CtrlK
BlogDocsLog inGet started
Tessl Logo

testland/pci-dss-control-test-author

Build-an-X for PCI DSS v4.0 scope verification - cardholder data environment (CDE) boundary tests, segmentation tests (PCI Req 1), prohibited-data-storage assertions per Req 3 (no full track data, no CVV/CAV2/CVC2/CID, no PIN/PIN block post-authorization), key-management tests per Req 3.6, encryption-of-transmissions per Req 4; includes the scope catalog (SAQ A / A-EP / D levels, PAN-storage rules, hosted-fields / tokenization scope-reduction patterns) in references/pci-scope.md. Use when authoring PCI DSS scope-reduction + control tests for any system handling payment-card data, or when determining a payment integration's SAQ level.

72

Quality

90%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

SecuritybySnyk

High

Do not use without reviewing

Overview
Quality
Evals
Security
Files

Quality

Content

85%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A well-structured, mostly executable build-an-X workflow with strong validation checkpoints and clean progressive disclosure into real reference files. Conciseness and actionability are strong but not perfect, due to some trimmable comments and a few undeclared test-app objects.

Suggestions

Tighten the inline block comments (e.g. 'untested CDE/non-CDE network policy drifts into a segmentation breach') so the code stays lean.

Declare or briefly note how the unimported test-app objects (client, CardVault, user, AuditLog) are obtained so the examples are fully self-contained.

The CVV_PATTERN regex comment notes it is naive; consider pointing the reader to the DLP-tooling caveat already in Limitations inline at the pattern.

DimensionReasoningScore

Conciseness

Lean body that assumes Claude knows PCI basics and avoids padding; each step is code plus a brief checkpoint, with only minor inline comments that could be trimmed.

4 / 5

Actionability

Concrete test functions with named helper stubs, specific regex patterns, and explicit assertions; a few test-app objects (client, CardVault, user) are referenced without being declared, leaving minor gaps.

4 / 5

Workflow Clarity

A clear 7-step sequence with explicit 'Checkpoint' halt-and-remediate feedback loops after nearly every step, including severity-1 finding and secret-rotation handling for destructive compliance work.

5 / 5

Progressive Disclosure

SKILL.md is an overview that pushes the scope catalog and strategies into real, one-level-deep, clearly signaled reference files (references/pci-scope.md, references/strategies.md) for easy navigation.

5 / 5

Total

18

/

20

Passed

Description

92%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A specific, complete, third-person description that clearly states what the skill does and when to use it, with strong trigger terms and low conflict risk. The only minor gap is missing a couple of natural synonyms such as 'PAN'.

DimensionReasoningScore

Specificity

Lists multiple concrete test categories (CDE boundary tests, segmentation Req 1, prohibited-data-storage assertions Req 3, key-management Req 3.6, transmission encryption Req 4) plus the scope catalog, giving comprehensive coverage.

5 / 5

Completeness

Explicitly answers both what (the build-an-X workflow and its test categories) and when ('Use when authoring PCI DSS scope-reduction + control tests ... or when determining a payment integration's SAQ level') with concrete trigger phrases.

5 / 5

Trigger Term Quality

Strong natural terms (PCI DSS, payment-card data, payment integration, SAQ level, scope-reduction + control tests) but a few common synonyms a user might say (e.g. PAN) are absent.

4 / 5

Distinctiveness Conflict Risk

Niche triggers (PCI DSS v4.0, CDE, SAQ A/A-EP/D) make it clearly distinguishable from the sister gdpr/hipaa/soc2 skills with minimal conflict risk.

5 / 5

Total

19

/

20

Passed

Validation

93%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation15 / 16 Passed

Validation for skill structure

CriteriaDescriptionResult

referenced_paths_exist

Referenced path issues: 1 missing

Warning

Total

15

/

16

Passed

Reviewed

Table of Contents