Hire an AI store account security reviewer

Everything it can hand back

Your task sets the actual outputs. The specialist picks the methods that cover them.

• A security score out of 100 across eight checks, with fixes ranked for today, this month and this quarter
• A sign-in score out of 100, ranked gaps and a one-page policy for passwords, second steps, recovery and risky changes
• A one-page phishing rule sheet in plain words, and a ten-minute drill with ten sample cases and answers
• A quarterly routine to keep it all current

How it does the job well

• Name the asset, the threat and the impact before recommending controls.
• Rank findings by real risk (likelihood and impact), with evidence for each.
• Prefer fixes that remove a problem over warnings that rely on people.
• Cite the exact law, standard or clause for compliance and legal points, and recommend qualified review.

Mistakes it avoids

• Long lists of generic issues with no evidence they apply.
• Testing or scanning systems without permission.
• Presenting a legal opinion as final.

What a good result looks like

An example, not your task: You have staff, contractors or agencies with admin access and have never reviewed who still needs it.

• Store security checkup. A score out of 100 across eight checks, with fixes ranked for today, this month and this quarter.
• Sign-in check. Ranked gaps in passwords, second steps and recovery, and a one-page sign-in policy.
• Phishing rules. A one-page rule sheet for staff, who to tell, and a ten-case drill with answers.
• HAND-BACK SUMMARY. Each step's file and every MISSING line in one list.

How the work is checked

• Each step passed its own checks, or the run stopped at the step that failed and says why.
• The steps ran in order, and each one used the result of the one before.
• Nothing was invented to fill a gap. Every gap is a MISSING: line.
• Nothing was sent, published or paid for without a clear yes.
• States which checks passed, failed or could not run, and names missing inputs.

These checks have not been run against a model yet. Your AI uses them to check its own work.

Capabilities

• Check your store security. Splits what your platform covers from what you cover, scores eight basics, and ranks the fixes into today, this month and this quarter.
• Check sign-in security. Pauses while you do today's fixes. Then ranks gaps in password rules, second steps and recovery, and writes the one-page policy.
• Brief staff on phishing. Pauses while you share the policy. Then writes the staff rule sheet and a ten-minute drill with made-up example addresses.

How the role works

1. Checks your task, context and available tools.
2. Picks the methods needed and prepares a work plan.
3. Carries out supported tasks, with each method's limits and review gates.
4. Checks the real deliverables and corrects supported faults.
5. Hands back files, evidence and unresolved gaps.

Your specialist's working setup

Download the base specialist without a task form or account. README.md and SETUP.md explain how to use the folder. SOUL.md defines its scope. INTAKE.md asks missing questions inside your AI. PLAYBOOK.md, SKILLS.md, BEST_PRACTICES.md, CHECKS.md and HANDOFF.md guide the work and its checked deliverables.

Complete associated skills, supporting files and licences are included. Choose only the methods needed for the actual task. Keep context, working files and accepted feedback in your AI project.

Use this specialist through MCP or the API

Call prepare_specialist with role_id lock-down-your-store-logins-and-staff-against-takeover only. No task is required to load it. Your AI asks what job you need done, what you want back and which relevant context it can use.

For task-led hiring, call find_specialist, explain the suggested specialists and let the user accept or change the team.

Complete ZIP: Download base specialist. API: GET /api/v1/specialists/lock-down-your-store-logins-and-staff-against-takeover/pack. The host AI supplies its own model, tools and execution; a pack does not connect accounts or run a task.

Inputs and helpful context

The specialist starts from the task brief. Only active methods require their inputs.

For the primary method, when used

• Your platform, such as Shopify, WooCommerce or a custom store
• Everyone with admin or staff access, their role and whether they are staff or a contractor
• Your installed apps and the permissions each one has
• How people sign in, your password rules today and what support does on a forgotten password
• The accounts that matter most, such as store admin, email, ad accounts and your domain, and whether you use a password manager

Tools and access

• Any good chat AI: Any current chat AI can run the checkup. Paste your admin list and app permissions as text.
• A password manager such as Bitwarden or 1Password: It covers the password check, and most teams can share one vault with roles.
• Any good chat AI: Any current chat AI can run this from a written description of your sign-in setup.
• Have I Been Pwned: A free breach lookup. It shows whether staff email addresses appear in known breaches.
• A password manager such as Bitwarden or 1Password: It only fills a password on the real site, so it works as the team's phishing alarm.
• Security keys or passkeys: They refuse to sign in on a fake site. Use them for email, store admin, ad accounts and your registrar.
• Any good chat AI: Any current chat AI can write the sheet and drill from your short list.

Functions and deliverables

• Store account security reviewer: Describe store accounts, staff access and apps without sharing secrets. Get gap priorities, a sign-in policy draft and phishing guidance.
  • A security score out of 100 across eight checks, with fixes ranked for today, this month and this quarter
  • A sign-in score out of 100, ranked gaps and a one-page policy for passwords, second steps, recovery and risky changes
  • A one-page phishing rule sheet in plain words, and a ten-minute drill with ten sample cases and answers
  • A quarterly routine to keep it all current
• Store security reviewer: Describe your admin team and apps. Get a ranked security fix list, a score and a quarterly routine.
  • A score out of 100 with the points listed for each of the 8 checks
  • Fixes ranked into do today, this month and this quarter
  • A list of what your platform already covers, so you do not buy what you do not need
  • A one-page routine to repeat every quarter
• Sign-in security checker: Describe how staff and customers sign in. Get gaps ranked, a score and a password and second-step policy.
  • Gaps ranked by risk, each with a fix
  • A score out of 100 with how it was counted
  • A one-page password and second-step policy for your team or developer
  • A list of checks that did not apply to your platform
• Staff phishing awareness trainer: Share your tools and team size. Get a one-page phishing rule sheet and a ten-minute drill with answers.
  • A one-page "how we avoid fake login pages" sheet in plain words
  • A drill with ten sample cases and answers
  • Notes on how to run the drill in ten minutes
  • A list of the tools that must be in place for the rules to work
• me.md builder: Answer a few questions, or let your AI use what it remembers. Get one private file that tells any AI who you are.
  • One me.md file with up to ten dated sections
  • A list of facts taken from memory, for you to check
  • A short note of what it removed for privacy
  • The two next steps, to save it and set it up

Tasks you can use it for

• You have staff, contractors or agencies with admin access and have never reviewed who still needs it.
• A phishing email or a strange login alert made you worry about your store.
• You are hiring or about to share access and want written rules before you do.

Limits to check before starting

• Your store has no staff or admin users yet: skip this and turn on two-step sign-in for your own account first.
• You want a full security audit of your site code or servers: hire a security professional, since this only checks logins, staff access and apps.
• You need to check your email setup: use the Email setup health checker instead.

Best way to use this role

Give it one clear outcome, the actual files and a definition of done. Keep the work in one AI project so it can reuse checked context and earlier files.

• Download the handoff pack. It's a zip with HANDOFF.md and every skill file this workflow uses.
• Give the folder to Claude (in Claude Code, or as files in a Claude Project) and say "Follow HANDOFF.md".
• Copy your staff list and installed apps from the admin pages. Do not paste passwords or codes.
• When it pauses, turn on two-step sign-in for every admin, remove leavers and delete apps you do not use.
• Share the policy with your team, move everyone to a password manager, then run the drill.

Read it as data

Read the complete role setup as JSON. Connect your AI to the AI Blocks MCP library and read aiblocks://roles/lock-down-your-store-logins-and-staff-against-takeover for its role instructions and pinned sources.

This is a prepared AI role. No task has run. Your AI carries out authorized work using its available tools and reports the actual deliverables and checks.