PCI-DSS Audit

This skill performs static code analysis for PCI-DSS v4.0 compliance violations across JavaScript/TypeScript, Python, Java, Go, and C#/.NET projects. It identifies 12 common PCI-DSS code-level anti-patterns — unprotected cardholder data, weak encryption of PANs, missing audit trails, insufficient access controls, and more — mapping each finding to CWE and PCI-DSS v4.0 requirement numbers with concrete UNSAFE/SAFE code pairs for remediation.

Scope: This skill covers application-code-level controls only. It does NOT audit infrastructure, network segmentation, physical security, or organizational policies — those require separate assessment tools and processes.

When to Use

• When the user asks to "audit PCI compliance", "check PCI-DSS", or "review payment card handling"
• When the user mentions "PCI audit", "cardholder data", "PAN protection", or "payment security"
• When scanning code that handles credit card numbers, CVVs, expiration dates, or payment tokens
• When reviewing code that stores, processes, or transmits cardholder data
• When a pull request modifies payment processing, card storage, or checkout flows
• When the user asks about "card data in logs", "PAN masking", "payment encryption", or "audit logging"
• When preparing for a PCI-DSS v4.0 Self-Assessment Questionnaire (SAQ) or Report on Compliance (RoC)

When NOT to Use