How to use the PCI DSS Compliance Guide agent skill

What the pci-compliance skill makes the agent do

An agent skill is a folder of instructions and reference material that an AI agent loads when a task matches the skill's description. This one covers PCI DSS. When it is active, the agent can list the 12 core PCI requirements grouped into six goals, explain the four merchant compliance levels, and tell you which cardholder data is prohibited from storage and which may be stored if encrypted.

The skill also includes Python code patterns the agent can draw on: tokenization using a payment processor such as Stripe, a custom token vault, log sanitizing, and AES-256-GCM encryption for data at rest. Its purpose is to steer payment code toward safer patterns, not to certify that your system is compliant.

• Explains the 12 core PCI DSS requirements
• Describes merchant compliance levels 1 to 4
• Lists card data that must never be stored (full track data, CVV, PIN) and data that may be stored if encrypted
• Provides tokenization, encryption and access-control code examples

Install the skill from the ZIP download

Download the ZIP for this skill from this page and unzip it. The skill is a folder containing SKILL.md and a references/details.md file. Place that folder in one of two locations, depending on how you want to use it.

For all your projects, unzip it into your personal skills folder at ~/.claude/skills/. For one project only, unzip it into the .claude/skills/ folder inside that project. Restart or reopen your agent session if it was already running, so it picks up the new skill.

• Personal (all projects): ~/.claude/skills/
• Single project: .claude/skills/ inside the project folder
• Or upload the ZIP in the Claude apps under Settings → Capabilities → Skills

Trigger the skill with natural requests

You do not need a special command. The agent decides to use the skill when your request matches its description, which mentions securing payment processing, achieving PCI compliance and implementing payment card security measures. Plain requests work well, and naming PCI DSS or cardholder data helps make the match clear.

Be specific about your system. Saying which payment processor you use, or whether card numbers currently reach your server, gives the agent what it needs to choose the right pattern.

• "Review this checkout handler for PCI DSS problems."
• "Can we store card CVVs for recurring billing? What does PCI say?"
• "Help me reduce our PCI scope by moving card entry to hosted tokenization."
• "Give me a starting checklist of the 12 PCI DSS requirements for our self-assessment."

Example: keeping card numbers off your server

Suppose your app takes card numbers in a form that posts to your own backend. Ask the agent how to avoid storing or handling raw card data. Using the skill's guidance, the agent will point to the pattern in the source: collect card details with Stripe.js in the browser, send only the resulting token to your server, and store the customer and payment method IDs rather than card details.

The skill's server-side example charges with a token and states that the server should only see the token, never the card number. Treat this as a direction to check against Stripe's own documentation, since the example code is illustrative.

Know what the skill needs and what it does not do

To run the Python examples you need Python 3 and the cryptography package, which provides the Fernet and AESGCM examples. The Stripe examples also require the Stripe Python library and a Stripe account, and the frontend tokenization pattern requires Stripe.js. You only need the Stripe pieces if you follow the Stripe examples.

The skill does not run scripts and does not use the network. It is reference material the agent reads and applies to your code.

• Required: Python 3 and the cryptography package
• Only if using Stripe examples: Stripe Python library, a Stripe account and Stripe.js on the frontend
• Runs scripts: no
• Uses network: no

Safety notes before you use the code

Several examples are illustrative. The token vault in the source keeps data in memory and is marked 'in production: use encrypted database', so do not use it as-is. Cryptographic and payment code mistakes can expose real card data, so have a qualified reviewer check anything you ship.

The skill is not a Qualified Security Assessor (QSA) opinion and is not suitable for final compliance sign-off or audit. Its compliance-level thresholds should be checked against the current PCI Security Standards Council (PCI SSC) documents.

• Do not ship examples without review
• Verify compliance-level thresholds against current PCI SSC documents
• Do not treat the skill as a QSA audit or certification

Tips for getting better answers

Give the agent your real context: the processor you use, your transaction volume, and where card data currently enters your system. The compliance level, for example, depends on transaction counts, so the agent needs those numbers to reason about your situation.

Ask for a checklist when you are preparing for a self-assessment, and ask for a review when you have code. The access-control pattern in the reference file, which restricts cardholder data to users with a pci_access role and logs access, is a useful starting point for a review.

• State your payment processor and transaction volume
• Ask for a checklist for self-assessment preparation
• Ask for a code review against the 12 requirements