edercnj/x-review-compliance

Skill: PCI-DSS Compliance Review

Purpose

Review code changes against PCI-DSS v4.0 requirements. Produce a per-point PASS/FAIL compliance report with remediation guidance for each finding.

Activation Condition

Include this skill when the project handles payment card data and compliance frameworks include PCI-DSS.

Triggers

• /x-review-compliance 42 -- review PR #42 for PCI-DSS compliance
• /x-review-compliance src/main/java/com/example/payment/ -- review specific file paths

Parameters

| Parameter | Type | Required | Default | Description | |-----------|------|----------|---------|-------------| | target | String | No | (current changes) | PR number or file paths to review |

Canonical Technology Selection

Use the canonical selector as the single source of truth for review assets:

Skill(skill: "x-internal-select-context-packs",
      args: "--phase review --capabilities compliance,security,api,java")

Consumption rules:

1. Read every path returned in required.
2. Read recommended only when relevant to the changed scope.
3. Do not duplicate static pack lists when the selector already covers the same asset.
4. Read optional only with explicit justification in findings.

Explicit Domain Exceptions (checklist-mandatory)

• Always read src/knowledge/shared/security-knowledge/pci-dss-requirements/knowledge.md for the 15-point PCI-DSS checklist (items 21-35).
• Read src/knowledge/shared/compliance-knowledge/compliance/knowledge.md for cross-framework controls used in evidence and remediation notes.

Workflow

Step 1 — Resolve Canonical Assets and Compliance Requirements

Before evaluation, resolve canonical compliance assets:

Skill(skill: "x-internal-select-context-packs",
      args: "--phase review --capabilities compliance,security,api,java")

Then consume selector output with these rules:

• Read every selector-returned required asset.
• Read only compliance-relevant recommended assets.
• Keep explicit checklist exceptions: always read src/knowledge/shared/security-knowledge/pci-dss-requirements/knowledge.md and src/knowledge/shared/compliance-knowledge/compliance/knowledge.md.

Step 2 — Identify Cardholder Data Files

Identify all files handling cardholder data (PAN, CVV, expiry, track data).

Step 3 — Evaluate Checklist

Evaluate each of the 15 checklist points (21-35) against the changed code. For each point: mark PASS or FAIL with file location and evidence.

Step 4 — Produce Compliance Report

Generate report with remediation for each FAIL.

PCI-DSS Compliance Checklist (Conditional — when pci-dss is active) — 15 points

Cardholder Data (21-25)

21. PAN never stored in full (masked first 6 + last 4, or tokenized).
22. CVV/CVC/PIN NEVER persisted after authorization.
23. PAN never appears in logs, traces, or error messages at any level.
24. Cardholder data encrypted at rest with AES-256 minimum.
25. Audit log records ALL access to cardholder data (who, what, when, where).

CDE Security (26-30)

26. Service in Cardholder Data Environment uses mTLS for service-to-service communication.
27. No direct internet access from CDE services (proxy/gateway only).
28. Session timeout configured (15 minutes inactivity).
29. Unique user ID for all access (no shared/generic service accounts).
30. MFA enforced for administrative access paths.

Application Security — PCI Req 6 (31-35)

31. SAST scan results available and clean (no critical/high findings).
32. Error messages generic to users (no internal details, stack traces, SQL).
33. WAF configuration appropriate for public-facing endpoints.
34. Code review completed as merge gate (not optional).
35. Secure coding training tracked (annual requirement).

Output Format

## PCI-DSS Compliance Review — [Change Description]

### Summary
- Points evaluated: 15
- PASS: [count]
- FAIL: [count]
- N/A: [count]

### Per-Category Results

#### Cardholder Data (21-25)
- [x] 21. PAN not in logs — PASS
- [ ] 22. CVV/CVC/PIN persisted after authorization — FAIL: [file:line] — Sensitive authentication data persisted
  - **Remediation:** Apply PanMasker.mask() before setting response field

... (all 15 points)

### Overall Verdict: COMPLIANT / NON-COMPLIANT
### Risk Level: LOW / MEDIUM / HIGH / CRITICAL

Error Handling

Convenções de erro/degradação transversais a review/audit (empty input, RULE-012 template fallback, falha de specialist, build/test override, idempotência) vivem em _shared/error-handling-review.md. As linhas abaixo são específicas desta skill.

| Scenario | Action | |----------|--------| | No cardholder data files found | Report N/A for all points with explanation | | Compliance KP not available | Warn and proceed with checklist-only review | | PR number invalid or inaccessible | Report error with PR number and suggest checking access |