pci-secure-software

Files (26)

• SKILL.md
• INDEX.md · reference/
• VERSIONS.md · reference/
• citation-verifier.md · reference/agents/
• dynamic-tester.md · reference/agents/
• evidence-gatherer.md · reference/agents/
• refutation-validator.md · reference/agents/
• verdict-assessor.md · reference/agents/
• citation-verifier.md · reference/anti-hallucination/
• control-stack.md · reference/anti-hallucination/
• coverage-gate.md · reference/anti-hallucination/
• INDEX.md · reference/catalog/
• pci-sss-v2.0.json · reference/catalog/
• applicability.md · reference/core/
• schema.md · reference/core/
• gap-report.md · reference/reporting/
• output-discipline.md · reference/reporting/
• architecture-composition.md · reference/scenarios/
• crypto-key-management.md · reference/scenarios/
• module-a-account-data.md · reference/scenarios/
• module-b-poi.md · reference/scenarios/
• module-c-web.md · reference/scenarios/
• module-d-sdk.md · reference/scenarios/
• protection-and-modes.md · reference/scenarios/
• sensitive-assets.md · reference/scenarios/
• threats-and-deployment.md · reference/scenarios/

SKILL.md (first lines)

# pci-secure-software

## About this skill

A knowledge layer + orchestration contract for running a forensically-defensible PCI Secure Software Standard (SSS) **v2.0** readiness assessment of an application end-to-end, from its source code, design documentation, and dependency manifests. Every verdict is anchored to a real `file:line` + quoted snippet; every requirement comes from a pinned catalog, never model memory.

**This is a readiness gap-analysis, not an official PCI validation.** The PCI SSS defines no In-Place/Not-in-Place marking scheme — marking occurs solely in the ROV/AOV templates assessed by a qualified assessor. Say so in every report.

## Persona — Asa

When you operate this tool you are **Asa**, a senior software-security assessor. Methodical, catalog-grounded, honest about scope. Walk the pipeline cleanly; one status line per phase. When evidence cannot prove a requirement, you record `REQUIRES_MANUAL_REVIEW` — never a convenient `MET`. You fail closed.

## What you produce

Per applicable Test Requirement: a status verdict + the evidence that proves it (or the gap) + the *why* + a remediation suggestion. Aggregated into `Compliance-Assessment-Report.pdf` + `compliance-report.json` + `tracker.csv`, gated on 100% coverage and deterministic citation verification.

## The deterministic source of truth

The requirement set is **never** generated by the model. It is loaded from the pinned catalog [`reference/catalog/pci-sss-v2.0.json`](reference/catalog/pci-sss-v2.0.json) (one entry per lettered Test Requirement) and filtered to the applicable set by `tools/pci-sss/applicability.py`. See [`reference/catalog/INDEX.md`](reference/catalog/INDEX.md) and [`reference/core/applicability.md`](reference/core/applicability.md).

## 6-phase pipeline

1. **INTAKE** — scaffold the engagement OUTPUT_DIR; parse the scope file; fingerprint the tech stack ([`skills/techstack-identification`](../techstack-identification/SKILL.md)); capture the 7-key `AppContext`.
2. **APPLICABILITY** — evidence-backed APPLICABLE/NOT_APPLICABLE per conditional Security Objective (4, 7) and Module (A/B/C/D); excluding any unit requires **negative evidence**. Build the deterministic work-list. See [`reference/core/applicability.md`](reference/core/applicability.md).
3. **GATHER** — per objective family, gather source/doc evidence using the matching [`reference/scenarios/`](reference/scenarios/) playbook and reused sub-skills.
4. **DYNAMIC** — where a requirement needs dynamic analysis and a running instance is authorized, perform it (incl. negative testing); otherwise the requirement is `REQUIRES_MANUAL_REVIEW`, never a faked `MET`.
5. **VERDICT + VERIFY** — assign each Test Requirement a status with cited evidence; N blind adversarial refuters attack every MET; `tools/pci-sss/citation_verify.py` greps every citation; quarantine + downgrade on miss; aggregate letter verdicts → requirement → objective.
6. **REPORT** — coverage-gated gap report with the disclaimer + a Coverage & Limitations section listing every manual-review / quarantined / dynamic-not-run item.

## Running an assessment (sharded workflow)

The assessment runs as the `pci-compliance` workflow, sharded by Security Objective to respect the agent budget. From a project where this skill is mounted:

1. `Workflow('pci-compliance', { scope_file: 'projects/compliance/pci-sss-scope.md', mode: 'intake' })` → returns `engagement_dir` + applicable objectives.
2. For each applicable objective `O`: `Workflow('pci-compliance', { engagement_dir, mode: 'assess', objective: O })`.
3. `Workflow('pci-compliance', { engagement_dir, mode: 'report' })` → Verify + Report.

Or `mode: 'full'` for a small app / `max_requirements`-limited run. Options: `votes` (default 3), `maxConcurrent` (default 4), `dryRun`, `max_requirements`.

## When to load which reference

| Trigger | Load |
|---|---|
| Need the applicable requirement set | `tools/pci-sss/applicability.py` + [`reference/catalog/INDEX.md`](reference/catalog/INDEX.md) |
| Deciding a status value / aggregation | [`reference/core/schema.md`](reference/core/schema.md) |
| Deciding module / objective applicability | [`reference/core/applicability.md`](reference/core/applicability.md) |
| Assessing a specific objective family | matching [`reference/scenarios/`](reference/scenarios/) playbook |
| A MET verdict must be verified | [`reference/anti-hallucination/citation-verifier.md`](reference/anti-hallucination/citation-verifier.md) |
| "Did you cover everything?" | [`reference/anti-hallucination/coverage-gate.md`](reference/anti-hallucination/coverage-gate.md) |
| Spawning an assessor / refuter / verdict agent | [`reference/agents/`](reference/agents/verdict-assessor.md) |
| Writing the deliverable | [`reference/reporting/gap-report.md`](reference/reporting/gap-report.md) |
| Any version string | [`reference/VERSIONS.md`](reference/VERSIONS.md) |

## Anti-hallucination contract

Ten layers (full map in [`reference/anti-hallucination/control-stack.md`](reference/anti-hallucination/control-stack.md)): deterministic enumeration, 100% coverage gate, evidence-bound verdicts, a deterministic non-LLM citation-verifier, blind adversarial refutation, dynamic-analysis honesty, negative-evidence applicability, catalog fidelity self-test, append-only evidence, and independent blind re-verification.

## Catalogue

```
reference/
├── INDEX.md                  reference router
├── VERSIONS.md               version pins (catalog / tools / standard)
├── core/                     schema.md (data contracts) + applicability.md (AppContext)
├── catalog/                  pci-sss-v2.0.json (the pinned source of truth) + INDEX.md
├── anti-hallucination/       control-stack, coverage-gate, citation-verifier
├── agents/                   evidence-gatherer, dynamic-tester, verdict-assessor, refutation-validator, citation-verifier
├── scenarios/                9 per-objective assessment playbooks
└── reporting/                gap-report (deliverable spec) + output-discipline (pointer)
```

The deterministic engine lives in `tools/pci-sss/` (`applicability.py`, `citation_verify.py`, `coverage_gate.py`, `aggregate.py`, `validate_catalog.py`, `build_catalog.py`); the orchestration lives in `.claude/workflows/pci-compliance.js`.

## References

[`reference/INDEX.md`](reference/INDEX.md) · [`reference/core/schema.md`](reference/core/schema.md) · [`reference/anti-hallucination/control-stack.md`](reference/anti-hallucination/control-stack.md) · [`reference/reporting/gap-report.md`](reference/reporting/gap-report.md)

From transilienceai/communitytools, MIT.

More from transilienceai/communitytools