pci-compliance
Pass
Audited by Gen Agent Trust Hub on Oct 13, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill provides high-quality security documentation and code templates following PCI DSS 4.0 standards.
- [SAFE]: Cryptographic implementations in custom-tokenization-advanced.md and data-at-rest.md use industry-standard libraries such as cryptography.fernet and AES-GCM with secure random nonces.
- [SAFE]: Web security configurations in data-in-transit.md correctly promote the use of TLS 1.2+, secure cookies (Secure, HttpOnly, SameSite), and HTTPS enforcement via Flask-Talisman.
- [SAFE]: Data handling logic in maintain-information-security-policy.md correctly identifies prohibited data storage (CVV, PIN) and implements proper PAN masking for logging purposes.
- [INDIRECT_PROMPT_INJECTION]: The skill defines functions to process untrusted user input (card numbers) in input-validation.md. 1. Ingestion points: validate_card_number and sanitize_input functions. 2. Boundary markers: None present. 3. Capability inventory: No dangerous capabilities such as subprocess execution, eval, or network exfiltration are present in the provided scripts. 4. Sanitization: Includes a placeholder function for input sanitization.
Audit Metadata