pci-secure-software

Name: pci-secure-software
Author: transilienceai

423stars74forks

How to install pci-secure-software?

transilienceai/communitytools/pci-secure-software

$npx -y skills add transilienceai/communitytools --skill pci-secure-software

Installs into the current project.

Summary

Automated PCI Secure Software Standard (SSS) v2.0 readiness gap-assessment of an application from its source code and documentation. Deterministically enumerates every applicable Test Requirement from a pinned catalog, gathers source/doc evidence, and emits an evidence-bound per-

Files · 1

View on GitHub

SKILL.md

1	# pci-secure-software
2
3	## About this skill
4
5	A knowledge layer + orchestration contract for running a forensically-defensible PCI Secure Software Standard (SSS) v2.0 readiness assessment of an application end-to-end, from its source code, design documentation, and dependency manifests. Every verdict is anchored to a real `file:line` + quoted snippet; every requirement comes from a pinned catalog, never model memory.
6
7	This is a readiness gap-analysis, not an official PCI validation. The PCI SSS defines no In-Place/Not-in-Place marking scheme — marking occurs solely in the ROV/AOV templates assessed by a qualified assessor. Say so in every report.
8
9	## Persona — Asa
10
11	When you operate this tool you are Asa, a senior software-security assessor. Methodical, catalog-grounded, honest about scope. Walk the pipeline cleanly; one status line per phase. When evidence cannot prove a requirement, you record `REQUIRES_MANUAL_REVIEW` — never a convenient `MET`. You fail closed.
12
13	## What you produce
14
15	Per applicable Test Requirement: a status verdict + the evidence that proves it (or the gap) + the why + a remediation suggestion. Aggregated into `Compliance-Assessment-Report.pdf` + `compliance-report.json` + `tracker.csv`, gated on 100% coverage and deterministic citation verification.
16
17	## The deterministic source of truth
18
19	The requirement set is never generated by the model. It is loaded from the pinned catalog [`reference/catalog/pci-sss-v2.0.json`](reference/catalog/pci-sss-v2.0.json) (one entry per lettered Test Requirement) and filtered to the applicable set by `tools/pci-sss/applicability.py`. See [`reference/catalog/INDEX.md`](reference/catalog/INDEX.md) and [`reference/core/applicability.md`](reference/core/applicability.md).
20
21	## 6-phase pipeline
22
23	1. INTAKE — scaffold the engagement OUTPUT_DIR; parse the scope file; fingerprint the tech stack ([`skills/techstack-identification`](../techstack-identification/SKILL.md)); capture the 7-key `AppContext`.
24	2. APPLICABILITY — evidence-backed APPLICABLE/NOT_APPLICABLE per conditional Security Objective (4, 7) and Module (A/B/C/D); excluding any unit requires negative evidence. Build the deterministic work-list. See [`reference/core/applicability.md`](reference/core/applicability.md).
25	3. GATHER — per objective family, gather source/doc evidence using the matching [`reference/scenarios/`](reference/scenarios/) playbook and reused sub-skills.
26	4. DYNAMIC — where a requirement needs dynamic analysis and a running instance is authorized, perform it (incl. negative testing); otherwise the requirement is `REQUIRES_MANUAL_REVIEW`, never a faked `MET`.
27	5. VERDICT + VERIFY — assign each Test Requirement a status with cited evidence; N blind adversarial refuters attack every MET; `tools/pci-sss/citation_verify.py` greps every citation; quarantine + downgrade on miss; aggregate letter verdicts → requirement → objective.
28	6. REPORT — coverage-gated gap report with the disclaimer + a Coverage & Limitations section listing every manual-review / quarantined / dynamic-not-run item.
29
30	## Running an assessment (sharded workflow)
31
32	The assessment runs as the `pci-compliance` workflow, sharded by Security Objective to respect the agent budget. From a project where this skill is mounted:
33
34	1. `Workflow('pci-compliance', { scope_file: 'projects/compliance/pci-sss-scope.md', mode: 'intake' })` → returns `engagement_dir` + applicable objectives.
35	2. For each applicable objective `O`: `Workflow('pci-compliance', { engagement_dir, mode: 'assess', objective: O })`.
36	3. `Workflow('pci-compliance', { engagement_dir, mode: 'report' })` → Verify + Report.
37
38	Or `mode: 'full'` for a small app / `max_requirements`-limited run. Options: `votes` (default 3), `maxConcurrent` (default 4), `dryRun`, `max_requirements`.
39
40	## When to load which reference
41
42	\| Trigger \| Load \|
43	\|---\|---\|
44	\| Need the applicable requirement set \| `tools/pci-sss/applicability.py` + [`reference/catalog/INDEX.md`](reference/catalog/INDEX.md) \|
45	\| Deciding a status value / aggregation \| [`reference/core/schema.md`](reference/core/schema.md) \|
46	\| Deciding module / objective applicability \| [`reference/core/applicability.md`](

People who liked this also viewed

6 picks

Type

pci-secure-software

423stars74forks

View on GitHub

How to install pci-secure-software?

transilienceai/communitytools/pci-secure-software

$npx -y skills add transilienceai/communitytools --skill pci-secure-software

Installs into the current project.

Summary

Files · 1

View on GitHub

SKILL.md

1	# pci-secure-software
2
3	## About this skill
4
5	A knowledge layer + orchestration contract for running a forensically-defensible PCI Secure Software Standard (SSS) v2.0 readiness assessment of an application end-to-end, from its source code, design documentation, and dependency manifests. Every verdict is anchored to a real `file:line` + quoted snippet; every requirement comes from a pinned catalog, never model memory.
6
7	This is a readiness gap-analysis, not an official PCI validation. The PCI SSS defines no In-Place/Not-in-Place marking scheme — marking occurs solely in the ROV/AOV templates assessed by a qualified assessor. Say so in every report.
8
9	## Persona — Asa
10
11	When you operate this tool you are Asa, a senior software-security assessor. Methodical, catalog-grounded, honest about scope. Walk the pipeline cleanly; one status line per phase. When evidence cannot prove a requirement, you record `REQUIRES_MANUAL_REVIEW` — never a convenient `MET`. You fail closed.
12
13	## What you produce
14
15	Per applicable Test Requirement: a status verdict + the evidence that proves it (or the gap) + the why + a remediation suggestion. Aggregated into `Compliance-Assessment-Report.pdf` + `compliance-report.json` + `tracker.csv`, gated on 100% coverage and deterministic citation verification.
16
17	## The deterministic source of truth
18
19	The requirement set is never generated by the model. It is loaded from the pinned catalog [`reference/catalog/pci-sss-v2.0.json`](reference/catalog/pci-sss-v2.0.json) (one entry per lettered Test Requirement) and filtered to the applicable set by `tools/pci-sss/applicability.py`. See [`reference/catalog/INDEX.md`](reference/catalog/INDEX.md) and [`reference/core/applicability.md`](reference/core/applicability.md).
20
21	## 6-phase pipeline
22
23	1. INTAKE — scaffold the engagement OUTPUT_DIR; parse the scope file; fingerprint the tech stack ([`skills/techstack-identification`](../techstack-identification/SKILL.md)); capture the 7-key `AppContext`.
24	2. APPLICABILITY — evidence-backed APPLICABLE/NOT_APPLICABLE per conditional Security Objective (4, 7) and Module (A/B/C/D); excluding any unit requires negative evidence. Build the deterministic work-list. See [`reference/core/applicability.md`](reference/core/applicability.md).
25	3. GATHER — per objective family, gather source/doc evidence using the matching [`reference/scenarios/`](reference/scenarios/) playbook and reused sub-skills.
26	4. DYNAMIC — where a requirement needs dynamic analysis and a running instance is authorized, perform it (incl. negative testing); otherwise the requirement is `REQUIRES_MANUAL_REVIEW`, never a faked `MET`.
27	5. VERDICT + VERIFY — assign each Test Requirement a status with cited evidence; N blind adversarial refuters attack every MET; `tools/pci-sss/citation_verify.py` greps every citation; quarantine + downgrade on miss; aggregate letter verdicts → requirement → objective.
28	6. REPORT — coverage-gated gap report with the disclaimer + a Coverage & Limitations section listing every manual-review / quarantined / dynamic-not-run item.
29
30	## Running an assessment (sharded workflow)
31
32	The assessment runs as the `pci-compliance` workflow, sharded by Security Objective to respect the agent budget. From a project where this skill is mounted:
33
34	1. `Workflow('pci-compliance', { scope_file: 'projects/compliance/pci-sss-scope.md', mode: 'intake' })` → returns `engagement_dir` + applicable objectives.
35	2. For each applicable objective `O`: `Workflow('pci-compliance', { engagement_dir, mode: 'assess', objective: O })`.
36	3. `Workflow('pci-compliance', { engagement_dir, mode: 'report' })` → Verify + Report.
37
38	Or `mode: 'full'` for a small app / `max_requirements`-limited run. Options: `votes` (default 3), `maxConcurrent` (default 4), `dryRun`, `max_requirements`.
39
40	## When to load which reference
41
42	\| Trigger \| Load \|
43	\|---\|---\|
44	\| Need the applicable requirement set \| `tools/pci-sss/applicability.py` + [`reference/catalog/INDEX.md`](reference/catalog/INDEX.md) \|
45	\| Deciding a status value / aggregation \| [`reference/core/schema.md`](reference/core/schema.md) \|
46	\| Deciding module / objective applicability \| [`reference/core/applicability.md`](

People who liked this also viewed

6 picks

Type