# w3os-compass

Web3 opsec triage for W3OSC. Researches an org from public sources, maps gaps to the W3OS standard, surfaces top 5 priorities, and recommends matching W3OSC tools. Use when an org needs to know where to start.

- **Kind:** skill
- **Source:** https://github.com/W3OSC/skills
- **Page:** https://forefy.com/skills/8e8e4d30-2339-42ef-bccc-dd54a8a865a5
- **API (JSON + files):** https://forefy.com/api/asr/8e8e4d30-2339-42ef-bccc-dd54a8a865a5

---

## SKILL.md

---
name: w3os-compass
description: Web3 opsec triage for W3OSC. Researches an org from public sources, maps gaps to the W3OS standard, surfaces top 5 priorities, and recommends matching W3OSC tools. Use when an org needs to know where to start.
---

# W3OS Compass

## Identity

W3OS community opsec guide. Research-first - do the homework before asking questions. Goal: org comes in with a name, leaves with a clear priority list and the right tools. Never generic - every recommendation derived from their actual profile. Conversational, not a questionnaire.

Dual-standard: every gap surfaces both the **W3OS control** (SP-* code) and the matching **SEAL framework** section. Orgs get the language and depth of both communities.

Powered by the [W3OS open standard](https://github.com/W3OSC/web3-opsec-standard), [SEAL Frameworks](https://frameworks.securityalliance.org), and [W3OSC tooling](https://github.com/W3OSC).

---

## Reference Files

| File | Load When |
|------|-----------|
| `references/w3os-domains.md` | Deriving gaps from confirmed profile |
| `references/seal-frameworks.md` | Pairing every W3OS control with its SEAL counterpart |
| `references/w3osc-tools.md` | Matching tools to gaps |

---

## Engagement Protocol

### Step 0 - Check memory first

Before anything, check `/memories/w3os-compass/` for an existing profile matching the org name or URL.

- **Profile found** → load it, greet returning org, skip to Step 4, ask if anything has changed since last session.
- **No profile** → proceed to Step 1.

---

### Step 1 - Minimal input

Ask only:
> "What's the name or URL of the project you want to assess?"

Nothing else yet. Don't interrogate upfront.

---

### Step 2 - Research

Using web search and fetch tools, build a profile from public sources:

**Search targets:**
- Project website / docs
- GitHub org (repos, CI/CD setup, open issues, recent commits, contributors)
- DeFi Llama (TVL, protocol type, chain(s), audits listed)
- X / Twitter (recent posts, incident history, team accounts)
- Known audit reports (Sherlock, Code4rena, Cantina, independent auditors)
- Recent news / hacks / incidents mentioning the org

**Extract:**
- Protocol type (DeFi / DAO / exchange / wallet / infra / other)
- Chain(s) deployed on
- Estimated TVL or asset exposure (if applicable)
- Team size estimate
- Treasury/multi-sig presence (Safe address discoverable?)
- GitHub activity and tooling signals (CI/CD, dep scanning, secret scanning)
- Known security incidents or audits
- Social media account structure (Discord, X, Telegram)
- Any AI tooling or agent integrations visible

---

### Step 3 - Present profile + confirm

Present findings conversationally. Flag confidence level (confirmed vs inferred). Ask user to correct anything wrong.

Example:
> "Here's what I found on [Org]. You're a DeFi protocol on Ethereum with ~$12M TVL, 6 repos on GitHub, and a 2-of-3 Safe for treasury. I didn't find any dep scanning in your CI. You had one audit on Code4rena last year. Does this look right? Anything to add or correct?"

If relevant tools are confirmed (Safe, GitHub repos, etc.) - ask for specifics to go deeper:
> "Looks like you're using Safe - want to share your treasury address so I can pull the live config?"

Once confirmed:

- Save profile to memory (see Memory Format)
- Proceed to Step 4

---

### Step 4 - Gap derivation

Load `references/w3os-domains.md`. Cross-reference confirmed profile against each W3OS domain. For each domain, identify which MUST-level requirements the profile indicates are unmet or unknown.

Weight gaps by:
- **Asset exposure** (high TVL or treasury = Domain 1 gaps rank higher)
- **Team surface area** (large team / many contributors = Domain 2, 3, 5 rank higher)
- **Active development** (active GitHub = Domain 4 ranks higher)
- **Known incidents** (prior hack or social compromise = relevant domain ranks highest)
- **Missing basics** (no MFA, no monitoring anywhere = General Security ranks high regardless)

Derive **top 5 priority areas** - not domains, specific control gaps within domains.

---

### Step 5 - Present top 5

Load `references/seal-frameworks.md`. Present as a prioritized list. Each item: the gap, why it matters for *this* org specifically, the W3OS control (SP-* code), and the matching SEAL framework section. Always pair both.

Example:
```
Your Top 5 Opsec Priorities

1. [CRITICAL] Safe quorum too low
   W3OS SP-WM-007 | SEAL: Multisig for Protocols - Setup & Configuration
   You're on 2-of-3. W3OS requires minimum 3-of-5. SEAL's Multisig framework
   covers the exact configuration steps. With $12M TVL, a single compromised
   signer + one social-engineered signer = full treasury loss.

2. [HIGH] No Safe monitoring
   W3OS SP-WM-016 | SEAL: Multisig for Protocols - Registration & Documentation
   No alerts on pending transactions or ownership changes. Attacker has your
   full time-lock window to act undetected.

3. [HIGH] No dependency scanning in CI
   W3OS SP-DI-007 | SEAL: Supply Chain - Dependency Awareness
   6 active repos, no depenemy or equivalent. Supply chain is your largest
   unmonitored attack surface right now.

4. [MEDIUM] No incident response runbook
   W3OS SP-GS-001 | SEAL: Incident Management - Playbooks
   8-person team with no documented response plan. When (not if) something
   happens, minutes matter.

5. [MEDIUM] SMS 2FA on social accounts
   W3OS SP-CS-001 | SEAL: Community Management - Strong Passwords and 2FA
   X and Discord accounts using SMS. SIM swap = immediate account takeover.
```

---

### Step 6 - Tool matching

Load `references/w3osc-tools.md`. For each of the top 5 gaps, check if a W3OSC tool directly addresses it. If yes, surface it inline.

Keep it tight - one tool recommendation per gap max. Don't list tools with no direct match.

---

### Step 7 - Escalation check

After presenting top 5, read the room. Escalate to human support if:
- User says they're overwhelmed, don't know where to start, or don't have internal security resources
- Overall profile shows < 40% W3OS compliance and no security-dedicated team member
- User explicitly asks "who can help us" or "can someone do this for us"
- Frustration signals across 2+ exchanges

**Escalation response:**
> "This is a lot to take on without a dedicated security person. Auditware (the team behind W3OSC) runs hands-on opsec training and setup sessions. You can book directly here: https://auditware.io/opsec-training"

Open the URL for the user if the environment supports it.

---

## Memory Format

Save confirmed org profiles to `/memories/w3os-compass/[org-slug].md`:

```markdown
# [Org Name] - W3OS Compass Profile

**Last updated:** [date]
**URL:** [url]

## Profile
- Type: [DeFi / DAO / exchange / wallet / infra]
- Chain(s): [...]
- TVL / asset exposure: [...]
- Team size: [...]
- GitHub: [url]

## Confirmed Controls
- Safe address: [address or "not confirmed"]
- Safe quorum: [M-of-N or "unknown"]
- Time-locks: [yes / no / unknown]
- CI/CD: [platform]
- Dep scanning: [yes / no / unknown]
- EDR: [yes / no / unknown]
- MFA type: [hardware / TOTP / SMS / mixed / unknown]
- Incident response runbook: [yes / no / unknown]

## Top 5 Gaps (last session)
1. [gap + SP code]
2. ...

## Notes
[anything user clarified that wasn't in public sources]
```

---

## Rules

1. Research first, ask second. Don't make user describe their own org if public data exists.
2. Never present generic opsec advice. Every recommendation tied to their specific profile.
3. Top 5 only - don't dump all gaps. Prioritize ruthlessly.
4. **Every gap gets both:** W3OS SP-* code + SEAL framework link. Never cite one without the other.
5. One W3OSC tool per gap max. Don't oversell the tooling.
6. Memory saves after profile confirmed in Step 3 - not after full assessment.
7. Escalate early if overwhelmed signals appear - don't wait for explicit ask.
8. Returning orgs: load memory, skip research, ask "anything changed?" only.
9. Mention SEAL certifications once, at the end of the report as a maturity goal - never during gap analysis.

## references

```

```

## references/seal-frameworks.md

# SEAL Framework Catalog

Cross-reference map: W3OS domain → SEAL framework sections.
When surfacing any W3OS control, pair it with the matching SEAL section from this file.
Source: https://frameworks.securityalliance.org

---

## Domain 1: Wallet & Multi-Sig → SEAL Multisig for Protocols + Wallet Security

| W3OS Controls | SEAL Section | URL |
|---------------|-------------|-----|
| SP-WM-001 to WM-005 (individual wallet, seed phrases, physical security) | Wallet Security - Hardware Wallet Setup | https://frameworks.securityalliance.org/wallet-security/intermediates-and-medium-funds |
| SP-WM-003 (seed phrase management) | Wallet Security - Seed Phrase Management | https://frameworks.securityalliance.org/wallet-security/seed-phrase-management |
| SP-WM-006 to WM-008 (multi-sig setup, quorum, timelocks) | Multisig for Protocols - Planning & Classification | https://frameworks.securityalliance.org/multisig-for-protocols/planning-and-classification |
| SP-WM-006 to WM-008 (multi-sig setup, quorum, timelocks) | Multisig for Protocols - Setup & Configuration | https://frameworks.securityalliance.org/multisig-for-protocols/setup-and-configuration |
| SP-WM-009 to WM-010 (transaction verification, on-device check) | Wallet Security - Safe Multisig Step-by-Step Verification | https://frameworks.securityalliance.org/wallet-security/signing-and-verification/secure-multisig-safe-verification |
| SP-WM-009 to WM-010 (transaction verification) | Multisig for Protocols - Joining a Multisig | https://frameworks.securityalliance.org/multisig-for-protocols/joining-a-multisig |
| SP-WM-011 to WM-012 (hot/cold structure, wallet segregation) | Multisig for Protocols - Use Case Specific Requirements | https://frameworks.securityalliance.org/multisig-for-protocols/use-case-specific-requirements |
| SP-WM-014 to WM-015 (out-of-band, dedicated signing machines) | Multisig for Protocols - Communication Setup | https://frameworks.securityalliance.org/multisig-for-protocols/communication-setup |
| SP-WM-014 to WM-015 (opsec for signers) | Multisig for Protocols - Personal Security (OpSec) | https://frameworks.securityalliance.org/multisig-for-protocols/personal-security-opsec |
| SP-WM-016 to WM-017 (monitoring, self-hosted UI) | Multisig for Protocols - Registration & Documentation | https://frameworks.securityalliance.org/multisig-for-protocols/registration-and-documentation |
| SP-WM-018 to WM-019 (simulation, external monitoring) | Multisig for Protocols - Operational Runbooks | https://frameworks.securityalliance.org/multisig-for-protocols/runbooks/overview |
| Emergency / key compromise | Multisig for Protocols - Emergency Procedures | https://frameworks.securityalliance.org/multisig-for-protocols/emergency-procedures |
| Implementation checklist | Multisig for Protocols - Implementation Checklist | https://frameworks.securityalliance.org/multisig-for-protocols/implementation-checklist |

**SEAL Cert:** Multisig Ops, Treasury Ops → https://frameworks.securityalliance.org/certs/overview

---

## Domain 2: Endpoint Security → SEAL OpSec

| W3OS Controls | SEAL Section | URL |
|---------------|-------------|-----|
| SP-EP-001 to EP-003 (dedicated devices, device config) | OpSec - Endpoint Security | https://frameworks.securityalliance.org/opsec/endpoint/overview |
| SP-EP-004 to EP-005 (secure usage, home network) | OpSec - Endpoint Security | https://frameworks.securityalliance.org/opsec/endpoint/overview |
| SP-EP-006 to EP-008 (EDR, network monitoring, malware detection) | OpSec - Control Domains | https://frameworks.securityalliance.org/opsec/control-domains/overview |
| SP-EP-009 (browser isolation, wallet extensions) | OpSec - Browser Security | https://frameworks.securityalliance.org/opsec/browser/overview |
| SP-EP-010 to EP-011 (file handling, extension vetting) | OpSec - Browser Security | https://frameworks.securityalliance.org/opsec/browser/overview |
| SP-EP-012 to EP-013 (workspace security, remote work physical) | OpSec - While Traveling | https://frameworks.securityalliance.org/opsec/travel/overview |

**SEAL Cert:** Identity & Accounts → https://frameworks.securityalliance.org/certs/overview

---

## Domain 3: Communications & Social Media → SEAL Community Management + OpSec

| W3OS Controls | SEAL Section | URL |
|---------------|-------------|-----|
| SP-CS-001 to CS-002 (MFA, account recovery) | Community Management - Strong Passwords and 2FA | https://frameworks.securityalliance.org/community-management/overview |
| SP-CS-001 to CS-002 (MFA) | OpSec - Multi-Factor Authentication | https://frameworks.securityalliance.org/opsec/mfa/overview |
| SP-CS-003 to CS-007 (E2E comms, email auth, file sharing, ops confirmation) | Community Management - Operational Security (OpSec) | https://frameworks.securityalliance.org/community-management/overview |
| SP-CS-005 to CS-007 (external verification, ops confirmation) | Community Management - Emergency Response Plan | https://frameworks.securityalliance.org/community-management/overview |
| SP-CS-008 (org identity) | Community Management - Phishing Awareness | https://frameworks.securityalliance.org/community-management/overview |
| All | Awareness - Security Awareness framework | https://frameworks.securityalliance.org/awareness/overview |

---

## Domain 4: DevOps & Infrastructure → SEAL DevSecOps + Supply Chain + Infrastructure

| W3OS Controls | SEAL Section | URL |
|---------------|-------------|-----|
| SP-DI-001 to DI-002 (isolated dev environments, IDE plugin security) | DevSecOps - Integrated Development Environments | https://frameworks.securityalliance.org/devsecops/integrated-development-environments |
| SP-DI-001 to DI-002 (sandboxed dev environments) | DevSecOps - Isolation & Sandboxing | https://frameworks.securityalliance.org/devsecops/isolation |
| SP-DI-003 (repo security, branch protection, signed commits, 2-person review) | DevSecOps - Repository Hardening | https://frameworks.securityalliance.org/devsecops/repository-hardening |
| SP-DI-003 (signed commits) | DevSecOps - Code Signing | https://frameworks.securityalliance.org/devsecops/code-signing |
| SP-DI-004 (secret scanning) | DevSecOps - Data Security Checklist | https://frameworks.securityalliance.org/devsecops/data-security-upgrade-checklist |
| SP-DI-005 to DI-007 (package verification, typosquatting, dep scanning) | Supply Chain - Dependency Awareness | https://frameworks.securityalliance.org/supply-chain/dependency-awareness |
| SP-DI-005 to DI-007 (supply chain threats) | Supply Chain - Web3 Supply Chain Threats | https://frameworks.securityalliance.org/supply-chain/web3-supply-chain-threats |
| SP-DI-008 (external contributors) | Supply Chain - Vendor Risk Management | https://frameworks.securityalliance.org/supply-chain/vendor-risk-management |
| SP-DI-009 to DI-010 (secrets management, pipeline access) | DevSecOps - CI/CD | https://frameworks.securityalliance.org/devsecops/continuous-integration-continuous-deployment |
| SP-DI-011 to DI-015 (IaC, infra access, cloud) | Infrastructure | https://frameworks.securityalliance.org/infrastructure/overview |
| SP-DI-016 (contract state monitoring, invariants) | DevSecOps - Governance Proposal Security | https://frameworks.securityalliance.org/devsecops/governance-proposal-security |

**SEAL Cert:** DevOps & Infrastructure, DNS Security → https://frameworks.securityalliance.org/certs/overview

---

## Domain 5: General Security → SEAL Incident Management + OpSec + Awareness + DPRK IT Workers

| W3OS Controls | SEAL Section | URL |
|---------------|-------------|-----|
| SP-GS-001 to GS-004 (IR runbooks, monitoring, response controls) | Incident Management - Incident Detection and Response | https://frameworks.securityalliance.org/incident-management/incident-detection-and-response |
| SP-GS-001 to GS-004 (playbooks) | Incident Management - Playbooks | https://frameworks.securityalliance.org/incident-management/playbooks/overview |
| SP-GS-001 to GS-004 (IR template) | Incident Management - Incident Response Template | https://frameworks.securityalliance.org/incident-management/incident-response-template/overview |
| SP-GS-005 to GS-006 (phishing simulation, social engineering training) | Awareness | https://frameworks.securityalliance.org/awareness/overview |
| SP-GS-008 to GS-009 (password management, account sharing) | OpSec - Password Management | https://frameworks.securityalliance.org/opsec/passwords/overview |
| SP-GS-011 (login methods, 2FA, no SMS) | OpSec - Multi-Factor Authentication | https://frameworks.securityalliance.org/opsec/mfa/overview |
| SP-GS-013 (SIM swap mitigation) | OpSec - MFA | https://frameworks.securityalliance.org/opsec/mfa/overview |
| SP-GS-014 to GS-017 (insider threat, identity verification for remote workers) | Insider Threats (DPRK IT Workers) | https://frameworks.securityalliance.org/dprk-it-workers/overview |
| SP-GS-016 (third party access) | Supply Chain - Vendor Risk Management | https://frameworks.securityalliance.org/supply-chain/vendor-risk-management |
| SP-GS-018 to GS-019 (leaked credential monitoring, account monitoring) | OpSec - Continuous Improvement | https://frameworks.securityalliance.org/opsec/continuous-improvement-metrics |

**SEAL Cert:** Incident Response, Identity & Accounts → https://frameworks.securityalliance.org/certs/overview

---

## Domain 6: Financial Controls → SEAL OpSec (treasury) + SEAL Certifications

| W3OS Controls | SEAL Section | URL |
|---------------|-------------|-----|
| SP-FC-001 to FC-003 (financial platform auth, dedicated devices) | OpSec - Multi-Factor Authentication | https://frameworks.securityalliance.org/opsec/mfa/overview |
| SP-FC-001 to FC-003 (financial platform auth, dedicated devices) | OpSec - Endpoint Security | https://frameworks.securityalliance.org/opsec/endpoint/overview |
| SP-FC-004 to FC-007 (dual auth, separation of duties, out-of-band) | OpSec - Control Domains | https://frameworks.securityalliance.org/opsec/control-domains/overview |
| SP-FC-014 to FC-015 (financial IR, emergency freeze) | Incident Management - Playbooks | https://frameworks.securityalliance.org/incident-management/playbooks/overview |

**SEAL Cert:** Treasury Ops → https://frameworks.securityalliance.org/certs/overview

---

## SEAL Certifications Overview

Modular certs available - surface as a maturity goal after top 5 gaps resolved:

| Cert | Covers | URL |
|------|--------|-----|
| Multisig Ops | Multisig configuration and operational security | https://frameworks.securityalliance.org/certs/overview |
| DevOps & Infrastructure | CI/CD, repo security, infra controls | https://frameworks.securityalliance.org/certs/overview |
| DNS Security | DNS configuration and security | https://frameworks.securityalliance.org/certs/overview |
| Identity & Accounts | MFA, access control, account security | https://frameworks.securityalliance.org/certs/overview |
| Incident Response | IR planning and procedures | https://frameworks.securityalliance.org/certs/overview |
| Treasury Ops | Treasury management and financial controls | https://frameworks.securityalliance.org/certs/overview |

Mention SEAL certs at end of compass report as a "next level" goal - not during gap derivation.

## references/w3os-domains.md

# W3OS Domain Reference

Condensed W3OS standard for gap derivation. Source: https://github.com/W3OSC/web3-opsec-standard

For each domain: key MUST-level requirements and profile signals that indicate a gap.

---

## Domain 1: Wallet & Multi-Sig Management

**Profile signals that indicate gaps:**
- Treasury not on multi-sig → SP-WM-006 NON-COMPLIANT
- Safe quorum < 3-of-5 → SP-WM-007 NON-COMPLIANT
- No time-locks configured → SP-WM-008 NON-COMPLIANT
- No monitoring on Safe address → SP-WM-016 NON-COMPLIANT
- No dedicated signing devices mentioned → SP-WM-015 gap
- No transaction simulation in workflow → SP-WM-018 gap
- No external monitoring party → SP-WM-019 gap

**Key MUSTs:**
- `SP-WM-006` Treasury and contract admin MUST use on-chain multi-sig → *SEAL: [Planning & Classification](https://frameworks.securityalliance.org/multisig-for-protocols/planning-and-classification)*
- `SP-WM-007` Minimum 3-of-5 quorum required → *SEAL: [Setup & Configuration](https://frameworks.securityalliance.org/multisig-for-protocols/setup-and-configuration)*
- `SP-WM-008` Time-locks MUST be enabled; minimum 3-day delay → *SEAL: [Setup & Configuration](https://frameworks.securityalliance.org/multisig-for-protocols/setup-and-configuration)*
- `SP-WM-009` Signers MUST verify on 2+ devices via 2+ channels → *SEAL: [Safe Multisig Verification](https://frameworks.securityalliance.org/wallet-security/signing-and-verification/secure-multisig-safe-verification)*
- `SP-WM-010` Hardware wallet display MUST be manually verified before signing → *SEAL: [Hardware Wallet Setup](https://frameworks.securityalliance.org/wallet-security/intermediates-and-medium-funds)*
- `SP-WM-014` Transaction coordination MUST use E2E encrypted channels; links MUST NOT be clicked → *SEAL: [Communication Setup](https://frameworks.securityalliance.org/multisig-for-protocols/communication-setup)*
- `SP-WM-015` Multi-sig ops MUST run on dedicated, network-restricted devices → *SEAL: [Personal Security (OpSec)](https://frameworks.securityalliance.org/multisig-for-protocols/personal-security-opsec)*
- `SP-WM-016` All multi-sig addresses MUST be monitored; channels MUST be immutable → *SEAL: [Registration & Documentation](https://frameworks.securityalliance.org/multisig-for-protocols/registration-and-documentation)*

**SEAL Certs:** Multisig Ops, Treasury Ops

**Risk weight:** Very high for any org with on-chain assets or smart contract admin keys.

---

## Domain 2: Endpoint Security

**Profile signals that indicate gaps:**
- No EDR mentioned anywhere → SP-EP-006 gap
- Personal devices used for work (small team, no device policy) → SP-EP-001 risk
- No network monitoring tools referenced → SP-EP-007 gap
- Browser extensions unvetted (no policy) → SP-EP-011 gap
- Remote team with no workspace security policy → SP-EP-012/013 gap

**Key MUSTs:**
- `SP-EP-001` Each member MUST have a dedicated org device; personal devices MUST NOT be used → *SEAL: [Endpoint Security](https://frameworks.securityalliance.org/opsec/endpoint/overview)*
- `SP-EP-003` Full disk encryption MUST be required; screen lock ≤5 min → *SEAL: [Endpoint Security](https://frameworks.securityalliance.org/opsec/endpoint/overview)*
- `SP-EP-006` EDR SHOULD be deployed; active network monitoring MUST be in place if no EDR → *SEAL: [Control Domains](https://frameworks.securityalliance.org/opsec/control-domains/overview)*
- `SP-EP-007` All endpoints MUST have active network monitoring and firewall enabled → *SEAL: [Control Domains](https://frameworks.securityalliance.org/opsec/control-domains/overview)*
- `SP-EP-009` Wallet extensions SHOULD only run on a dedicated transaction-only browser → *SEAL: [Browser Security](https://frameworks.securityalliance.org/opsec/browser/overview)*

**SEAL Certs:** Identity & Accounts

**Risk weight:** High for teams with signing authority; medium for non-signing members.

---

## Domain 3: Communications & Social Media

**Profile signals that indicate gaps:**
- SMS 2FA detected on any account (X, Discord, email) → SP-CS-001 NON-COMPLIANT
- No SPF/DKIM/DMARC records on org domain → SP-CS-004 gap
- Discord/X accounts not linked from official sources → SP-CS-008 gap
- Prior social account compromise in history → SP-CS-001/002 critical
- No Signal or E2E encrypted channel for internal ops → SP-CS-003 gap

**Key MUSTs:**
- `SP-CS-001` All org communication accounts MUST have MFA; SMS MUST NOT be primary or backup → *SEAL: [Community Management - 2FA](https://frameworks.securityalliance.org/community-management/overview), [OpSec - MFA](https://frameworks.securityalliance.org/opsec/mfa/overview)*
- `SP-CS-002` SMS recovery SHOULD NOT be enabled on any account → *SEAL: [OpSec - MFA](https://frameworks.securityalliance.org/opsec/mfa/overview)*
- `SP-CS-004` SPF, DKIM, DMARC MUST be configured on org domain → *SEAL: [Community Management](https://frameworks.securityalliance.org/community-management/overview)*
- `SP-CS-006` Files from external parties MUST be sanitized before opening (Dangerzone, VirusTotal, Google Drive) → *SEAL: [Community Management - OpSec](https://frameworks.securityalliance.org/community-management/overview)*
- `SP-CS-007` Internal ops coordination MUST be confirmed in secure channel (video, E2E encrypted) → *SEAL: [Community Management - Emergency Response Plan](https://frameworks.securityalliance.org/community-management/overview)*

**SEAL Certs:** Identity & Accounts

**Risk weight:** High for orgs with active communities (Discord, Telegram, X). Prior compromise = critical.

---

## Domain 4: DevOps & Infrastructure

**Profile signals that indicate gaps:**
- No dep scanning in CI (no depenemy, Dependabot, Snyk, etc.) → SP-DI-007 NON-COMPLIANT
- No secret scanning in repos → SP-DI-004 gap
- No branch protection on main/prod branches → SP-DI-003 gap
- Unsigned commits → SP-DI-003 gap
- Single-person PR merges → SP-DI-003 NON-COMPLIANT
- Secrets visible in repo history → SP-DI-009 critical
- No IaC (manual infra setup) → SP-DI-011 gap
- No smart contract state monitoring → SP-DI-016 gap (for protocol orgs)
- External contributors with full repo access → SP-DI-008 gap

**Key MUSTs:**
- `SP-DI-003` Branch protection MUST be on prod branches; signed commits MUST be required; 2-person PR approval MUST be required → *SEAL: [Repository Hardening](https://frameworks.securityalliance.org/devsecops/repository-hardening), [Code Signing](https://frameworks.securityalliance.org/devsecops/code-signing)*
- `SP-DI-004` Repos MUST be continuously scanned for committed secrets → *SEAL: [Data Security Checklist](https://frameworks.securityalliance.org/devsecops/data-security-upgrade-checklist)*
- `SP-DI-007` All deps MUST be scanned for known vulns before deployment; version pinning MUST be used → *SEAL: [Supply Chain - Dependency Awareness](https://frameworks.securityalliance.org/supply-chain/dependency-awareness)*
- `SP-DI-009` Secrets MUST NOT be in source code; dedicated secrets management MUST be used → *SEAL: [DevSecOps - CI/CD](https://frameworks.securityalliance.org/devsecops/continuous-integration-continuous-deployment)*
- `SP-DI-010` Pipeline modifications MUST require multi-party approval; manual deploy permissions MUST NOT exist → *SEAL: [DevSecOps - CI/CD](https://frameworks.securityalliance.org/devsecops/continuous-integration-continuous-deployment)*
- `SP-DI-016` Invariant monitoring SHOULD be set up for deployed contracts (DeFi protocols) → *SEAL: [Governance Proposal Security](https://frameworks.securityalliance.org/devsecops/governance-proposal-security)*

**SEAL Certs:** DevOps & Infrastructure, DNS Security

**Risk weight:** High for any org with active development. Critical for protocols with deployed contracts.

---

## Domain 5: General Security

**Profile signals that indicate gaps:**
- No incident response runbook found → SP-GS-001 NON-COMPLIANT
- No security champion/owner on team → SP-GS-007 gap
- No leaked credential monitoring → SP-GS-018 gap
- Small team with shared credentials visible → SP-GS-009 NON-COMPLIANT
- SSO used for admin/financial access → SP-GS-011 gap
- SMS 2FA anywhere → SP-GS-011 NON-COMPLIANT
- No phishing training mentioned → SP-GS-005 gap
- North Korea / remote-hire risk (crypto-native org) → SP-GS-017 relevant

**Key MUSTs:**
- `SP-GS-001` Org MUST maintain documented incident response plans for all critical systems → *SEAL: [Incident Management - Detection & Response](https://frameworks.securityalliance.org/incident-management/incident-detection-and-response), [Playbooks](https://frameworks.securityalliance.org/incident-management/playbooks/overview)*
- `SP-GS-008` Password manager MUST be used; passwords MUST be unique, 20-32 chars, auto-generated → *SEAL: [OpSec - Password Management](https://frameworks.securityalliance.org/opsec/passwords/overview)*
- `SP-GS-009` Credential sharing MUST NOT occur; account delegation MUST be used where possible → *SEAL: [OpSec - Control Domains](https://frameworks.securityalliance.org/opsec/control-domains/overview)*
- `SP-GS-010` Admin privileges MUST be granted to minimum necessary roles only → *SEAL: [OpSec - Control Domains](https://frameworks.securityalliance.org/opsec/control-domains/overview)*
- `SP-GS-011` 2FA MUST be enforced on all accounts; SMS MUST NOT be used; SSO MUST NOT be used for sensitive access → *SEAL: [OpSec - MFA](https://frameworks.securityalliance.org/opsec/mfa/overview)*
- `SP-GS-012` Owner/superadmin accounts MUST be treated as break-glass; usage MUST trigger team alert → *SEAL: [OpSec - Control Domains](https://frameworks.securityalliance.org/opsec/control-domains/overview)*
- `SP-GS-014` to `SP-GS-017` Insider threat modeling, remote worker verification → *SEAL: [DPRK IT Workers](https://frameworks.securityalliance.org/dprk-it-workers/overview)*
- `SP-GS-018` Leaked passwords MUST be monitored; alerts MUST be instant and immutable → *SEAL: [OpSec - Continuous Improvement](https://frameworks.securityalliance.org/opsec/continuous-improvement-metrics)*

**SEAL Certs:** Incident Response, Identity & Accounts

**Risk weight:** High across all org types. No IR runbook = critical regardless of other controls.

---

## Domain 6: Financial Controls & Banking Security

**Profile signals that indicate gaps:**
- Single person controls bank account → SP-FC-004 NON-COMPLIANT
- No dual approval for wire transfers → SP-FC-004 NON-COMPLIANT
- SMS MFA on banking portals → SP-FC-001 NON-COMPLIANT
- No dedicated financial device → SP-FC-003 gap
- Payment recipients not whitelisted → SP-FC-008 gap
- No documented financial IR runbook → SP-FC-014 gap

**Key MUSTs:**
- `SP-FC-001` Banking portals MUST require strong MFA; SMS MUST NOT be used; hardware keys strongly recommended → *SEAL: [OpSec - MFA](https://frameworks.securityalliance.org/opsec/mfa/overview)*
- `SP-FC-003` Financial portal access SHOULD be on dedicated devices; MUST NOT be over public networks → *SEAL: [OpSec - Endpoint Security](https://frameworks.securityalliance.org/opsec/endpoint/overview)*
- `SP-FC-004` All outbound payments MUST require approval from at least 2 authorized individuals → *SEAL: [OpSec - Control Domains](https://frameworks.securityalliance.org/opsec/control-domains/overview)*
- `SP-FC-006` Payment initiator and approver MUST be separate individuals → *SEAL: [OpSec - Control Domains](https://frameworks.securityalliance.org/opsec/control-domains/overview)*
- `SP-FC-007` High-value payments MUST have out-of-band verbal confirmation before approval → *SEAL: [Incident Management - Playbooks](https://frameworks.securityalliance.org/incident-management/playbooks/overview)*
- `SP-FC-012` Real-time transaction alerts MUST be configured; delivered to 2+ people via 2+ channels → *SEAL: [OpSec - Control Domains](https://frameworks.securityalliance.org/opsec/control-domains/overview)*

**SEAL Certs:** Treasury Ops

**Risk weight:** Medium-high for orgs with fiat banking operations. Often overlooked in Web3 orgs.

## references/w3osc-tools.md

# W3OSC Tool Catalog

All tools from the W3OSC organization. Use this to match gaps to tools.
Source: https://github.com/W3OSC

---

## multisigmonitor

**Repo:** https://github.com/W3OSC/multisigmonitor  
**What it does:** Analysis and real-time monitoring for Safe{wallet} multisig wallets. Tracks pending transactions, ownership changes, signer activity, and balance shifts. Delivers alerts.  
**Matches gaps:**
- SP-WM-016 - no Safe monitoring / no immutable alert channel
- SP-WM-008 - time-lock visibility (see pending txns awaiting delay)
- SP-WM-019 - supports external monitoring party workflow  

**When to recommend:** Any org using Safe with no active monitoring. Highest priority tool for DeFi protocols with on-chain treasury.  
**Setup complexity:** Low - TypeScript, self-hosted or run as a service.

---

## depenemy

**Repo:** https://github.com/W3OSC/depenemy  
**What it does:** Scans project dependencies for supply chain risks - malicious packages, typosquatting, suspicious metadata, version anomalies.  
**Matches gaps:**
- SP-DI-007 - no dependency scanning before deployment
- SP-DI-006 - typosquatting detection and prevention
- SP-DI-005 - package verification and integrity  

**When to recommend:** Any org with active GitHub repos and no existing dep scanning. Especially valuable for protocols with complex dependency trees.  
**Setup complexity:** Low - Python, run locally or in CI.

---

## depenemy-action

**Repo:** https://github.com/W3OSC/depenemy-action  
**What it does:** GitHub Action that runs depenemy automatically on every push/PR. Integrates supply chain scanning into existing CI/CD pipeline.  
**Matches gaps:**
- SP-DI-007 - automates dep scanning in pipeline
- SP-DI-010 - supports automated pipeline security controls  

**When to recommend:** Pair with depenemy when org already uses GitHub Actions. Drop-in addition to existing CI.  
**Setup complexity:** Very low - add to existing workflow YAML.

---

## skill-warden

**Repo:** https://github.com/W3OSC/skill-warden  
**What it does:** Security scanner for AI skills (Copilot, Claude, etc.). Detects prompt injection, jailbreak attempts, secret grabbing patterns, and other AI-specific threats in skill/prompt files.  
**Matches gaps:**
- SP-DI-002 - vetting AI-powered extensions and tools
- SP-DI-004 - scanning AI skill files for embedded threats
- SP-GS-006 - social engineering surface in AI tooling  

**When to recommend:** Any org using AI coding assistants or deploying AI skills/agents. Especially relevant if conduit or similar tools are in use.  
**Setup complexity:** Low - Python, run locally or in CI.

---

## skill-warden-action

**Repo:** https://github.com/W3OSC/skill-warden-action  
**What it does:** GitHub Action for skill-warden. Scans AI skill files on every commit, outputs SARIF for GitHub Security tab integration.  
**Matches gaps:** Same as skill-warden, automated in pipeline.  
**When to recommend:** Pair with skill-warden when org has GitHub repos containing AI skill/prompt files.  
**Setup complexity:** Very low - add to existing workflow YAML.

---

## conduit

**Repo:** https://github.com/W3OSC/conduit  
**What it does:** Connects AI agents to org accounts with human-in-the-loop approval flows, fine-grained access control, and detailed audit logs. Prevents agents from taking unsupervised actions on sensitive accounts.  
**Matches gaps:**
- SP-GS-010 - principle of least privilege for AI agent access
- SP-GS-009 - account sharing / credential sharing by agents
- SP-DI-010 - pipeline access controls for automated systems
- SP-GS-004 - immutable audit logs of sensitive actions  

**When to recommend:** Orgs actively using AI agents that interact with accounts, APIs, or on-chain systems. Growing use case as teams adopt AI tooling.  
**Setup complexity:** Medium - TypeScript, requires setup and account integration.

---

## web3-opsec-directory

**Repo:** https://github.com/W3OSC/web3-opsec-directory  
**What it does:** Curated directory of Web3 opsec tools and resources, organized by category. Community-maintained.  
**Matches gaps:** All domains - use when no specific W3OSC tool covers a gap but the user needs tooling recommendations for it (e.g. EDR, password managers, E2E comms).  
**When to recommend:** After top 5 gaps surfaced - point here for gaps not covered by a specific W3OSC tool so user can find best-in-class alternatives.  
**Setup complexity:** N/A - reference resource.

---

## web3-opsec-standard

**Repo:** https://github.com/W3OSC/web3-opsec-standard  
**Interactive tracker:** https://w3osc.github.io/web3-opsec-standard/index.html  
**What it does:** The W3OS open standard itself. Interactive checklist for tracking compliance across all 6 domains. 75 requirements, 282 control points.  
**When to recommend:** After compass session - give user the interactive tracker so they can self-track progress on all gaps (not just top 5).  
**Setup complexity:** N/A - web app, no setup.

---

## Matching Priority

When multiple tools could apply, prefer in this order:
1. Tool that directly addresses the **highest-ranked gap** in the top 5
2. Tools with **lowest setup complexity** for the org's current stack
3. GitHub Action variants over standalone tools if org already uses GitHub Actions
4. `web3-opsec-directory` as fallback when no specific W3OSC tool covers the gap

Never recommend more than one tool per gap. Don't force a tool match where none fits well.