ClaudeSuperPower
SubmitLog in

pci-secure-software

Skill

Automated PCI Secure Software Standard (SSS) v2.0 readiness gap-assessment of an application from its source code and documentation. Deterministically enumerates every applicable Test Requirement from a pinned catalog, gathers source/doc evidence, and emits an evidence-bound per-requirement verdict

0Documentation

Install

git clone https://github.com/transilienceai/communitytools.git ~/.claude/skills/pci-secure-software

What is pci-secure-software?

Automated PCI Secure Software Standard (SSS) v2.0 readiness gap-assessment of an application from its source code and documentation. Deterministically enumerates every applicable Test Requirement from a pinned catalog, gathers source/doc evidence, and emits an evidence-bound per-requirement verdict (MET / NOT_MET / PARTIALLY_MET / NOT_APPLICABLE / REQUIRES_MANUAL_REVIEW) with file+line citations, then a Transilience gap report. Use when asked to assess, gap-assess, or check an application's readiness against the PCI Secure Software Standard v2.0 / PCI SSF, or to map source code and design docs to PCI SSS Security Objectives and Test Requirements. Produces a readiness gap-analysis only — NOT an official PCI validation.

What this can do

Capabilities declared in this component's own frontmatter — not inferred.

Inherit all session tools

Declares no tool restrictions — inherits every session tool

~182 tokens of context used while enabled, before you invoke anything

Documentation

README · ~3 min read

pci-secure-software

About this skill

A knowledge layer + orchestration contract for running a forensically-defensible PCI Secure Software Standard (SSS) v2.0 readiness assessment of an application end-to-end, from its source code, design documentation, and dependency manifests. Every verdict is anchored to a real file:line + quoted snippet; every requirement comes from a pinned catalog, never model memory.

This is a readiness gap-analysis, not an official PCI validation. The PCI SSS defines no In-Place/Not-in-Place marking scheme — marking occurs solely in the ROV/AOV templates assessed by a qualified assessor. Say so in every report.

Persona — Asa

When you operate this tool you are Asa, a senior software-security assessor. Methodical, catalog-grounded, honest about scope. Walk the pipeline cleanly; one status line per phase. When evidence cannot prove a requirement, you record REQUIRES_MANUAL_REVIEW — never a convenient MET. You fail closed.

What you produce

Per applicable Test Requirement: a status verdict + the evidence that proves it (or the gap) + the why + a remediation suggestion. Aggregated into Compliance-Assessment-Report.pdf + compliance-report.json + tracker.csv, gated on 100% coverage and deterministic citation verification.

The deterministic source of truth

The requirement set is never generated by the model. It is loaded from the pinned catalog reference/catalog/pci-sss-v2.0.json (one entry per lettered Test Requirement) and filtered to the applicable set by tools/pci-sss/applicability.py. See reference/catalog/INDEX.md and reference/core/applicability.md.

Reviews

Log in to leave a review.

No reviews yet — be the first.

Explore related

Other things in this space — across every part of the ecosystem, not just skills.

Subagents

All subagents →

agent-sdk-verifier-ts

Use this agent to verify that a TypeScript Agent SDK application is properly configured, follows SDK best practices and documentation recommendations, and is ready for deployment or testing. This agent should be invoked after a TypeScript Agent SDK app has been created or modified.

32.8K stars

comment-analyzer

Use this agent when you need to analyze code comments for accuracy, completeness, and long-term maintainability. This includes (1) after generating large documentation comments or docstrings, (2) before finalizing a pull request that adds or modifies comments, (3) when reviewing existing comments fo

32.8K stars

agent-sdk-verifier-py

Use this agent to verify that a Python Agent SDK application is properly configured, follows SDK best practices and documentation recommendations, and is ready for deployment or testing. This agent should be invoked after a Python Agent SDK app has been created or modified.

32.8K stars