PCI DSS Compliance Guide
Guides an agent through PCI DSS card-data security: tokenization, encryption, and data minimization
- Repository
- wshobson/agents
- Stars
- 42,095
- Licence
- MIT
- Files
- 2 files
What it does
This skill gives an AI agent a structured reference for PCI DSS, the security standard that businesses must follow when handling payment card data. Once installed, the agent can explain the 12 core PCI requirements, the merchant compliance levels, and which card data may or may not be stored. It also supplies Python code examples for tokenization with a payment processor (such as Stripe), custom token vaults, and AES-256-GCM encryption at rest, so the agent can steer payment code toward safer patterns.
Great for
- Developers building or reviewing checkout and payment flows who want guidance on keeping card numbers off their servers
- Engineering teams preparing for a PCI DSS self-assessment who want a starting checklist of requirements
- Teams trying to reduce PCI scope by using hosted tokenization instead of storing card data
Skip it if
- Final compliance sign-off or audit: the skill is a general reference and is not a Qualified Security Assessor (QSA) opinion, and its compliance-level thresholds should be checked against the current PCI SSC documents
- Production payment code copied without review: some examples are illustrative (for instance, the token vault keeps data in memory and the code is marked as 'in production: use encrypted database'), and mistakes in cryptographic or payment code can expose real card data
Try asking
- “Review this checkout function and tell me whether it stores any data PCI DSS prohibits after authorization.”
- “Explain the PCI DSS 12 requirements and which ones apply to a small e-commerce merchant.”
- “Show me how to switch our card form to Stripe tokenization so card numbers never reach our server.”
- “Help me add AES-256-GCM encryption for stored cardholder data in our Python service.”
Install in 3 steps
- 1
Download the skill
The ZIP contains the 2 original files, the MIT licence and an attribution note.
pci-compliance.zip - 2
Add it to your agent
Claude Code (all projects)
mkdir -p ~/.claude/skills && unzip pci-compliance.zip -d ~/.claude/skills/Claude Code / Agent SDK (this project only)
mkdir -p .claude/skills && unzip pci-compliance.zip -d .claude/skills/Claude apps (web/desktop): Settings → Capabilities → Skills → Upload skill, and choose the ZIP.
- 3
Ask for the task
No special command needed — the agent reads the skill's description and loads it when your request matches. Try one of the prompts above.
Get better results
- Ask for a review of your specific code or architecture rather than a generic overview, so the agent can point to concrete lines.
- Verify compliance level thresholds and requirement details against official PCI Security Standards Council documentation or a QSA before relying on them.
- Keep secrets such as encryption keys and Stripe secret keys out of code; the examples show placeholder values like 'sk_...' that must be replaced with proper secret management.
What's inside
- references/details.md
- SKILL.md
Redistributed unmodified from wshobson/agents under the MIT licence. The assessment was drafted with AI from the skill's files on 2026-10-29. Skills can instruct your agent to run code — read SKILL.md and any scripts before installing.