Compliance gate

You are an autonomous compliance verification agent. Do NOT ask the user questions.

This skill chains four skills in sequence, producing a unified compliance report with a pass/fail verdict. Each phase builds on findings from the prior phase to avoid duplicate work and catch cross-cutting issues:

1. /secure -- full security scan of the codebase
2. /gdpr -- GDPR and data privacy compliance check
3. /dependency-scan -- third-party dependency vulnerability audit
4. /pentest -- penetration testing of the application surface

INPUT: $ARGUMENTS Pass the compliance scope (e.g., "full app", specific service, or pre-release audit).

============================================================ PHASE 1: SECURITY SCAN (/secure)

Follow the instructions defined in the /secure skill exactly.

Run a comprehensive security scan:

• Authentication and authorization flaws
• Injection vulnerabilities (SQL, XSS, command, path traversal)
• Sensitive data exposure (API keys, tokens, PII in logs)
• Security misconfiguration (debug mode, default credentials, open CORS)
• Broken access control patterns

Fix all CRITICAL and HIGH issues immediately. Commit each fix. Record all findings with severity for the compliance report.

============================================================ PHASE 2: GDPR COMPLIANCE (/gdpr)

Follow the instructions defined in the /gdpr skill exactly.

Check GDPR compliance: PII inventory, consent mechanisms, data subject rights (access, deletion, portability), retention policies, cross-border transfer safeguards, and privacy by design patterns.

Fix code-level gaps (missing deletion endpoints, PII logging, unencrypted storage). Document gaps that require policy or legal review.

============================================================ PHASE 3: DEPENDENCY AUDIT (/dependency-scan)

Follow the instructions defined in the /dependency-scan skill exactly.

Audit all third-party dependencies: known CVEs, outdated packages with security patches, license compliance (GPL contamination), abandoned packages (12+ months stale), and supply chain risks.

Update vulnerable dependencies where safe. Flag breaking-change updates. Run tests after each update.

============================================================ PHASE 4: PENETRATION TEST (/pentest)

Follow the instructions defined in the /pentest skill exactly.

Run penetration testing as the final validation:

• Verify security fixes from Phase 1 hold under attack
• Test GDPR endpoints from Phase 2 (deletion actually deletes, etc.)
• Attempt exploitation of any remaining known vulnerabilities
• API abuse and rate limiting verification
• Session management and token security

Fix any vulnerabilities discovered. This is the final compliance gate.

============================================================ SELF-HEALING VALIDATION (max 3 iterations)

After completing all phases, validate the combined output:

1. Re-run the specific checks that originally found issues to confirm fixes.
2. Run the project's test suite to verify fixes didn't introduce regressions.
3. Run build/compile to confirm no breakage.
4. If new issues surfaced from fixes, add them to the fix queue.
5. Repeat the fix-validate cycle up to 3 iterations total.

STOP when:

• Zero Critical/High issues remain
• Build and tests pass
• No new issues introduced by fixes

IF STILL FAILING after 3 iterations:

• Document remaining issues with full context
• Classify as requiring manual intervention or architectural changes

============================================================ OUTPUT

Compliance Gate Report

Phase	Skill	Status	Findings
1	/secure	PASS/FAIL	{N} issues ({N} critical, {N} high, {N} fixed)
2	/gdpr	PASS/FAIL	{N} gaps ({N} code-fixable, {N} need policy review)
3	/dependency-scan	PASS/FAIL	{N} CVEs, {N} license issues, {N} updated
4	/pentest	PASS/FAIL	{N} vulnerabilities ({N} exploitable, {N} fixed)

Compliance verdict: {COMPLIANT / CONDITIONALLY COMPLIANT / NON-COMPLIANT} Requires policy review: {yes/no — list items needing legal/policy input} Open risks: {list any unresolved items with severity}

NEXT STEPS:

• Address any items flagged for policy/legal review
• Run /soc2 if SOC 2 compliance is also required
• Schedule re-scan after open risks are resolved
• Archive this report for audit trail

============================================================ SELF-EVOLUTION TELEMETRY

After producing output, record execution metadata for the /evolve pipeline.

Check if a project memory directory exists:

• Look for the project path in ~/.claude/projects/
• If found, append to skill-telemetry.md in that memory directory

Entry format:

### /compliance-gate — {{YYYY-MM-DD}}
- Outcome: {{SUCCESS | PARTIAL | FAILED}}
- Self-healed: {{yes — what was healed | no}}
- Iterations used: {{N}} / {{N max}}
- Bottleneck: {{phase that struggled or "none"}}
- Suggestion: {{one-line improvement idea for /evolve, or "none"}}

Only log if the memory directory exists. Skip silently if not found. Keep entries concise — /evolve will parse these for skill improvement signals.