ai-tool-compliance

Files (21)

• REFERENCE.md
• SETUP.md
• SKILL.md
• SKILL.toon
• rule-catalog.md · resources/
• score-weights.md · resources/
• catalog-all.json · rules/
• catalog-p1.json · rules/
• catalog.json · rules/
• p0-catalog.yaml · rules/
• p1-catalog.yaml · rules/
• gate.sh · scripts/
• install.sh · scripts/
• notify.sh · scripts/
• score.sh · scripts/
• verify.sh · scripts/
• ai-tool-compliance.yml · templates/
• remediation-task.json · templates/
• risk-score-report.md · templates/
• role-approval-checklist.md · templates/
• verification-run.json · templates/

SKILL.md (first lines)

# ai-tool-compliance - Internal AI Tool Compliance Automation

## When to use this skill

- **Starting a new AI project**: When scaffolding the compliance foundation (RBAC, Gateway, logs, cost tracking) from scratch
- **Pre-deploy P0 full verification**: When automatically evaluating all 13 P0 mandatory requirements as pass/fail and computing a compliance score
- **RBAC design and permission matrix generation**: When defining the 5 roles (Super Admin/Admin/Manager/Viewer/Guest) + granular access control per game/menu/feature unit
- **Auditing existing code for compliance**: When inspecting an existing codebase against the guide and identifying violations
- **Implementing cost transparency**: When building a tracking system for model/token/BQ scan volume/cost per action
- **Designing a behavior log schema**: When designing a comprehensive behavior log recording system (Firestore/BigQuery)
- **Role-based verification workflow**: When configuring the release approval process based on Section 14 (ServiceStability/Engineer/PM/CEO)
- **Building a criteria verification system**: When setting up the Rule Registry + Evidence Collector + Verifier Engine + Risk Scorer + Gatekeeper architecture

---

## Installation

```bash
npx skills add https://github.com/supercent-io/skills-template --skill ai-tool-compliance
```

---

## Quick Reference

| Action | Command | Description |
|--------|---------|-------------|
| Project initialization | `/compliance-init` | Generate RBAC matrix, Gateway boilerplate, log schema, cost tracking interface |
| Quick scan | `/compliance-scan`, `/compliance-quick`, `/quick` | Quick inspection of P0 key items (code pattern-based) |
| Full verification | `/compliance-verify`, `/compliance-full`, `/full` | Full verification of 11 P0 rules + compliance score computation |
| Score check | `/compliance-score` | Display current compliance score (security/auth/cost/logging) |
| Deploy gate | `/compliance-gate` | Green/Yellow/Red verdict + deploy approve/block decision |
| Improvement guide | `/compliance-improve`, `/improve` | Specific fix suggestions per violation + re-verification loop |

### Slash Mode Router

Mode slash commands are mapped as follows.

- `/quick`, `/compliance-quick` -> Quick Scan (`/compliance-scan`)
- `/full`, `/compliance-full` -> Full Verify (`/compliance-verify`)
- `/improve` -> Improve (`/compliance-improve`)

---

## 3 Execution Modes

### 1. Quick Scan (`quick-scan`)

Statically analyzes the codebase to quickly identify potential P0 violations.

**How to run**: `/compliance-scan`, `/compliance-quick`, `/quick` or trigger keywords `compliance scan`, `quick scan`

**What it does**:
- Grep/Glob-based code pattern search
- Detect direct external API calls (whether Gateway is bypassed)
- Detect direct Firestore client access
- Detect hardcoded sensitive data
- Check for missing Guest role

**Output**: List of suspected violations (file path + line number + rule ID)

**Duration**: 1–3 minutes

### 2. Full Verify (`full-verify`)

Fully verifies all 11 P0 rules and computes a quantitative compliance score.

**How to run**: `/compliance-verify`, `/compliance-full`, `/full` or trigger keywords `P0 verification`, `full verify`, `deploy verification`

**What it does**:
- Collect Evidence and evaluate pass/fail for each of the 11 P0 rules
- Compute scores per 4 domains (Security 40pts / Auth 25pts / Cost 20pts / Logging 15pts)
- Calculate total compliance score (out of 100)
- Determine deploy gate grade (Green/Yellow/Red)
- Generate role-based approval checklist

**Output**: Compliance report (`compliance-report.md`)

```
## Compliance Report
- Date: 2026-03-03
- Project: my-ai-tool
- Score: 92/100 (Green)

### Rule Results
| Rule ID | Rule Name | Result | Evidence |
|---------|-----------|--------|----------|
| AUTH-P0-001 | Force Guest for New Signups | PASS | signup.ts:45 role='guest' |
| AUTH-P0-002 | Block Guest Menu/API Access | PASS | middleware.ts:12 guestBlock |
| ... | ... | ... | ... |

### Score Breakdown
- Security: 33/40
- Auth: 25/25
- Cost: 17/20
- Logging: 12/15
- Total: 92/100

### Gate Decision: GREEN - Deploy Approved
```

**Duration**: 5–15 minutes (varies by project size)

### 3. Improve (`improve`)

Provides specific fix guides for violations and runs a re-verification loop.

**How to run**: `/compliance-improve`, `/improve` or trigger keywords `compliance improvement`, `fix violations`

**What it does**:
- Code-level fix suggestions for each FAIL item (file path + before/after code)
- Re-verify the rule after applying the fix
- Track score changes (Before -> After)
- Guide for gradually introducing P1 recommended requirements after passing P0

**Output**: Fix proposal + re-verification results

### Improve Mode Auto-Fix Logic

From jyjeanne/ai-setup-forge, MIT.

More from jyjeanne/ai-setup-forge