CtrlK
BlogDocsLog inGet started
Tessl Logo

testland/pci-dss-control-test-author

Build-an-X for PCI DSS v4.0 scope verification - cardholder data environment (CDE) boundary tests, segmentation tests (PCI Req 1), prohibited-data-storage assertions per Req 3 (no full track data, no CVV/CAV2/CVC2/CID, no PIN/PIN block post-authorization), key-management tests per Req 3.6, encryption-of-transmissions per Req 4. Use when authoring PCI DSS scope-reduction + control tests for any system handling payment-card data.

80

Quality

100%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

SecuritybySnyk

Passed

No findings from the security scan

Overview
Quality
Evals
Security
Files

Quality

Content

100%

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The skill body is a well-structured build-an-X workflow: executable test code per step, explicit halt-and-remediate checkpoints, and a single one-level reference file for the scope-reduction detail. It is lean, actionable, and well organized.

DimensionReasoningScore

Conciseness

The body is code-forward with terse inline commentary and no padding of concepts Claude already knows; every section earns its place with executable tests and short checkpoints rather than prose.

3 / 3

Actionability

Each step provides fully executable Python test functions backed by documented helper stubs (network_policy, export_database, inspect_tls, is_encrypted_aes_256, etc.), making the guidance copy-paste ready.

3 / 3

Workflow Clarity

Seven steps are explicitly sequenced and each ends with a 'Checkpoint: ... halt and remediate' block providing validation feedback loops, matching the clear-sequence-with-explicit-validation anchor.

3 / 3

Progressive Disclosure

The body is an overview that pushes detail to one clearly signaled, one-level-deep reference — [references/strategies.md](references/strategies.md), which exists in the bundle — keeping navigation shallow and easy.

3 / 3

Total

12

/

12

Passed

Description

100%

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description is concrete, third-person, and complete: it names the specific test families it produces and gives an explicit 'Use when' trigger grounded in PCI DSS domain language. It is distinct and unlikely to conflict with other skills.

DimensionReasoningScore

Specificity

Lists multiple concrete actions: 'CDE boundary tests, segmentation tests (PCI Req 1), prohibited-data-storage assertions per Req 3 ... key-management tests per Req 3.6, encryption-of-transmissions per Req 4', matching the score-3 anchor for multiple specific concrete actions.

3 / 3

Completeness

It explicitly answers both what (the test categories) and when via 'Use when authoring PCI DSS scope-reduction + control tests for any system handling payment-card data', satisfying the explicit-trigger bar for a 3.

3 / 3

Trigger Term Quality

Natural domain terms a user would say are present — 'PCI DSS v4.0', 'payment-card data', 'PCI DSS scope-reduction + control tests' — giving good coverage of real phrasings rather than pure jargon.

3 / 3

Distinctiveness Conflict Risk

A clear PCI DSS v4.0 scope-verification niche with distinct payment-card/CDE triggers makes it unlikely to fire for unrelated skills.

3 / 3

Total

12

/

12

Passed

Validation

100%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation16 / 16 Passed

Validation for skill structure

No warnings or errors.

Reviewed

Table of Contents