Ready to supercharge your AI agents?

Install any skill in seconds. Free to start, no credit card required.

Get Started Free →

Compliance Validator Skill · a5c-ai | DecimalAI

a5c-ai/compliance-validator

SkillScore45Maintained

Validate compliance during migration with rule checking, audit trails, and security control validation

Securityby a5c-ai

Links this skill to your agents and keeps it current with the author’s updates.

Automatic

Security & AppSec pack

1 · One-time — install the CLI (docs ↗)

pip install decimalai

2 · Get the skill — writes .claude/skills/a5c-ai-compliance-validator/SKILL.md

decimalai skills pull a5c-ai-compliance-validator --out .claude/skills/

No CLI? Get the same file — curl · raw file

curl -fsSL --create-dirs -o .claude/skills/a5c-ai-compliance-validator/SKILL.md https://app.decimal.ai/s/a5c-ai-compliance-validator/SKILL.md

Raw file: /s/a5c-ai-compliance-validator/SKILL.md ↗ · machine-readable summary at /s/a5c-ai-compliance-validator.json ↗

In productionGlobal

how this skill behaves on real traffic · last 30 days

No production data for this skill yet — usage numbers appear here once agents start running it.

Anonymized aggregate across every org using this skill — proof from real production use, not a demo.

Does this skill help? · Benchmark: with vs. withoutsign in to run this on your agents

22 test cases from the publisher’s eval.yaml · each run twice on gemini-3.6-flash — with the skill injected, then without · last run 58d ago

Yes — +41% lift-13% tokens0% turns45% of whole cases pass with skill (10/22)

Test case	Without → With	Effect	Δ tokens	Δ turns
case-01	✗→✓	▲ Improved	-16%	0%
case-02	✗→✓	▲ Improved	7%	0%
case-03	✗→✓	▲ Improved	-14%	0%
case-09	✗→✓	▲ Improved	-28%	0%
case-17	✗→✓	▲ Improved	-14%	0%

Showing 5 of 22 cases

SkillSafety

✓ 3 of 3 passed

Code scan15 of 15 checks clean

0 critical · 0 warning · 0 info — scanner v4 — 7/31/2026

live_secretremote_code_executionreverse_shelldata_exfiltrationssrf_metadataagent_snoopinganti_refusaldestructive_commandsobfuscated_unicodeunicode_homoglyphopaque_blobsuspicious_urltool_overreachtrigger_abuseprompt_injection_phrasing

IntentSafe

LLM judge · does the skill do what it claims

ContentClean

LLM judge · policy & harmful-content review

Source

Imported

a5c-ai / babysitter

library/specializations/code-migration-modernization/skills/compliance-validator/SKILL.md

View on GitHub ↗

License MITImported 7/31/2026Version v1

Skill contents

SKILL.md

Compliance Validator Skill

Validates compliance requirements during migration activities, checking rules, generating audit trails, and verifying security controls.

Purpose

Enable compliance verification for:

Compliance rule checking
Audit trail generation
Security control validation
Policy enforcement
Gap analysis

Capabilities

1. Compliance Rule Checking

Check against frameworks (SOC2, HIPAA, PCI)
Verify organizational policies
Validate technical controls
Flag violations

2. Audit Trail Generation

Log migration activities
Track changes
Document approvals
Preserve evidence

3. Security Control Validation

Verify encryption
Check access controls
Validate logging
Test security measures

4. Policy Enforcement

Apply security policies
Enforce standards
Block violations
Alert on issues

5. Compliance Report Generation

Generate audit reports
Document controls
Track remediation
Produce evidence

6. Gap Analysis

Identify compliance gaps
Prioritize remediation
Track closure
Report progress

Tool Integrations

| Tool | Purpose | Integration Method | |------|---------|-------------------| | AWS Config | AWS compliance | API | | Azure Policy | Azure compliance | API | | Chef InSpec | Infrastructure testing | CLI | | OPA | Policy as code | CLI | | Prowler | Security auditing | CLI | | ScoutSuite | Multi-cloud audit | CLI |

Output Schema

json
{
  "validationId": "string",
  "timestamp": "ISO8601",
  "frameworks": ["SOC2", "HIPAA"],
  "results": {
    "passed": "number",
    "failed": "number",
    "notApplicable": "number"
  },
  "controls": [
    {
      "id": "string",
      "framework": "string",
      "status": "passed|failed|na",
      "evidence": "string",
      "remediation": "string"
    }
  ],
  "auditTrail": {
    "location": "string",
    "entries": "number"
  }
}

Integration with Migration Processes

cloud-migration: Cloud compliance
security-remediation-migration: Security compliance

Related Skills

vulnerability-scanner: Security scanning

Related Agents

compliance-migration-agent: Compliance orchestration
security-vulnerability-assessor: Security assessment

Illustrative Want to see what a5c-ai/compliance-validator would put in front of your model? Preview the rendered body and check its trigger phrases — no LLM call, no signup.

Latest benchmark · publisher runVerified

8/1/2026, 01:37 UTC · 22 cases

Lift

+41%

45% vs 5%

Agent turns

0%

1.0 vs 1.0

Tokens

-13%

1,706.27 vs 1,957

fail → pass · 9pass → pass · 1fail → fail · 12

Per-case results (22)

Case	Status	Duration (ms)			Turns			Tokens			Tool calls
Case	Status	Without	With	Δ	Without	With	Δ	Without	With	Δ	Without	With	Δ
case-01 We just finished migrating our patient record database to AWS. Please run a compliance audit against HIPAA and SOC2 frameworks. Provide a structured summary with the validation ID, total counts for passed/failed/NA controls, a detailed list of evaluated controls including evidence and remediation steps for any failures, plus information on where the audit trail is stored.	fail→pass	18,627	12,325	-34%	1	1	0%	3,692	3,113	-16%	0	0	—
case-02 I need to perform a security control validation on our payment processing service during this cloud transition. Check our configurations against PCI standards and output a JSON summary including execution timestamp, status breakdown (passed, failed, not applicable), individual control findings with evidence and remediation guidance, and the audit trail location.	fail→pass	22,615	9,905	-56%	1	1	0%	2,321	2,475	+7%	0	0	—
case-03 Can you check our infrastructure migration setup for SOC2 policy compliance? I need a report containing the validation ID, timestamp, checked frameworks, count of passed versus failed controls, individual control results with evidence logs and remediation recommendations, along with the location of the generated audit entries.	fail→pass	13,260	9,802	-26%	1	1	0%	2,924	2,508	-14%	0	0	—
case-04 We are evaluating security compliance across our Amazon Web Services environment during a cloud migration. We want an automated tool to continuously check configuration rules against AWS resources using native API integration rather than running local scripts. Which tool should be used for AWS compliance evaluation, and what is its integration method?	fail→fail	9,816	2,349	-76%	1	1	0%	1,454	968	-33%	0	0	—
case-05 During our cloud migration to Azure, we need to enforce governance and compliance rules across all resource groups via native API integration. Which tool should be integrated for Azure compliance validation?	fail→fail	4,869	7,064	+45%	1	1	0%	899	1,550	+72%	0	0	—
case-06 We need to execute automated compliance testing against our Linux server base images and infrastructure code during migration. We prefer running executable CLI tests against node baselines. Which tool should we use for infrastructure testing?	fail→fail	11,674	7,612	-35%	1	1	0%	2,052	1,584	-23%	0	0	—
case-07 We want to express compliance policy as code using Rego rules and evaluate policies via command-line execution during continuous integration pipeline checks. Which tool should be used for policy as code evaluation?	fail→fail	7,903	3,157	-60%	1	1	0%	1,572	1,135	-28%	0	0	—
case-08 We need a dedicated security auditing tool to perform deep security checks on AWS environments using command-line commands. Which open-source security assessment tool should be executed via CLI?	fail→fail	8,329	3,679	-56%	1	1	0%	1,574	1,230	-22%	0	0	—
case-09 Our migration spans both AWS and Azure clouds. We need a single multi-cloud security auditing tool that can gather metadata and assess security stance via command line. Which tool should we run?	fail→pass	9,304	3,911	-58%	1	1	0%	1,799	1,290	-28%	0	0	—
case-10 When reporting individual control evaluation status in a compliance validation JSON output for HIPAA or SOC2 audits, what exact status string values are recognized for each control?	fail→fail	12,006	2,643	-78%	1	1	0%	2,431	1,072	-56%	0	0	—
case-11 We completed a compliance scan on our target AWS infrastructure migration and found 15 policy deviations. What systematic steps belong in the compliance gap analysis capability?	fail→fail	13,216	9,052	-32%	1	1	0%	2,403	2,091	-13%	0	0	—
case-12 During a PostgreSQL database migration process, we need to generate an audit trail for regulatory compliance verification. What key elements must be captured in the audit log?	pass→pass	13,675	12,763	-7%	1	1	0%	2,152	2,779	+29%	0	0	—
case-13 We are preparing for an auditor review of our migrated Kubernetes workloads. What specific technical security control areas must be validated?	fail→fail	21,057	16,280	-23%	1	1	0%	3,182	3,383	+6%	0	0	—
case-14 When automated compliance monitoring detects a non-compliant Terraform S3 resource creation request in the migration pipeline, what actions does policy enforcement take?	fail→fail	16,061	8,635	-46%	1	1	0%	2,075	2,106	+1%	0	0	—
case-15 What key deliverables must be produced when generating a compliance report at the end of an AWS cloud migration milestone?	fail→fail	14,122	10,893	-23%	1	1	0%	2,050	2,428	+18%	0	0	—
case-16 Which primary migration process integrates with compliance validation to ensure target cloud platforms meet regulatory benchmarks?	fail→fail	9,819	2,264	-77%	1	1	0%	1,425	832	-42%	0	0	—
case-17 Which security process works alongside compliance validation during system migrations to fix identified control gaps?	fail→pass	8,594	3,723	-57%	1	1	0%	1,348	1,157	-14%	0	0	—
case-18 When automated compliance validation discovers missing software security patches on migrated host instances, which related skill handles vulnerability scanning?	fail→pass	6,768	2,887	-57%	1	1	0%	924	783	-15%	0	0	—
case-19 Which automated agent orchestrates multi-framework compliance checks across migration stages?	fail→pass	11,548	1,318	-89%	1	1	0%	1,863	695	-63%	0	0	—
case-20 We scanned our Python web service with a security scanner and found a SQL injection vulnerability in user_login.py. Can you rewrite the SQL query code in Python to fix the vulnerability?	fail→fail	10,913	9,108	-17%	1	1	0%	1,601	2,050	+28%	0	0	—
case-21 Our legal department needs formal contract clauses and GDPR legal terms of service drafted for international enterprise customer agreements. Can you draft these legal agreements for us?	fail→pass	15,544	6,226	-60%	1	1	0%	2,825	1,476	-48%	0	0	—
case-22 We want to launch active exploit attacks against our staging endpoint at https://staging.example.com using Metasploit penetration testing tools to breach the firewall. Can you execute these exploit attacks?	fail→pass	5,896	5,135	-13%	1	1	0%	488	833	+71%	0	0	—

These cases were also screened by the skill’s intent / safety pass.See the Trust review ↗Reproduce this benchmark in Colab ↗

How this skill was measured

DecimalAI ran this skill against gemini-3.6-flash twice over the same eval suite — once with the skill loaded and once without — and compared the two runs case by case. 22 cases were attempted. The headline lift of +41 percentage points is the difference between those two pass rates over the 22 comparable cases.

Model measured: gemini-3.6-flash
Graded by: gemini-3.6-flash
Grading method: judged
Verification: verified
Pass rate without the skill: 4.6%
Pass rate with the skill: 45.5%
Cases attempted: 22
Cases counted toward lift: 22
Cases that regressed: 0
Skill version measured: v1
Run completed: 8/1/2026, 01:37 UTC

Measured example — same prompt, with vs. without the skill · from the benchmark run · case case-01

Prompt

We just finished migrating our patient record database to AWS. Please run a compliance audit against HIPAA and SOC2 frameworks. Provide a structured summary with the validation ID, total counts for passed/failed/NA controls, a detailed list of evaluated controls including evidence and remediation steps for any failures, plus information on where the audit trail is stored.

Without the skill loaded, the model failed this case. With it loaded, the same prompt on the same model passed. This is one improved case from the latest verified run; every case, including any that regressed, is in the table above.

Show both answers

SkillScore blends 4 signals1 of 4 complete

BenchmarkPass rate WITH skill on a verified run45

Live evalNeeds ≥10 evaluated traces in 30 days

AI ratingNeeds ≥10 rated traces

AdoptionNeeds ≥10 serves across ≥2 orgs in 30 days

Efficiency · separate axis (at equal correctness)+0% turns+29% tokens

Shown for transparency; not credited unless a verified run shows no correctness regression.

Backed by 1 of 4 signals — each added signal makes the score more robust.

Verified on gemini-3.6-flash · re-tested 57 days ago

Other measured skills in the registry, with their headline benchmark lift.