Agent skill · security · sickn33
pci-compliance
Review payment data flows and engineering control evidence for a scoped PCI assessment, without claiming certification.
Why this skill is useful
Provides specific compliance procedures and code examples for handling cardholder data securely, which the AI wouldn't reliably generate on its own.
What it needs
About 2k tokens when loaded. Last updated 2026-08-07. 44,571 stars on the source repository.
What this skill does
Payment Data and PCI Evidence Review When to Use Review payment data flows, prepare engineering controls or collect evidence for a scoped PCI assessment. This skill does not certify compliance or determine assessment eligibility on its own. Inputs and prerequisites Identify the merchant/service-provider role, acquiring institution, processor integration, systems handling account data and the applicable assessment documents. Obtain the current documents from the PCI SSC document library; confirm applicability with the responsible assessor or acquiring institution. Procedure 1. Follow resources/implementation-playbook.md to map forms, APIs, storage, queues, logs, telemetry, backups and support exports. 2. Prefer provider-hosted collection when appropriate. Verify what the application actually receives; a tokenization claim does not prove that raw account data never reaches another system. 3. Minimize retained data and document purpose, access, retention and deletion. Do not retain sensitive authentication data after authorization, even encrypted. Do not build a custom card vault from an illustrative encryption snippet. 4. Map required controls to implementation evidence: network boundaries, system configuration, data protection, access, monitoring, testing and operational ownership. Keep unverified controls marked as gaps. 5. Use allowlisted event fields in logs and responses. Test nested errors and retries with synthetic data; denylist filtering cannot anticipate every sensitive field name. 6. Verify role and resource authorization together. A broad payment role does not grant access to every customer's payment method. 7. Produce a control/evidence/gap/owner table and remediation plan. Treat SAQ eligibility, transaction thresholds and formal attestation as decisions requiring the applicable current guidance. Example Input: a checkout webhook is copied into application logs. Replace the log payload with approved event type, internal request ID and outcome fields. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills sickn33/pci-compliance--ece609