Learning module · Intermediate
Build a Risk Sweep skill that finds loose secrets
Turn a checklist you already follow into a skill that scans your files, email and chats every week for passwords, keys and account numbers.
Watch
Why it matters
What this protects
A skill is a workflow, an SOP your AI can follow and adapt. The compliance checklists you already use, whether credit bureau, NIST or HIPAA, can become a skill that runs on a schedule across your drives, email, chats and meeting transcripts.
Most companies have passwords, API keys and account numbers sitting in old emails and files. A weekly sweep finds them first. It won't stop a determined attacker, but it builds the habit of looking.
You can get yourself to a first version. A security professional, like a good auditor, knows the questions you don't, so have one review it.
Game plan
Do it in 7 steps
- Connect your drives and email to your AI tool through its connectors, read-only.
- Give it a checklist you already follow and ask it to turn the checklist into a skill.
- Set the rule that it never deletes: it reports, and moves sensitive files to a secured folder only with your approval.
- Run it once by hand, review what it finds, then schedule it weekly.
- Keep the skill in its own folder on OneDrive, Google Drive or GitHub, and point every AI tool at that folder.
- Include the files your agents store behind the scenes; tools like GrokBot keep more than you'd expect.
- Each time a new model ships, ask it to review and improve the skill, and have a security professional check it.
Prompts
Copy and use
Replace the [bracketed] parts. Each prompt keeps you in control: nothing is sent, deleted or shared without your approval.
Claude, ChatGPT or any agent with access to your files.
Here is our [compliance checklist or SOP]. Turn it into a skill that scans [my email, OneDrive and chat history] every week for passwords, API keys, account numbers and Social Security numbers. Report only the location and the last four characters, ranked High, Medium or Low. Never delete, move or share anything; propose each fix for me to approve.
Run it whenever a new model ships.
Review the [skill name] skill with fresh eyes. List the improvements in priority order: false positives, gaps in what it checks, and anything that could expose the data it finds. Then rebuild the skill with the changes I approve.
Inside the agent itself, for example GrokBot.
List every file you have stored or downloaded for me since [date], where it lives, and whether it contains personal, financial or login information. Don't open, move or delete anything. Just report, and rank what you'd move to a private folder first.
Check your work
You're done when
- The skill has run once and you've reviewed its findings.
- It's scheduled weekly and can't delete anything.
- It lives in a folder every tool can reach.
Taught live in the AI Practicum on Thursday, October 15, 2026. The videos above are clips from that class.
Keep going