Implement and maintain compliance with SOC 2, HIPAA, PCI-DSS, and GDPR using unified control mapping, policy-as-code enforcement, and automated evidence collection.
SkillScore95Maintained
Automatic
◆Security & AppSec pack
Last verified 8/21/2026
What it changes
Passed 21 of 22 test cases with the skill, and 14 of 22 without it.
Without skill64%
With skill95%
Checks it passed that the model alone missed
Restricts secrets resource verbs to get and list.
States the SOC 2 report must be 90 days old or newer.
Cites an implementation effort reduction of 60% or more.
and 5 more in the full report
7 fixed14 passed either way1 still failing0 broke
Pass-rate lift
+32 pp
Tokens
+156%
Agent turns
0%
Response time
-14%
Model gemini-3.6-flashMeasured 8/21/2026v121 of 22 cases passed with skill
Tokens, turns and time describe resource use, not a dollar price.
See it in action
One of 7 test cases the skill fixed. Same model, same prompt, with and without the skill.
1 of 7
Prompt
Provide the CLI command to run static IaC security analysis on `./terraform` specifically checking compliance for SOC 2, HIPAA, PCI-DSS, and GDPR frameworks concurrently.
What was checked, without and with the skill
Checked
Without skill
With skill
Invokes checkov targeting the terraform directory.
Passed
Passed
Includes framework check flags for SOC2, HIPAA, PCI, and GDPR.
Missed
Passed
case-05 · gemini-3.6-flash · 8/21/2026 · answers are capped and redacted
What's inside
The instructions your model reads when the skill loads.
SKILL.md483 lines14 files
Compliance Frameworks
Implement continuous compliance with major regulatory frameworks through unified control mapping, policy-as-code enforcement, and automated evidence collection.
Purpose
Modern compliance is a continuous engineering discipline requiring technical implementation of security controls. This skill provides patterns for SOC 2 Type II, HIPAA, PCI-DSS 4.0, and GDPR compliance using infrastructure-as-code, policy automation, and evidence collection. Focus on unified controls that satisfy multiple frameworks simultaneously to reduce implementation effort by 60-80%.
When to Use
Invoke when:
Building SaaS products requiring SOC 2 Type II for enterprise sales
Handling healthcare data (PHI) requiring HIPAA compliance