pci-compliance
Pass
Audited by Gen Agent Trust Hub on Jul 27, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill provides secure implementation patterns for PCI compliance, focusing on encryption and tokenization.\n- [SAFE]: All third-party dependencies (stripe, cryptography, flask, flask-talisman) are well-known and appropriate for the skill's functionality.\n- [SAFE]: The skill uses safe placeholders for sensitive information (e.g., Stripe test keys and card numbers) rather than hardcoded credentials.\n- [SAFE]: Code logic correctly implements data minimization and sanitization, specifically targeting the removal of prohibited fields like CVV and PIN from logs.\n- [SAFE]: The skill identifies data ingestion points for payment card information but provides robust sanitization and boundary logic to mitigate injection risks.\n
- Ingestion points: Payment card data handled by
PaymentDataandTokenVaultclasses inSKILL.md.\n - Boundary markers: Data is processed through dedicated methods that validate and mask fields.\n
- Capability inventory: Restricted to standard cryptographic functions and API interactions; no arbitrary command execution.\n
- Sanitization: Includes methods like
sanitize_logto mask primary account numbers and remove sensitive fields.
Audit Metadata