Individual skill

pci-secure-software

Automated PCI Secure Software Standard (SSS) v2.0 readiness gap-assessment of an application from its source code and documentation. Deterministically enumerates every applicable Test Requirement from a pinned catalog, gathers source/doc evidence, and emits an evidence-bound per-requirement verdict (MET / NOT_MET / PARTIALLY_MET / NOT_APPLICABLE / REQUIRES_MANUAL_REVIEW) with file+line citations, then a Transilience gap report. Use when asked to assess, gap-assess, or check an application's readiness against the PCI Secure Software Standard v2.0 / PCI SSF, or to map source code and design docs to PCI SSS Security Objectives and Test Requirements. Produces a readiness gap-analysis only — NOT an official PCI validation.

skills/pci-secure-software/SKILL.md

Read pinned source

Source commit 95fdc128af4ca1ae16b3226f9430f1bad97b0656

What was checked

Matches the observed repository HEAD: Yes
Scanner rules are current: Yes
Repository scan complete: No
Skill scan complete: No
Observed behavior: Network or broad shell
Last checked: Nov 5, 2026

These are observations at the recorded commit, not a guarantee of safety. Review the source before running it.

Install this skill

Choose an agent in your Stack or copy a command below. Commands fetch the pinned commit and copy only this skill directory. Existing destinations are refused. Copying a command does not install anything.

An install command is unavailable: current rules, complete repository and skill scans, an eligible behavior level and a permitted license are required.

Repository context

Repository stars (not skill ratings): 610
Repository last updated: Jul 29, 2026
License: MIT

Observed agent integration: No specific integration evidence. Standard SKILL.md installation does not imply verified compatibility.

bounty-hunters Repository topic
hackerone Repository topic
pentest Repository topic
pentest-tool Repository topic
security Repository topic
security-research Repository topic
security-tools Repository topic
docs Derived category
engineering Derived category
design Derived category
security Derived category
testing Derived category

Files and excerpt

File metadata and permitted, redacted excerpts come from the recorded scan. Source links are pinned to that commit.

Browse files

SKILL.mdcore · 7,454 bytes
SKILL.mdcore · 7,454 bytes
SKILL.mdcore · 7,454 bytes
SKILL.mdcore · 7,454 bytes
SKILL.mdcore · 7,454 bytes
SKILL.mdcore · 7,454 bytes
reference/INDEX.mddoc · 3,295 bytes
reference/VERSIONS.mddoc · 2,199 bytes
reference/agents/citation-verifier.mddoc · 2,222 bytes
reference/agents/dynamic-tester.mddoc · 2,630 bytes
reference/agents/evidence-gatherer.mddoc · 2,496 bytes
reference/agents/refutation-validator.mddoc · 2,522 bytes
reference/agents/verdict-assessor.mddoc · 3,017 bytes
reference/anti-hallucination/citation-verifier.mddoc · 2,823 bytes
reference/anti-hallucination/control-stack.mddoc · 3,658 bytes
reference/anti-hallucination/coverage-gate.mddoc · 2,857 bytes
reference/catalog/INDEX.mddoc · 4,329 bytes
reference/catalog/pci-sss-v2.0.jsonasset · 386,207 bytes
reference/core/applicability.mddoc · 4,973 bytes
reference/core/schema.mddoc · 9,013 bytes
reference/reporting/gap-report.mddoc · 4,562 bytes
reference/reporting/output-discipline.mddoc · 2,650 bytes
reference/scenarios/architecture-composition.mddoc · 7,971 bytes
reference/scenarios/crypto-key-management.mddoc · 10,153 bytes
reference/scenarios/module-a-account-data.mddoc · 7,080 bytes
reference/scenarios/module-b-poi.mddoc · 8,014 bytes
reference/scenarios/module-c-web.mddoc · 9,143 bytes
reference/scenarios/module-d-sdk.mddoc · 8,480 bytes
reference/scenarios/protection-and-modes.mddoc · 10,140 bytes
reference/scenarios/sensitive-assets.mddoc · 10,616 bytes
reference/scenarios/threats-and-deployment.mddoc · 9,681 bytes

Read excerpt


# pci-secure-software

## About this skill

A knowledge layer + orchestration contract for running a forensically-defensible PCI Secure Software Standard (SSS) **v2.0** readiness assessment of an application end-to-end, from its source code, design documentation, and dependency manifests. Every verdict is anchored to a real `file:line` + quoted snippet; every requirement comes from a pinned catalog, never model memory.

**This is a readiness gap-analysis, not an official PCI validation.** The PCI SSS defines no In-Place/Not-in-Place marking scheme — marking occurs solely in the ROV/AOV templates assessed by a qualified assessor. Say so in every report.

## Persona — Asa

When you operate this tool you are **Asa**, a senior software-security assessor. Methodical, catalog-grounded, honest about scope. Walk the pipeline cleanly; one status line per phase. When evidence cannot prove a requirement, you record `REQUIRES_MANUAL_REVIEW` — never a convenient `MET`. You fail closed.

## What you produce