agentsclimarketplace

Pci dss

Skill bromso/metapowers/plugins/compliance/skills/pci-dss

A Claude Code plugin that adds an agentic skills framework, with MCP's and a meta prompting processes. Inspired by "Superpowers" & "Figma Console MCP", but not just for development or design; but for all aspect within the digital production cycle.

Install
npx -y skills add bromso/metapowers --skill pci-dss

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

One thing to look at

  • 1 stars1 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

What its author says it does

Copied from the file, not written here

Assess PCI DSS compliance — 12 requirements, SAQ determination, scope reduction

SKILL.md

4.4 KB, as published. Nobody here has run it

PCI DSS Assessment

Assess Payment Card Industry Data Security Standard (PCI DSS) compliance for "$ARGUMENTS". Determine SAQ type, assess the 12 requirements, and identify scope reduction opportunities.

Prerequisites

Read .metapowers/compliance/$ARGUMENTS/00-scope.md. If this file does not exist, tell the user:

Phase 0 (Scope) has not been completed for "$ARGUMENTS". Run /compliance:regulatory-landscape $ARGUMENTS first, or use --skip-checks to bypass.

If --skip-checks is present in $ARGUMENTS, skip this check.

Process

  1. Read context files:

    • Read plugins/compliance/shared/grc-lifecycle-guide.md for GRC methodology reference
    • Read plugins/compliance/shared/assessment-template.md for output structure
    • Read .metapowers/compliance/$ARGUMENTS/00-scope.md for scope and control framework context

  2. SAQ type determination:

    • Assess payment processing model and cardholder data flow
    • Determine applicable SAQ: A (card-not-present, fully outsourced), A-EP (e-commerce with partial outsourcing), B (imprint/standalone terminals), C (payment application connected to internet), D (all others), P2PE (validated P2PE merchants)
    • Evaluate merchant level (1-4) based on transaction volume
    • Document SAQ type and merchant level with rationale

  3. Scope assessment:

    • Identify all systems that store, process, or transmit cardholder data (CHD)
    • Map the Cardholder Data Environment (CDE)
    • Identify connected-to and security-impacting systems
    • Assess network segmentation effectiveness
    • Document in-scope systems, applications, and network segments

  4. 12 requirements assessment:

    • Req 1: Network security controls — firewall/network security device configuration, CDE isolation
    • Req 2: Secure configurations — vendor default passwords removed, system hardening standards
    • Req 3: Protect stored account data — data retention policies, rendering PAN unreadable, key management
    • Req 4: Encrypt transmission — strong cryptography for CHD over open/public networks
    • Req 5: Anti-malware — malware protection on all systems, anti-malware mechanisms current
    • Req 6: Secure development — secure SDLC, patch management, web application security (WAF)
    • Req 7: Restrict access — need-to-know access control, access control systems
    • Req 8: Identify users — unique IDs, MFA for CDE access, strong authentication policies
    • Req 9: Physical security — physical access controls to CDE, visitor management, media security
    • Req 10: Logging and monitoring — audit trails, log review, time synchronization, SIEM
    • Req 11: Security testing — vulnerability scans (ASV quarterly), penetration testing, IDS/IPS, file integrity monitoring
    • Req 12: Security policies — information security policy, risk assessment, security awareness, incident response
    • Score each requirement: in place / in place with remediation / not in place / not applicable

  5. Scope reduction opportunities:

    • Evaluate tokenization feasibility (replace CHD with tokens)
    • Assess Point-to-Point Encryption (P2PE) validated solutions
    • Review outsourcing options for payment processing
    • Evaluate network segmentation improvements
    • Identify quick wins for reducing in-scope systems

  6. Write the artifact to .metapowers/compliance/$ARGUMENTS/01-assess/pci-dss.md following the assessment template structure with:

    • SAQ Determination — SAQ type and merchant level with rationale
    • Scope Definition — CDE map, in-scope systems, segmentation assessment
    • 12 Requirements Assessment — scoring per requirement with sub-requirement detail
    • Scope Reduction Opportunities — tokenization, P2PE, outsourcing options
    • ASV and Penetration Testing Status — current scan and test coverage
    • Evidence Inventory — existing evidence and evidence gaps
    • Remediation Priorities — ranked list of gaps to address

Output

The PCI DSS assessment written to .metapowers/compliance/$ARGUMENTS/01-assess/pci-dss.md. Present a summary to the user highlighting:

  • SAQ type and merchant level determination
  • Overall compliance score across 12 requirements
  • Scope reduction opportunities with estimated effort savings
  • Top 3 gaps requiring remediation

Keep looking

Skills are one crate of 328,083. Ordering is by how many stacks a row turns up in, so the top of any crate is what has actually been picked rather than what has the most stars.