agentsclimarketplace

Compliance awareness

Skill ShieldNet-360/secure-vibe/skills/compliance-awareness

SecureVibe — prevention-first security for AI-written code. Signed SKILL.md knowledge that makes AI coding assistants write secure code at generation time, plus a deterministic CI gate. Offline · keyless · Ed25519-signed. By ShieldNet360.

Install
npx -y skills add ShieldNet-360/secure-vibe --skill compliance-awareness

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

One thing to look at

  • 2 stars2 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

What its author says it does

Copied from the file, not written here

Map generated code against OWASP, CWE, and SANS Top 25 controls for traceability

SKILL.md

4.4 KB, as published. Nobody here has run it

Compliance Awareness

Rules (for AI agents)

ALWAYS

  • Tag functions that handle PII / PHI / PCI data with a comment indicating the classification (e.g. // classification: PII).
  • Log audit events for security-relevant actions (login, permission change, data export, admin operations) — log who, what, when, NOT the sensitive payload.
  • Identify the CWE / OWASP category for security-relevant code in comments when the team's convention is to include traceability (// addresses CWE-79 — XSS).
  • For PCI scope, segregate card-data-handling code into clearly-named modules so scope boundaries are visible.
  • For HIPAA workloads, prefer encryption at rest AND in transit, with documented key management.

NEVER

  • Include PII / PHI / PCI in log messages, error messages, or telemetry events.
  • Store payment card numbers, CVVs, or full magnetic stripe data outside of a PCI DSS-compliant tokenization service.
  • Mix PII-handling code into general utility modules without explicit classification.
  • Generate code that processes EU residents' personal data without considering GDPR obligations (right to erasure, data minimization, lawful basis).
  • Suggest workarounds that bypass compliance controls "for development" — these workarounds always leak into production.

KNOWN FALSE POSITIVES

  • Logs of types of data accessed ("user accessed claim record") are usually fine; the rule is against logging the contents of sensitive fields.
  • Test fixtures using clearly fake data (555-0100 phone numbers, 4111-1111-1111-1111 PAN, John Doe) are not PII.
  • Audit log retention is intentionally long (often years) and should not be filtered by general data-retention sweeps.

Context (for humans)

Compliance frameworks (PCI DSS, HIPAA, SOC 2, ISO 27001, GDPR) prescribe controls but don't tell developers what code to write. This skill bridges the gap by attaching control-relevant guidance to AI generation steps, so the resulting code is audit-friendly by default.

Verify & lock (triaging a finding)

A compliance gap flagged in review is a candidate, not a confirmed gap. Confirm the control is actually missing, remediate, then lock it so the control can't silently regress between audits.

  1. Confirm the gap is real (map to the control + check for evidence). Tie the finding to a specific clause — SOC 2 CC-series, PCI DSS requirement, HIPAA Security Rule safeguard, GDPR article — then check whether the technical evidence for that control actually exists: encryption-at-rest flag enabled, audit logging on for the security-relevant action, MFA enforced on the access path, PII/PHI classification tags present, the data-retention/erasure job scheduled and running. Real gap if the evidence is absent; false positive if a compensating control (tokenization service, network segmentation, an existing managed-encryption layer) already satisfies the clause.
  2. Remediate, then lock with an automated control test (unit or integration — dev's call). Write a CI check that asserts the control's technical evidence as compliance-as-code: the config flag is set, the audit-log entry is emitted for the sensitive action, the classification comment/tag is present on the data-handling module, the retention policy exists. Add a passing baseline and commit it, so the control is verified continuously rather than rediscovered at the next audit.

References

Keep looking

Skills are one crate of 328,083. Ordering is by how many stacks a row turns up in, so the top of any crate is what has actually been picked rather than what has the most stars.