Agent skill · security · sickn33
fsi-compliance-checker
Maps code, architecture, and infrastructure changes to specific control IDs in PCI-DSS v4.0 and MAS TRM (Singapore financial regulator), producing an audit-traceable findings report with per-control remediation.
Why this skill is useful
Adds a detailed compliance assessment workflow for PCI-DSS and MAS TRM that the AI cannot generate on its own.
What it needs
About 4k tokens when loaded. Last updated 2026-08-07. 44,571 stars on the source repository.
What this skill does
FSI Compliance Checker Overview Maps a concrete change (code diff, architecture design, IaC, pipeline config) to the specific controls it touches in financial services compliance frameworks — PCI-DSS v4.0 for payment card data and MAS TRM for Singapore-regulated institutions — and reports gaps with actionable remediation. This is engineering-level compliance triage: it helps teams catch violations before audit, but it does not replace a qualified assessor (QSA) or the institution's compliance function. Say so in every report. When to Use This Skill Use when a change touches payment card data (PAN, CVV, track data) and needs a PCI-DSS check Use when reviewing changes at a Singapore-regulated financial institution against MAS TRM expectations Use when someone asks "is this compliant", "does logging this violate PCI", or requests a banking-regulation review of a diff, design, or Terraform change Do NOT use for generic security review (no framework involved), GDPR/SOC2/HIPAA (out of bundled scope), or legal advice How It Works Step 1: Select the framework Load only the reference file(s) the engagement needs: Situation Load ----------- ------ Payment card data is stored, processed, or transmitted pci-dss.md Singapore-regulated financial institution (bank, insurer, capital markets, major payment institution) mas-trm.md Both apply (e.g. Singapore bank handling cards) Both files Other jurisdictions/frameworks (SOX, GDPR, HKMA, APRA) State they are out of scope; offer general secure-engineering review instead If the user hasn't said which applies, ask one question: what data does the change touch, and is the institution Singapore-regulated? Step 2: Scope the change Identify what the diff/design actually touches: data elements (card data? customer PII? credentials?), trust boundaries, environments (production? DR?), and third parties. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills sickn33/fsi-compliance-checker--f9a788