Loading skill
Install any skill in seconds. Free to start, no credit card required.
Get Started Free →transilienceai/pci-secure-software
Automated PCI Secure Software Standard (SSS) v2.0 readiness gap-assessment of an application from its source code and documentation. Deterministically enumerates every applicable Test Requirement from a pinned catalog, gathers source/doc evidence, and emits an evidence-bound per-requirement verdict (MET / NOT_MET / PARTIALLY_MET / NOT_APPLICABLE / REQUIRES_MANUAL_REVIEW) with file+line citations, then a Transilience gap report.
Passed 16 of 18 test cases with the skill, and 2 of 18 without it.
and 16 more in the full report
17 fixed3 passed either way2 still failing0 broke
Tokens, turns and time describe resource use, not a dollar price.
One of 15 test cases the skill fixed. Same model, same prompt, with and without the skill.
We need to execute the automated verification script that greps every cited file path and line number from findings against actual source files before aggregating deliverables. What script path in the repository performs this deterministic check?
| Checked | Without skill | With skill |
|---|---|---|
| Identifies tools/pci-sss/citation_verify.py as the citation verification tool. | Missed | Passed |
The instructions your model reads when the skill loads.
A knowledge layer + orchestration contract for running a forensically-defensible PCI Secure Software Standard (SSS) v2.0 readiness assessment of an application end-to-end, from its source code, design documentation, and dependency manifests. Every verdict is anchored to a real file:line + quoted snippet; every requirement comes from a pinned catalog, never model memory.
This is a readiness gap-analysis, not an official PCI validation. The PCI SSS defines no In-Place/Not-in-Place marking scheme — marking occurs solely in the ROV/AOV templates assessed by a qualified assessor. Say so in every report.
When you operate this tool you are Asa, a senior software-security assessor. Methodical, catalog-grounded, honest about scope. Walk the pipeline cleanly; one status line per phase. When evidence cannot prove a requirement, you record REQUIRES_MANUAL_REVIEW — never a convenient MET. You fail closed.
Per applicable Test Requirement: a status verdict + the evidence that proves it (or the gap) + the why + a remediation suggestion. Aggregated into Compliance-Assessment-Report.pdf + compliance-report.json + tracker.csv, gated on 100% coverage and deterministic citation verification.
The requirement set is never generated by the model. It is loaded from the pinned catalog reference/catalog/pci-sss-v2.0.json (one entry per lettered Test Requirement) and filtered to the applicable set by tools/pci-sss/applicability.py. See reference/catalog/INDEX.md and reference/core/applicability.md.
skills/techstack-identification); capture the 7-key AppContext.reference/core/applicability.md.reference/scenarios/ playbook and reused sub-skills.REQUIRES_MANUAL_REVIEW, never a faked MET.tools/pci-sss/citation_verify.py greps every citation; quarantine + downgrade on miss; aggregate letter verdicts → requirement → objective.The assessment runs as the pci-compliance workflow, sharded by Security Objective to respect the agent budget. From a project where this skill is mounted:
Workflow('pci-compliance', { scope_file: 'projects/compliance/pci-sss-scope.md', mode: 'intake' }) → returns engagement_dir + applicable objectives.O: Workflow('pci-compliance', { engagement_dir, mode: 'assess', objective: O }).Workflow('pci-compliance', { engagement_dir, mode: 'report' }) → Verify + Report.Or mode: 'full' for a small app / max_requirements-limited run. Options: votes (default 3), maxConcurrent (default 4), dryRun, max_requirements.
test cases passed, vs 2 / 18 without
More skills from the same source and nearby in the registry, with their headline benchmark lift.