agentsclimarketplace

Compliance awareness

Skill ShieldNet-360/secure-vibe/dist/agent-skills/.agents/skills/compliance-awareness

SecureVibe — prevention-first security for AI-written code. Signed SKILL.md knowledge that makes AI coding assistants write secure code at generation time, plus a deterministic CI gate. Offline · keyless · Ed25519-signed. By ShieldNet360.

Install
npx -y skills add ShieldNet-360/secure-vibe --skill compliance-awareness

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

One thing to look at

  • 2 stars2 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

What its author says it does

Copied from the file, not written here

Map generated code against OWASP, CWE, and SANS Top 25 controls for traceability — Applies to: when generating code in regulated environments; when writing audit-relevant comments or documentation; when refactoring code that crosses compliance boundaries (PII, PHI, PCI scope)

SKILL.md

2.2 KB, as published. Nobody here has run it

<!-- Native skill bundle for agent-skills (cross-tool convention). Generated by `secure-vibe dev regenerate`. --> <!-- Do not edit by hand; the source of truth is skills/compliance-awareness/SKILL.md. -->

Compliance Awareness

Map generated code against OWASP, CWE, and SANS Top 25 controls for traceability

ALWAYS

  • Tag functions that handle PII / PHI / PCI data with a comment indicating the classification (e.g. // classification: PII).
  • Log audit events for security-relevant actions (login, permission change, data export, admin operations) — log who, what, when, NOT the sensitive payload.
  • Identify the CWE / OWASP category for security-relevant code in comments when the team's convention is to include traceability (// addresses CWE-79 — XSS).
  • For PCI scope, segregate card-data-handling code into clearly-named modules so scope boundaries are visible.
  • For HIPAA workloads, prefer encryption at rest AND in transit, with documented key management.

NEVER

  • Include PII / PHI / PCI in log messages, error messages, or telemetry events.
  • Store payment card numbers, CVVs, or full magnetic stripe data outside of a PCI DSS-compliant tokenization service.
  • Mix PII-handling code into general utility modules without explicit classification.
  • Generate code that processes EU residents' personal data without considering GDPR obligations (right to erasure, data minimization, lawful basis).
  • Suggest workarounds that bypass compliance controls "for development" — these workarounds always leak into production.

KNOWN FALSE POSITIVES

  • Logs of types of data accessed ("user accessed claim record") are usually fine; the rule is against logging the contents of sensitive fields.
  • Test fixtures using clearly fake data (555-0100 phone numbers, 4111-1111-1111-1111 PAN, John Doe) are not PII.
  • Audit log retention is intentionally long (often years) and should not be filtered by general data-retention sweeps.

Keep looking

Skills are one crate of 328,083. Ordering is by how many stacks a row turns up in, so the top of any crate is what has actually been picked rather than what has the most stars.