dlp-windows-specialist

What problem does it solve?

This Skill provides specialized review axes for the IBM Guardium Workforce / DLP Windows agent, ensuring product-specific correctness, audit, and policy invariants in PRs.

Core Features & Use Cases

• Audit Completeness: Ensures no silent drops of events and proper handling of suppression gates and deduplication windows.
• Policy Decision Correctness: Validates the correctness of policy decisions and the Lua engine sandbox boundary.
• Server-Coordinated Schema Evolution: Manages breaking schema changes and new endpoints.
• Backward Compatibility: Ensures backward compatibility for installed agents, including config keys, renames, and defaults.
• Concurrency Handling: Manages concurrency hazards in the Durable Activity Updater.
• ETW Provider Lifecycle: Ensures proper registration and unregistration of ETW providers.
• Service Lifecycle Hardness: Manages SCM stop timeouts, session change handler thread safety, crash-loop logic, and dwControlsAccepted changes.
• IPC Security: Secures named pipes and shared-memory IPC with proper DACLs and message validation.
• Privilege Transitions: Ensures proper impersonation and logon context handling.
• Sensitive Data Leakage: Protects sensitive data in logs, including policy content, file paths, and activity payloads.
• MSI Installer/VDPROJ Correctness: Validates upgrade codes, service install/uninstall sections, custom actions, and rollback paths.
• ARM64 + MSVC Particulars: Handles ARM64-specific issues with __cpuid, pointer truncation, warnings-as-errors, and inline assembly.
• What NOT to Flag: Outlines what should not be flagged, including general C++ style, test file changes, documentation-only changes, new shared-skills config additions, and performance speculation.

Quick Start

Activate the dlp-windows-specialist skill on any diff to the dlp-agent-windows / endpoint-dlp-windows codebase to ensure product-specific correctness and compliance.