Generate comprehensive compliance reports for security standards. Use when creating compliance documentation. Trigger with 'generate compliance report', 'compliance status', or 'audit compliance'.
npxskills add jeremylongshore/claude-code-plugins-plus-skills--skill generating-compliance-reportsLoading…
Generate structured compliance reports for major security frameworks including PCI DSS, HIPAA, SOC 2, GDPR, and ISO 27001. This skill scans codebases, configurations, and infrastructure definitions to assess compliance posture, maps findings to specific framework controls, and produces audit-ready documentation with evidence references and gap analysis.
${CLAUDE_SKILL_DIR}/${CLAUDE_SKILL_DIR}/references/README.md for PCI DSS guidelines, HIPAA compliance checklist, SOC 2 framework overview, config schema, and API documentation${CLAUDE_SKILL_DIR}/compliance-report-[framework]-[date].md using the Write tool.${CLAUDE_SKILL_DIR}/references/README.md if applicable.| Error | Cause | Solution |
|---|---|---|
| Unknown compliance framework requested | Framework not in supported list | Map the custom framework controls manually or select the closest standard framework as a baseline |
| Insufficient evidence for control assessment | Codebase lacks configuration files or documentation | Mark the control as "Evidence Not Available" and recommend documenting the control implementation |
| Mixed framework versions | Codebase references multiple versions of a standard (e.g., PCI DSS 3.2.1 vs 4.0) | Clarify the target version and assess against that version only; note version discrepancies in the report |
| Large codebase scan timeout | Too many files to scan within time limits | Scope the scan to relevant directories (e.g., src/, config/, infra/) and exclude generated code |
| Conflicting control evidence | Different parts of the codebase implement conflicting security policies | Flag as Partially Compliant and document both implementations; recommend standardization |
Scan an e-commerce application in ${CLAUDE_SKILL_DIR}/ for PCI DSS v4.0 compliance.
Assess Requirement 2 (Apply Secure Configurations) by checking for default
credentials in config files, Requirement 3 (Protect Stored Account Data) by
verifying encryption of cardholder data fields, and Requirement 6 (Develop and
Maintain Secure Systems) by checking dependency vulnerability status. Produce a
report rating each requirement as Compliant/Non-Compliant with file-level evidence.
Evaluate a healthcare application against HIPAA Technical Safeguards. Check 164.312(a)(1) Access Control by reviewing authentication and RBAC implementations, 164.312(e)(1) Transmission Security by verifying TLS 1.2+ enforcement, and 164.312(b) Audit Controls by confirming audit logging captures access to PHI. Generate a gap analysis with remediation steps for each non-compliant safeguard.
Assess SOC 2 Trust Services Criteria CC6 (Logical and Physical Access Controls) and CC7 (System Operations) by scanning for access control policies, change management procedures, incident response documentation, and monitoring configurations. Produce a readiness report indicating which criteria need additional evidence or implementation before a formal SOC 2 audit.
Create or update AgentSkills. Use when designing, structuring, or packaging skills with scripts, references, and assets.
Create or update AgentSkills. Use when designing, structuring, or packaging skills with scripts, references, and assets.
Set up and use 1Password CLI (op). Use when installing the CLI, enabling desktop app integration, signing in (single or multi-account), or reading/injecting/running secrets via op.
CLI to manage emails via IMAP/SMTP. Use `himalaya` to list, read, write, reply, forward, search, and organize emails from the terminal. Supports multiple accounts and message composition with MML (MIME Meta Language).
Create or update AgentSkills. Use when designing, structuring, or packaging skills with scripts, references, and assets.
Create or update AgentSkills. Use when designing, structuring, or packaging skills with scripts, references, and assets.
Set up and use 1Password CLI (op). Use when installing the CLI, enabling desktop app integration, signing in (single or multi-account), or reading/injecting/running secrets via op.
CLI to manage emails via IMAP/SMTP. Use `himalaya` to list, read, write, reply, forward, search, and organize emails from the terminal. Supports multiple accounts and message composition with MML (MIME Meta Language).