mikeparcewski/compliance

Compliance Skill

Analyze code and systems for regulatory compliance.

When to Use

• Code handles sensitive data (PII, PHI, payment data)
• Pre-deployment compliance verification
• User mentions regulatory frameworks
• User says "is this compliant", "compliance check", "regulatory requirements"

Supported Frameworks

| Framework | Focus | Key Requirements | |-----------|-------|------------------| | SOC2 | Security, Availability | Access controls, encryption, logging, monitoring | | HIPAA | Protected Health Info | PHI safeguards, access logs, encryption, BAA | | GDPR | Personal Data | Consent, minimization, deletion, DPO | | PCI DSS | Payment Card Data | Encryption, network segmentation, access control |

See refs/frameworks.md for detailed framework requirements.

Commands

/wicked-garden:platform:compliance [--framework soc2|hipaa|gdpr|pci] [--quick]

Analysis Process

1. Identify Sensitive Data

Scan for:

• PII: Names, emails, SSN, addresses
• PHI: Medical records, health data
• Payment: Credit cards, bank accounts
• Credentials: Passwords, API keys

2. Verify Controls

Access Control:

• Authentication required
• Authorization checks (RBAC)
• Least privilege

Data Protection:

• Encryption at rest (AES-256)
• Encryption in transit (TLS 1.2+)
• Secure key management

Logging & Monitoring:

• Access logs
• Audit trails
• Security events
• Log retention

Data Lifecycle:

• Consent mechanisms (GDPR)
• Retention policies
• Secure deletion
• Data minimization

3. Detect Violations

Common issues:

• PII/PHI in logs or errors
• Hardcoded secrets
• Missing encryption
• Insufficient access controls
• Missing audit trails

See refs/checklists.md for detailed verification checklists.

4. Generate Report

Output:

• Status: COMPLIANT / NEEDS ATTENTION / NON-COMPLIANT
• Findings: Violations by priority (P0, P1, P2)
• Evidence: Code references
• Remediation: Required fixes

Integration

With wicked-crew

Auto-triggered at phase gates

With native tasks

TaskUpdate(
  taskId="{task_id}",
  description="{previous}\n\n[compliance] {framework}: {status}"
)

With wicked-brain

Skill(skill="wicked-brain:memory", args="recall \"compliance {framework}\"")

With product

/wicked-garden:platform:security {target}

Output Format

## Compliance Analysis: {Framework}

**Target**: {scope}
**Status**: {COMPLIANT|NEEDS ATTENTION|NON-COMPLIANT}
**Framework**: {SOC2|HIPAA|GDPR|PCI}

### Critical (P0)
- {violation} - {file}:{line}
  Remediation: {fix}

### High Priority (P1)
- {gap} - {file}:{line}
  Recommendation: {guidance}

### Medium Priority (P2)
- {improvement} - {suggestion}

### Controls Verified
- [x] Encryption at rest
- [ ] Data retention policy

### Next Steps
{Recommended actions}

Automation Script

Use compliance checker:

sh "${CLAUDE_PLUGIN_ROOT}/scripts/_python.sh" "${CLAUDE_PLUGIN_ROOT}/scripts/compliance_checker.py" \
  --target {path} \
  --framework {soc2|hipaa|gdpr|pci}

External Integration Discovery

Compliance checking can leverage available integrations by capability:

| Capability | Discovery Patterns | Provides | |------------|-------------------|----------| | Security scanning | snyk, semgrep, sast | Vulnerability detection | | Secrets | vault, secrets | Credential management audit | | SBOM | trivy, sbom, cyclonedx | Supply chain compliance |

Discover available integrations via capability detection. Fall back to local compliance_checker.py when none available.

Quality Standards

Good analysis:

• Specific code references
• Clear violation descriptions
• Actionable remediation
• Prioritized by risk

Bad analysis:

• Generic checklists
• No code evidence
• Vague recommendations