Hire an AI store access security reviewer

Everything it can hand back

Your task sets the actual outputs. The specialist picks the methods that cover them.

• A security score, set against last quarter, with the sums shown
• The checks that got better, worse or stayed open
• A fix list: do today, this month, this quarter
• Which deeper checks ran, and why the others did not

How it does the job well

• Name the asset, the threat and the impact before recommending controls.
• Rank findings by real risk (likelihood and impact), with evidence for each.
• Prefer fixes that remove a problem over warnings that rely on people.
• Cite the exact law, standard or clause for compliance and legal points, and recommend qualified review.

Mistakes it avoids

• Telling a hosted store to buy a firewall or a malware scanner. The platform covers those.
• Pushing password rotation on a store that already has a password manager and two-step sign-in.
• Counting the score as proof of safety. It measures coverage of the basics.
• Running every skill every quarter. A stable store needs the checkup and little more.
• Long lists of generic issues with no evidence they apply.
• Testing or scanning systems without permission.

What a good result looks like

An example, not your task: You run a store with staff, contractors or several apps and nobody checks access on a schedule.

• SCORE. Your score out of 100 this quarter against last quarter, with the sum shown.
• WHAT MOVED. Each check marked better, worse, the same, or still open after two quarters.
• FIX LIST. Fixes grouped as do today, do this month and do this quarter, each with its check and time.
• DEEPER CHECKS. Which deeper checks ran and why, and which were skipped and why.
• NEXT QUARTER. One to three things to watch that decide which checks run next time.
• CHECKS MISSED. Any check that failed or could not run, or the word none.

How the work is checked

• The score comes from the skill's own sums, shown.
• Every check is set against last quarter, or the baseline run is stated.
• Deeper checks ran only when a result or a change called for them, and the skipped ones are named.
• No access, setting or record was changed without a yes.
• States which checks passed, failed or could not run, and names missing inputs.

These checks have not been run against a model yet. Your AI uses them to check its own work.

Capabilities

• Read last quarter. Opens the saved history of scores and fixes, or marks this as the baseline run.
• Run the checkup. Scores two-step sign-in, access, apps, card data, backups and habits.
• Compare. Marks each check better, worse or the same. A check that lost points twice in a row is marked still open and goes first.
• Choose the deeper checks. Runs the sign-in, app and script, domain or fraud-rule check only where the result or a change calls for it.
• Merge and re-check. Puts all fixes in one ranked list. After you make fixes, it re-runs only the check that scored them, at most twice.
• Save and hand back. Saves the score for next quarter and hands back the list, then stops for your yes.

How the role works

1. Checks your task, context and available tools.
2. Picks the methods needed and prepares a work plan.
3. Carries out supported tasks, with each method's limits and review gates.
4. Checks the real deliverables and corrects supported faults.
5. Hands back files, evidence and unresolved gaps.

Your specialist's working setup

Download the base specialist without a task form or account. README.md and SETUP.md explain how to use the folder. SOUL.md defines its scope. INTAKE.md asks missing questions inside your AI. PLAYBOOK.md, SKILLS.md, BEST_PRACTICES.md, CHECKS.md and HANDOFF.md guide the work and its checked deliverables.

Complete associated skills, supporting files and licences are included. Choose only the methods needed for the actual task. Keep context, working files and accepted feedback in your AI project.

Use this specialist through MCP or the API

Call prepare_specialist with role_id quarterly-store-security-keeper only. No task is required to load it. Your AI asks what job you need done, what you want back and which relevant context it can use.

For task-led hiring, call find_specialist, explain the suggested specialists and let the user accept or change the team.

Complete ZIP: Download base specialist. API: GET /api/v1/specialists/quarterly-store-security-keeper/pack. The host AI supplies its own model, tools and execution; a pack does not connect accounts or run a task.

Inputs and helpful context

The specialist starts from the task brief. Only active methods require their inputs.

For the primary method, when used

• Everyone with admin or staff access, their role and any contractor end dates
• Your installed apps and what data each can read
• How staff sign in and how recovery works
• Monthly orders and chargeback numbers (optional)
• Your domains and who can log in to the registrar (optional)

Helpful context (optional)

• A list of domains and who can log in to the registrar
• The last three months of chargeback counts

Tools and access

• Claude Code: It can keep the history folder between quarters. It runs only when you ask, so set your own quarterly reminder.
• Your platform's admin pages: Staff, apps and sign-in details are copied from there.
• Any good chat AI: Any current chat AI can run the checkup. Paste your admin list and app permissions as text.
• A password manager such as Bitwarden or 1Password: It covers the password check, and most teams can share one vault with roles.
• Any good chat AI: Any current chat AI can run this from a written description of your sign-in setup.
• Have I Been Pwned: A free breach lookup. It shows whether staff email addresses appear in known breaches.
• Browser developer tools (network tab): Free in Chrome, Firefox and Safari. It lists every script a page loads, including ones that load other scripts.
• Any good chat AI: Any current chat AI can build the inventory and rank risk from pasted lists.
• Your DNS host's record export: Copying the full list of records gives the checker the real targets.
• crt.sh: A free search of public certificate logs. It shows every certificate issued for your domain.
• Any good chat AI: Any current chat AI can check the list from pasted records.
• Shopify Flow: It runs the rules above on the order risk rating, using free fraud templates you can edit.
• Any good chat AI: Any current chat AI can write the rule set from your numbers.

Functions and deliverables

• Store access security reviewer: Review staff access, sign-in and app risks. Compare earlier findings and get the next security checks and fixes to consider.
  • A security score, set against last quarter, with the sums shown
  • The checks that got better, worse or stayed open
  • A fix list: do today, this month, this quarter
  • Which deeper checks ran, and why the others did not
• Store security reviewer: Describe your admin team and apps. Get a ranked security fix list, a score and a quarterly routine.
  • A score out of 100 with the points listed for each of the 8 checks
  • Fixes ranked into do today, this month and this quarter
  • A list of what your platform already covers, so you do not buy what you do not need
  • A one-page routine to repeat every quarter
• Sign-in security checker: Describe how staff and customers sign in. Get gaps ranked, a score and a password and second-step policy.
  • Gaps ranked by risk, each with a fix
  • A score out of 100 with how it was counted
  • A one-page password and second-step policy for your team or developer
  • A list of checks that did not apply to your platform
• Store script and app risk auditor: Check the scripts, apps and pixels on your store for risk. Get each one ranked, a score out of 100 and a list of what to remove and revoke.
  • One row per script or app: owner, purpose, risk level, what it can see and the action
  • A score out of 100 with how it was counted
  • A removal list that includes keys, webhooks and staff seats to revoke
  • A list of scripts the skill could not judge and why
• Domain access and certificate reviewer: Review supplied domain records and account access. Get possible takeover risks, renewal gaps, a house checklist score and proposed fixes.
  • One row per domain or subdomain: points to, still needed, risk, action
  • A score out of 100 with how it was counted
  • A DNS clean-up list and a registrar access checklist
  • A short list of lookalike domains worth registering or watching
• Store fraud rules planner: Share your order volume and payment setup. Get fraud rules, a review routine and a chargeback watch line.
  • A rule set by risk level, ready to build in your platform
  • A manual review checklist and a 24-hour release-or-cancel routine
  • A chargeback watch line with a warning level before the processor's limit
  • A monthly loop to tune the rules, and a list of checks it could not make
• me.md builder: Answer a few questions, or let your AI use what it remembers. Get one private file that tells any AI who you are.
  • One me.md file with up to ten dated sections
  • A list of facts taken from memory, for you to check
  • A short note of what it removed for privacy
  • The two next steps, to save it and set it up

Tasks you can use it for

• You run a store with staff, contractors or several apps and nobody checks access on a schedule.
• You want to know if your security basics improved since last quarter.
• Chargebacks or fake orders are rising and you want to know if rules need changing.

Limits to check before starting

• You think someone has broken into your store or leaked customer data: contact your platform's support and a qualified security professional first.
• You want it to remove access or change settings for you: it only lists fixes and waits for your yes, so make the changes yourself in your platform's admin pages.
• You run a small store with one owner, no staff and few apps: a quick look at your admin list and two-step sign-in each quarter is enough.

Best way to use this role

Give it one clear outcome, the actual files and a definition of done. Keep the work in one AI project so it can reuse checked context and earlier files.

• Add the agent in Claude Code, or save it in .claude/agents, then ask it to run this quarter's check.
• The first time, give it your admin list, apps and sign-in details. It saves a history file.
• Read the fix list and do the "today" items first.
• Tell the agent which fixes you made. It re-checks only those and shows the new score.
• Run it again next quarter. It does not start by itself, so set your own quarterly reminder. It compares with the saved score.

Read it as data

Read the complete role setup as JSON. Connect your AI to the AI Blocks MCP library and read aiblocks://roles/quarterly-store-security-keeper for its role instructions and pinned sources.

This is a prepared AI role. No task has run. Your AI carries out authorized work using its available tools and reports the actual deliverables and checks.