testland/pci-dss-control-test-author
Build-an-X for PCI DSS v4.0 scope verification - cardholder data environment (CDE) boundary tests, segmentation tests (PCI Req 1), prohibited-data-storage assertions per Req 3 (no full track data, no CVV/CAV2/CVC2/CID, no PIN/PIN block post-authorization), key-management tests per Req 3.6, encryption-of-transmissions per Req 4; includes the scope catalog (SAQ A / A-EP / D levels, PAN-storage rules, hosted-fields / tokenization scope-reduction patterns) in references/pci-scope.md. Use when authoring PCI DSS scope-reduction + control tests for any system handling payment-card data, or when determining a payment integration's SAQ level.
72
90%
Does it follow best practices?
Run evals on this skill
Adds up to 20 points to the overall score
View guide
High
Do not use without reviewing
Security
1 high severity finding. You should review these findings carefully before considering using this skill.
W007: Insecure credential handling detected in skill instructions.
What this means
The skill handles credentials insecurely by requiring the agent to include secret values verbatim in its generated output. This exposes credentials in the agent’s context and conversation history, creating a risk of data exfiltration.
Why it was flagged
The skill includes a hard-coded plaintext password ('secret') embedded in a sample API request (and a placeholder 'correct_password') which requires the agent to emit secret values verbatim in generated code/requests.
Where we found it
[REDACTED]
secret · 2 sites
The skill instructs the agent to emit a hard-coded plaintext password '[REDACTED]' in a POST request body as part of a test for shared-account access control.
SKILL.md
187
response = client.post('/cde-api/login', json={'username': 'shared-svc', 'password': '[REDACTED]'})
SKILL.md
194
'password': [REDACTED],
- Audited
- Security analysis