email template defaults, sandbox refresh procedures, release preview planning, or account-level system preferences in NetSuite. Trigger phrases: ...

Flashlight skill for reviewing the security and governance posture of NetSuite AI Connector Service (MCP) deployments. Verifies exact required permissions ('MCP Server Connection' and 'Log in using OAuth 2.0 Access Tokens' — not 'Log in using Access Tokens'), confirms the connecting role is never Administrator, validates explicit tool allowlists, checks HIPAA/BAA restrictions, and reviews prompt-injection testing coverage. T0 static review — no live account connection required. Depends on Ora...

Flashlight skill for reviewing NetSuite AI feature enablement and AI Connector Service configuration posture, aligned to the AI Foundations Associate certification (N16765GC10, available). T0 static review — no live account connection required. NOTE: AI Specialist and AI Professional certifications are COMING SOON and are not yet available; this skill does not cover those levels. TRIGGER when: user asks to review NetSuite AI feature enablement (bill matching, anomaly detection, text enhanceme...

Reviews NetSuite SuiteScript 2.x code, SuiteFlow workflows, SuiteBuilder customizations, and UIF SPA components against Application Developer Professional standards. Depends on netsuite-suitescript-records-reference (272 record types) and netsuite-uif-spa-reference (@uif-js API) as upstream Oracle UPL-1.0 reference contexts. TRIGGER when: user asks to review or write SuiteScript, design a SuiteFlow workflow, configure a custom record or field, build a UIF SPA component, or review a script dep...

Flashlight skill for reviewing NetSuite financial governance and SOX internal control configurations. T0 static review — no live account connection required. TRIGGER when: user asks to review segregation of duties, SoD conflicts, posting period controls, period-close procedures, revenue recognition schedules, approval workflow chains for journal entries or vendor bills, audit trail completeness, or SOX walkthrough evidence in NetSuite. Trigger phrases: SOX review, segregation of duties, SoD c...

Reviews and designs NetSuite reports, dashboards, and KPI definitions against BI & Reporting Associate/Specialist standards. Validates data-source scoping, period and subsidiary filters, KPI formula correctness, and financial narrative accuracy. TRIGGER when: user asks to review or design a NetSuite report, dashboard, KPI meter, financial narrative, chart, pivot, or executive summary; phrases include 'build a dashboard', 'review my report', 'create a KPI', 'why does this report show X', 'conf...

Flashlight skill for auditing PII exposure paths, data retention and purge policies, field-level access restrictions, privacy controls, and export configurations in NetSuite. T0 static review — no live account connection or actual personal data required. TRIGGER when: user asks to review PII field access, audit data retention settings, check field-level security on sensitive records, assess privacy controls, identify PII in saved searches, review export control permissions, or evaluate GDPR/C...