Loading skill
Install any skill in seconds. Free to start, no credit card required.
Get Started Free →sickn33/fsi-compliance-checker
Maps code, architecture, and infrastructure changes to specific control IDs in PCI-DSS v4.0 and MAS TRM (Singapore financial regulator), producing an audit-traceable findings report with per-control remediation.
Passed 17 of 22 test cases with the skill, and 11 of 22 without it.
and 6 more in the full report
6 fixed11 passed either way5 still failing0 broke
Tokens, turns and time describe resource use, not a dollar price.
One of 6 test cases the skill fixed. Same model, same prompt, with and without the skill.
Can you perform a compliance check on our database schema update for customer profiles? Here is the diff showing new fields added to the user table.
| Checked | Without skill | With skill |
|---|---|---|
| Ask what specific data elements are touched by the change. | Missed | Passed |
| Ask whether the institution is regulated in Singapore or handles payment card data. | Missed | Passed |
The instructions your model reads when the skill loads.
Maps a concrete change (code diff, architecture design, IaC, pipeline config) to the specific controls it touches in financial services compliance frameworks — PCI-DSS v4.0 for payment card data and MAS TRM for Singapore-regulated institutions — and reports gaps with actionable remediation. This is engineering-level compliance triage: it helps teams catch violations before audit, but it does not replace a qualified assessor (QSA) or the institution's compliance function. Say so in every report.
Load only the reference file(s) the engagement needs:
| Situation | Load |
|---|---|
| Payment card data is stored, processed, or transmitted | pci-dss.md |
| Singapore-regulated financial institution (bank, insurer, capital markets, major payment institution) | mas-trm.md |
| Both apply (e.g. Singapore bank handling cards) | Both files |
| Other jurisdictions/frameworks (SOX, GDPR, HKMA, APRA) | State they are out of scope; offer general secure-engineering review instead |
If the user hasn't said which applies, ask one question: what data does the change touch, and is the institution Singapore-regulated?
Identify what the diff/design actually touches: data elements (card data? customer PII? credentials?), trust boundaries, environments (production? DR?), and third parties.
Select the applicable controls from the loaded reference file(s) — typically 5-15 controls, not the whole framework. List what you ruled out and why (one line each) so the scoping is auditable. Assess each as Compliant / Gap / Needs evidence (can't tell from the artifact — name the evidence required).
Every Gap gets: the control ID, what's wrong in this specific change, concrete remediation, and severity (Critical = violation involving live regulated data; High = control absent; Medium = control partial/undocumented).
test cases passed, vs 11 / 22 without
Published skills whose descriptions closely match this one, with their headline benchmark lift.
More skills from the same source and nearby in the registry, with their headline benchmark lift.