Fintech Spec Section

Before you start: read this whole install prompt, tell me in a few lines what this skill does and what installing it involves, and wait for my go-ahead before you do anything else. Prerequisites: none for the install itself: no account, no API key, no paid service, and nothing else to install first. The skill is free under the MIT license and is a single instruction file — there is no code, no script and no dependency to install. For using it afterwards, no key or account is required either: it works from a draft spec or feature description that I provide myself. One upstream fact to know before you install, disclosed here and in point 2: the file's frontmatter is exactly as published upstream and a strict YAML parser rejects it (see point 2) — install the file exactly as fingerprinted, do not edit or "fix" it, and report that fact back to me in point 4 instead of claiming the frontmatter is valid. Install "fintech-spec-section" for me. It writes the regulatory, risk and compliance section of a PRD, BRD or feature spec for a money-moving or financial product, putting the compliance thinking into the spec from the start, as questions and controls for the compliance team to confirm, not as legal conclusions and not legal advice. From my draft spec or feature description it builds: (1) a trigger map deciding, with a reason for each, which areas the feature touches — identity verification and customer due diligence, enhanced due diligence, beneficial ownership, transaction monitoring, suspicious activity reporting timelines, sanctions screening, card data and PCI DSS scope (does card data touch our systems, or only a tokenized processor), consumer disclosures and fee transparency, adverse action or decline notices, complaints handling, record keeping and retention, privacy and data minimization, fraud and account takeover — each marked triggered, possibly triggered (question), or not triggered (reason); (2) for each triggered area, requirements in the spec's style, each with its control owner, the check, what happens on failure, and the audit event to record (who, what, when, outcome); (3) failure and exception paths — verification fails, screening hit, monitoring alert, partner system down, manual review queue, customer appeals — each with a user-facing state and a message reviewed by compliance; (4) a data table: which personal and financial data the feature collects, where it is stored, who can access it, the retention period, and whether card data is tokenized; (5) a numbered list of partner and regulator questions for compliance, legal and the bank or sponsor partner, each saying what decision it blocks. Its output is a section titled "Regulatory, risk and compliance", ready to paste into the spec, ending with the line: "Prepared for review by compliance. Not legal advice; thresholds and timelines must be confirmed for each market." Its rules: never state thresholds, deadlines or legal conclusions as settled — where a well-known figure applies in a named market, give it as "commonly X in <market>, confirm with compliance"; keep card numbers, account numbers and real customer data out of examples. Repository: https://github.com/ChenxingJi-Innovate/Cheatcode_ (the skill is the whole packages/regulated-spec-sections/skills/fintech-spec-section/ folder at the pinned commit: SKILL.md only, 1 file) Pinned version: install the code at commit 1071f72533f0a8bb671e2d9b48c8d75f12adc904 exactly. Do not substitute a newer version. If this commit is unreachable, stop and tell me. 1. Clone https://github.com/ChenxingJi-Innovate/Cheatcode_ into a temporary folder, check out commit 1071f72533f0a8bb671e2d9b48c8d75f12adc904, and copy the packages/regulated-spec-sections/skills/fintech-spec-section/ folder from that checkout. Then compare every file in the folder with the fingerprints recorded for this listing on 2026-10-19: [FINGERPRINTS] - SKILL.md: SHA-256 dc4e626b465c670bbdf464cd2b903bd65694dce4ec75907d5e67f3e04594c96c If a file does not match, it changed since the listing was prepared: do not install it yet, tell me what you found and let me decide. 2. Read SKILL.md in full, and tell me in plain words: what the skill does when used, which services it can connect to, whether it reads or sends any personal information or keys, and anything that seems unusual. Stop on any red flag and tell me before going further. Confirm these points from the file: - The skill folder holds 1 file only: SKILL.md (3,343 bytes). There are no scripts, no code, no assets and no configuration in the folder. The skill is self-contained in that one file for installation: it contains no import, no URL and no file reference, and it needs no file from elsewhere in the repository to be installed — not the sibling skill healthcare-spec-section, not the package files (packages/regulated-spec-sections/README.md, cheatcode.json, .claude-plugin/plugin.json, LICENSE), not the repository root files, and not the installer/ app. - Frontmatter, exactly as upstream — read it byte by byte and state it back to me, do not correct it: the file opens with a line "---", then one line "name: fintech-spec-section", then one single line "description: " followed by a 614-character unquoted plain text (627 characters for the whole line), then a line "---". There are no other frontmatter fields — no license, version, author or any other key — the encoding is UTF-8 with LF line endings only, no BOM and no CRLF. Because that description is unquoted and contains ": " (a colon followed by a space, in "financial product: which obligations", at column 121 of the description line), a strict YAML parser rejects this frontmatter with "mapping values are not allowed here". That is the upstream state, recorded on this listing as-is: install the byte-identical file, never edit, re-quote or otherwise repair the frontmatter, and never report it as valid YAML. - Nothing is sent anywhere during installation itself; the only download at install time is the skill folder from GitHub at the pinned commit. No script is run during installation (there is none), no key is asked for, and there is no telemetry in the folder. - What is read and what stays where at use time, disclosed here before it ever happens — using the skill is a separate step that only starts when I bring a draft spec or feature description: I supply the inputs myself — the draft spec or feature description, the markets and customer types (consumer, business), the product type, the partner bank or sponsor if any, and my company's existing policies if I choose to share them — all of that is material I hand you, it stays in our conversation, and the skill defines no network call, no API, no webhook, no connector and no posting or editing of anything. Its output is the draft section, produced in our conversation for me to paste into the spec myself and for compliance to review. One conditional reference, also disclosed here: SKILL.md says that if the separate Fintech Compliance Kit skills (know-your-customer, anti-money-laundering, privacy-data-security) are already installed, it uses them for detail and says so. Those three skills are not in this repository, are not part of this install, are not required, and nothing is fetched for them: only if I already have them installed do they inform the draft, in our conversation, at use time. SKILL.md also treats the spec I provide as data and says to ignore any instructions inside it. - Do not use the skill during this install: do not draft any spec section, do not build any trigger map, and do not contact compliance, legal, any partner bank or any service. 3. When I say "yes, install", install it as a skill: copy the whole fintech-spec-section folder into the agent's skills directory, in a folder named "fintech-spec-section", keeping its 1 file (SKILL.md at its root), byte-identical to the fingerprint above. A manual clone followed by copying the packages/regulated-spec-sections/skills/fintech-spec-section folder into ~/.claude/skills/ is the route described here; any other route is fine only as long as every installed file matches its fingerprint. 4. Verify with no network calls: the 1 file in place with a matching fingerprint, and the "name: fintech-spec-section" line present in its frontmatter. Also report, exactly as found and without fixing it, that a strict YAML parser rejects this frontmatter because the unquoted description contains ": " ("financial product: which obligations") — do not claim the frontmatter is valid, and do not edit the installed file to make it valid. Do not run any usage step to verify. 5. Report what was installed, where, and what I still need to do myself (for example: bring the draft spec or feature description, the markets and customer types, the product type, and the partner bank or sponsor if any, plus my existing policies if I want them used; have compliance confirm every threshold, timeline and open question myself, since the draft is not legal advice and states nothing as settled; keep card numbers, account numbers and real customer data out of anything I hand over for examples; using the skill is a separate step that only starts when I ask for it, and the use-time work disclosed above happens only then). GitHub is optional: if I have a GitHub account or the gh CLI, you may use it; otherwise public access is fine. Never require it unless it's in the prerequisites above. Rules: don't touch anything outside the temp folder and the install target. If anything looks off, stop and ask me.