[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M719FHNFVJCB4NVCG9PKXSTS":3,"skill-same:01M719FHNFVJCB4NVCG9PKXSTS":67},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":23,"publishedAt":41,"linkOnly":42,"markdownContent":43,"markdownBody":44,"frontMatter":45,"refName":47,"commitSha":48,"skillDirectory":49,"forksCount":14,"repositoryHtmlUrl":50,"repositoryHomepageUrl":6,"ownerHtmlUrl":51,"ownerBlogUrl":6,"ownerDescription":6,"updatedAt":52,"install":53,"resources":66},"01M719FHNFVJCB4NVCG9PKXSTS","pci-compliance",null,"Master PCI DSS (Payment Card Industry Data Security Standard) compliance for secure payment processing and handling of cardholder data.","sapsapshen\u002Fai-memory-router","sapsapshen","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F20347959?v=4","01M6XDQEF1DP50DKF37H81J3J5","shenmian","01M6XDQEJPE41Y3DT2763X8ZJN",0,"MIT","https:\u002F\u002Fgithub.com\u002Fsapsapshen\u002Fai-memory-router\u002Fblob\u002Fmain\u002Fskills-store\u002Fglobal\u002Fpci-compliance\u002FSKILL.md",[18],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000037","律师与法务","PROFESSION","适用职业",[24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40],"compliance","pci","pci compliance","dss","2026","standard","unknown","for","industry","processing","card","security","payment","community","master","data","secure","2026-11-10 10:12:30",false,"---\nname: pci-compliance\ndescription: \"Master PCI DSS (Payment Card Industry Data Security Standard) compliance for secure payment processing and handling of cardholder data.\"\nrisk: unknown\nsource: community\ndate_added: \"2026-02-27\"\n---\n\n# PCI Compliance\n\nMaster PCI DSS (Payment Card Industry Data Security Standard) compliance for secure payment processing and handling of cardholder data.\n\n## Do not use this skill when\n\n- The task is unrelated to pci compliance\n- You need a different domain or tool outside this scope\n\n## Instructions\n\n- Clarify goals, constraints, and required inputs.\n- Apply relevant best practices and validate outcomes.\n- Provide actionable steps and verification.\n- If detailed examples are required, open `resources\u002Fimplementation-playbook.md`.\n\n## Use this skill when\n\n- Building payment processing systems\n- Handling credit card information\n- Implementing secure payment flows\n- Conducting PCI compliance audits\n- Reducing PCI compliance scope\n- Implementing tokenization and encryption\n- Preparing for PCI DSS assessments\n\n## PCI DSS Requirements (12 Core Requirements)\n\n### Build and Maintain Secure Network\n1. Install and maintain firewall configuration\n2. Don't use vendor-supplied defaults for passwords\n\n### Protect Cardholder Data\n3. Protect stored cardholder data\n4. Encrypt transmission of cardholder data across public networks\n\n### Maintain Vulnerability Management\n5. Protect systems against malware\n6. Develop and maintain secure systems and applications\n\n### Implement Strong Access Control\n7. Restrict access to cardholder data by business need-to-know\n8. Identify and authenticate access to system components\n9. Restrict physical access to cardholder data\n\n### Monitor and Test Networks\n10. Track and monitor all access to network resources and cardholder data\n11. Regularly test security systems and processes\n\n### Maintain Information Security Policy\n12. Maintain a policy that addresses information security\n\n## Compliance Levels\n\n**Level 1**: > 6 million transactions\u002Fyear (annual ROC required)\n**Level 2**: 1-6 million transactions\u002Fyear (annual SAQ)\n**Level 3**: 20,000-1 million e-commerce transactions\u002Fyear\n**Level 4**: \u003C 20,000 e-commerce or \u003C 1 million total transactions\n\n## Data Minimization (Never Store)\n\n```python\n# NEVER STORE THESE\nPROHIBITED_DATA = {\n    'full_track_data': 'Magnetic stripe data',\n    'cvv': 'Card verification code\u002Fvalue',\n    'pin': 'PIN or PIN block'\n}\n\n# CAN STORE (if encrypted)\nALLOWED_DATA = {\n    'pan': 'Primary Account Number (card number)',\n    'cardholder_name': 'Name on card',\n    'expiration_date': 'Card expiration',\n    'service_code': 'Service code'\n}\n\nclass PaymentData:\n    \"\"\"Safe payment data handling.\"\"\"\n\n    def __init__(self):\n        self.prohibited_fields = ['cvv', 'cvv2', 'cvc', 'pin']\n\n    def sanitize_log(self, data):\n        \"\"\"Remove sensitive data from logs.\"\"\"\n        sanitized = data.copy()\n\n        # Mask PAN\n        if 'card_number' in sanitized:\n            card = sanitized['card_number']\n            sanitized['card_number'] = f\"{card[:6]}{'*' * (len(card) - 10)}{card[-4:]}\"\n\n        # Remove prohibited data\n        for field in self.prohibited_fields:\n            sanitized.pop(field, None)\n\n        return sanitized\n\n    def validate_no_prohibited_storage(self, data):\n        \"\"\"Ensure no prohibited data is being stored.\"\"\"\n        for field in self.prohibited_fields:\n            if field in data:\n                raise SecurityError(f\"Attempting to store prohibited field: {field}\")\n```\n\n## Tokenization\n\n### Using Payment Processor Tokens\n```python\nimport stripe\n\nclass TokenizedPayment:\n    \"\"\"Handle payments using tokens (no card data on server).\"\"\"\n\n    @staticmethod\n    def create_payment_method_token(card_details):\n        \"\"\"Create token from card details (client-side only).\"\"\"\n        # THIS SHOULD ONLY BE DONE CLIENT-SIDE WITH STRIPE.JS\n        # NEVER send card details to your server\n\n        \"\"\"\n        \u002F\u002F Frontend JavaScript\n        const stripe = Stripe('pk_...');\n\n        const {token, error} = await stripe.createToken({\n            card: {\n                number: '4242424242424242',\n                exp_month: 12,\n                exp_year: 2024,\n                cvc: '123'\n            }\n        });\n\n        \u002F\u002F Send token.id to server (NOT card details)\n        \"\"\"\n        pass\n\n    @staticmethod\n    def charge_with_token(token_id, amount):\n        \"\"\"Charge using token (server-side).\"\"\"\n        # Your server only sees the token, never the card number\n        stripe.api_key = \"sk_...\"\n\n        charge = stripe.Charge.create(\n            amount=amount,\n            currency=\"usd\",\n            source=token_id,  # Token instead of card details\n            description=\"Payment\"\n        )\n\n        return charge\n\n    @staticmethod\n    def store_payment_method(customer_id, payment_method_token):\n        \"\"\"Store payment method as token for future use.\"\"\"\n        stripe.Customer.modify(\n            customer_id,\n            source=payment_method_token\n        )\n\n        # Store only customer_id and payment_method_id in your database\n        # NEVER store actual card details\n        return {\n            'customer_id': customer_id,\n            'has_payment_method': True\n            # DO NOT store: card number, CVV, etc.\n        }\n```\n\n### Custom Tokenization (Advanced)\n```python\nimport secrets\nfrom cryptography.fernet import Fernet\n\nclass TokenVault:\n    \"\"\"Secure token vault for card data (if you must store it).\"\"\"\n\n    def __init__(self, encryption_key):\n        self.cipher = Fernet(encryption_key)\n        self.vault = {}  # In production: use encrypted database\n\n    def tokenize(self, card_data):\n        \"\"\"Convert card data to token.\"\"\"\n        # Generate secure random token\n        token = secrets.token_urlsafe(32)\n\n        # Encrypt card data\n        encrypted = self.cipher.encrypt(json.dumps(card_data).encode())\n\n        # Store token -> encrypted data mapping\n        self.vault[token] = encrypted\n\n        return token\n\n    def detokenize(self, token):\n        \"\"\"Retrieve card data from token.\"\"\"\n        encrypted = self.vault.get(token)\n        if not encrypted:\n            raise ValueError(\"Token not found\")\n\n        # Decrypt\n        decrypted = self.cipher.decrypt(encrypted)\n        return json.loads(decrypted.decode())\n\n    def delete_token(self, token):\n        \"\"\"Remove token from vault.\"\"\"\n        self.vault.pop(token, None)\n```\n\n## Encryption\n\n### Data at Rest\n```python\nfrom cryptography.hazmat.primitives.ciphers.aead import AESGCM\nimport os\n\nclass EncryptedStorage:\n    \"\"\"Encrypt data at rest using AES-256-GCM.\"\"\"\n\n    def __init__(self, encryption_key):\n        \"\"\"Initialize with 256-bit key.\"\"\"\n        self.key = encryption_key  # Must be 32 bytes\n\n    def encrypt(self, plaintext):\n        \"\"\"Encrypt data.\"\"\"\n        # Generate random nonce\n        nonce = os.urandom(12)\n\n        # Encrypt\n        aesgcm = AESGCM(self.key)\n        ciphertext = aesgcm.encrypt(nonce, plaintext.encode(), None)\n\n        # Return nonce + ciphertext\n        return nonce + ciphertext\n\n    def decrypt(self, encrypted_data):\n        \"\"\"Decrypt data.\"\"\"\n        # Extract nonce and ciphertext\n        nonce = encrypted_data[:12]\n        ciphertext = encrypted_data[12:]\n\n        # Decrypt\n        aesgcm = AESGCM(self.key)\n        plaintext = aesgcm.decrypt(nonce, ciphertext, None)\n\n        return plaintext.decode()\n\n# Usage\nstorage = EncryptedStorage(os.urandom(32))\nencrypted_pan = storage.encrypt(\"4242424242424242\")\n# Store encrypted_pan in database\n```\n\n### Data in Transit\n```python\n# Always use TLS 1.2 or higher\n# Flask\u002FDjango example\napp.config['SESSION_COOKIE_SECURE'] = True  # HTTPS only\napp.config['SESSION_COOKIE_HTTPONLY'] = True\napp.config['SESSION_COOKIE_SAMESITE'] = 'Strict'\n\n# Enforce HTTPS\nfrom flask_talisman import Talisman\nTalisman(app, force_https=True)\n```\n\n## Access Control\n\n```python\nfrom functools import wraps\nfrom flask import session\n\ndef require_pci_access(f):\n    \"\"\"Decorator to restrict access to cardholder data.\"\"\"\n    @wraps(f)\n    def decorated_function(*args, **kwargs):\n        user = session.get('user')\n\n        # Check if user has PCI access role\n        if not user or 'pci_access' not in user.get('roles', []):\n            return {'error': 'Unauthorized access to cardholder data'}, 403\n\n        # Log access attempt\n        audit_log(\n            user=user['id'],\n            action='access_cardholder_data',\n            resource=f.__name__\n        )\n\n        return f(*args, **kwargs)\n\n    return decorated_function\n\n@app.route('\u002Fapi\u002Fpayment-methods')\n@require_pci_access\ndef get_payment_methods():\n    \"\"\"Retrieve payment methods (restricted access).\"\"\"\n    # Only accessible to users with pci_access role\n    pass\n```\n\n## Audit Logging\n\n```python\nimport logging\nfrom datetime import datetime\n\nclass PCIAuditLogger:\n    \"\"\"PCI-compliant audit logging.\"\"\"\n\n    def __init__(self):\n        self.logger = logging.getLogger('pci_audit')\n        # Configure to write to secure, append-only log\n\n    def log_access(self, user_id, resource, action, result):\n        \"\"\"Log access to cardholder data.\"\"\"\n        entry = {\n            'timestamp': datetime.utcnow().isoformat(),\n            'user_id': user_id,\n            'resource': resource,\n            'action': action,\n            'result': result,\n            'ip_address': request.remote_addr\n        }\n\n        self.logger.info(json.dumps(entry))\n\n    def log_authentication(self, user_id, success, method):\n        \"\"\"Log authentication attempt.\"\"\"\n        entry = {\n            'timestamp': datetime.utcnow().isoformat(),\n            'user_id': user_id,\n            'event': 'authentication',\n            'success': success,\n            'method': method,\n            'ip_address': request.remote_addr\n        }\n\n        self.logger.info(json.dumps(entry))\n\n# Usage\naudit = PCIAuditLogger()\naudit.log_access(user_id=123, resource='payment_methods', action='read', result='success')\n```\n\n## Security Best Practices\n\n### Input Validation\n```python\nimport re\n\ndef validate_card_number(card_number):\n    \"\"\"Validate card number format (Luhn algorithm).\"\"\"\n    # Remove spaces and dashes\n    card_number = re.sub(r'[\\s-]', '', card_number)\n\n    # Check if all digits\n    if not card_number.isdigit():\n        return False\n\n    # Luhn algorithm\n    def luhn_checksum(card_num):\n        def digits_of(n):\n            return [int(d) for d in str(n)]\n\n        digits = digits_of(card_num)\n        odd_digits = digits[-1::-2]\n        even_digits = digits[-2::-2]\n        checksum = sum(odd_digits)\n        for d in even_digits:\n            checksum += sum(digits_of(d * 2))\n        return checksum % 10\n\n    return luhn_checksum(card_number) == 0\n\ndef sanitize_input(user_input):\n    \"\"\"Sanitize user input to prevent injection.\"\"\"\n    # Remove special characters\n    # Validate against expected format\n    # Escape for database queries\n    pass\n```\n\n## PCI DSS SAQ (Self-Assessment Questionnaire)\n\n### SAQ A (Least Requirements)\n- E-commerce using hosted payment page\n- No card data on your systems\n- ~20 questions\n\n### SAQ A-EP\n- E-commerce with embedded payment form\n- Uses JavaScript to handle card data\n- ~180 questions\n\n### SAQ D (Most Requirements)\n- Store, process, or transmit card data\n- Full PCI DSS requirements\n- ~300 questions\n\n## Compliance Checklist\n\n```python\nPCI_COMPLIANCE_CHECKLIST = {\n    'network_security': [\n        'Firewall configured and maintained',\n        'No vendor default passwords',\n        'Network segmentation implemented'\n    ],\n    'data_protection': [\n        'No storage of CVV, track data, or PIN',\n        'PAN encrypted when stored',\n        'PAN masked when displayed',\n        'Encryption keys properly managed'\n    ],\n    'vulnerability_management': [\n        'Anti-virus installed and updated',\n        'Secure development practices',\n        'Regular security patches',\n        'Vulnerability scanning performed'\n    ],\n    'access_control': [\n        'Access restricted by role',\n        'Unique IDs for all users',\n        'Multi-factor authentication',\n        'Physical security measures'\n    ],\n    'monitoring': [\n        'Audit logs enabled',\n        'Log review process',\n        'File integrity monitoring',\n        'Regular security testing'\n    ],\n    'policy': [\n        'Security policy documented',\n        'Risk assessment performed',\n        'Security awareness training',\n        'Incident response plan'\n    ]\n}\n```\n\n## Resources\n\n- **references\u002Fdata-minimization.md**: Never store prohibited data\n- **references\u002Ftokenization.md**: Tokenization strategies\n- **references\u002Fencryption.md**: Encryption requirements\n- **references\u002Faccess-control.md**: Role-based access\n- **references\u002Faudit-logging.md**: Comprehensive logging\n- **assets\u002Fpci-compliance-checklist.md**: Complete checklist\n- **assets\u002Fencrypted-storage.py**: Encryption utilities\n- **scripts\u002Faudit-payment-system.sh**: Compliance audit script\n\n## Common Violations\n\n1. **Storing CVV**: Never store card verification codes\n2. **Unencrypted PAN**: Card numbers must be encrypted at rest\n3. **Weak Encryption**: Use AES-256 or equivalent\n4. **No Access Controls**: Restrict who can access cardholder data\n5. **Missing Audit Logs**: Must log all access to payment data\n6. **Insecure Transmission**: Always use TLS 1.2+\n7. **Default Passwords**: Change all default credentials\n8. **No Security Testing**: Regular penetration testing required\n\n## Reducing PCI Scope\n\n1. **Use Hosted Payments**: Stripe Checkout, PayPal, etc.\n2. **Tokenization**: Replace card data with tokens\n3. **Network Segmentation**: Isolate cardholder data environment\n4. **Outsource**: Use PCI-compliant payment processors\n5. **No Storage**: Never store full card details\n\nBy minimizing systems that touch card data, you reduce compliance burden significantly.\n","# PCI Compliance\n\nMaster PCI DSS (Payment Card Industry Data Security Standard) compliance for secure payment processing and handling of cardholder data.\n\n## Do not use this skill when\n\n- The task is unrelated to pci compliance\n- You need a different domain or tool outside this scope\n\n## Instructions\n\n- Clarify goals, constraints, and required inputs.\n- Apply relevant best practices and validate outcomes.\n- Provide actionable steps and verification.\n- If detailed examples are required, open `resources\u002Fimplementation-playbook.md`.\n\n## Use this skill when\n\n- Building payment processing systems\n- Handling credit card information\n- Implementing secure payment flows\n- Conducting PCI compliance audits\n- Reducing PCI compliance scope\n- Implementing tokenization and encryption\n- Preparing for PCI DSS assessments\n\n## PCI DSS Requirements (12 Core Requirements)\n\n### Build and Maintain Secure Network\n1. Install and maintain firewall configuration\n2. Don't use vendor-supplied defaults for passwords\n\n### Protect Cardholder Data\n3. Protect stored cardholder data\n4. Encrypt transmission of cardholder data across public networks\n\n### Maintain Vulnerability Management\n5. Protect systems against malware\n6. Develop and maintain secure systems and applications\n\n### Implement Strong Access Control\n7. Restrict access to cardholder data by business need-to-know\n8. Identify and authenticate access to system components\n9. Restrict physical access to cardholder data\n\n### Monitor and Test Networks\n10. Track and monitor all access to network resources and cardholder data\n11. Regularly test security systems and processes\n\n### Maintain Information Security Policy\n12. Maintain a policy that addresses information security\n\n## Compliance Levels\n\n**Level 1**: > 6 million transactions\u002Fyear (annual ROC required)\n**Level 2**: 1-6 million transactions\u002Fyear (annual SAQ)\n**Level 3**: 20,000-1 million e-commerce transactions\u002Fyear\n**Level 4**: \u003C 20,000 e-commerce or \u003C 1 million total transactions\n\n## Data Minimization (Never Store)\n\n```python\n# NEVER STORE THESE\nPROHIBITED_DATA = {\n    'full_track_data': 'Magnetic stripe data',\n    'cvv': 'Card verification code\u002Fvalue',\n    'pin': 'PIN or PIN block'\n}\n\n# CAN STORE (if encrypted)\nALLOWED_DATA = {\n    'pan': 'Primary Account Number (card number)',\n    'cardholder_name': 'Name on card',\n    'expiration_date': 'Card expiration',\n    'service_code': 'Service code'\n}\n\nclass PaymentData:\n    \"\"\"Safe payment data handling.\"\"\"\n\n    def __init__(self):\n        self.prohibited_fields = ['cvv', 'cvv2', 'cvc', 'pin']\n\n    def sanitize_log(self, data):\n        \"\"\"Remove sensitive data from logs.\"\"\"\n        sanitized = data.copy()\n\n        # Mask PAN\n        if 'card_number' in sanitized:\n            card = sanitized['card_number']\n            sanitized['card_number'] = f\"{card[:6]}{'*' * (len(card) - 10)}{card[-4:]}\"\n\n        # Remove prohibited data\n        for field in self.prohibited_fields:\n            sanitized.pop(field, None)\n\n        return sanitized\n\n    def validate_no_prohibited_storage(self, data):\n        \"\"\"Ensure no prohibited data is being stored.\"\"\"\n        for field in self.prohibited_fields:\n            if field in data:\n                raise SecurityError(f\"Attempting to store prohibited field: {field}\")\n```\n\n## Tokenization\n\n### Using Payment Processor Tokens\n```python\nimport stripe\n\nclass TokenizedPayment:\n    \"\"\"Handle payments using tokens (no card data on server).\"\"\"\n\n    @staticmethod\n    def create_payment_method_token(card_details):\n        \"\"\"Create token from card details (client-side only).\"\"\"\n        # THIS SHOULD ONLY BE DONE CLIENT-SIDE WITH STRIPE.JS\n        # NEVER send card details to your server\n\n        \"\"\"\n        \u002F\u002F Frontend JavaScript\n        const stripe = Stripe('pk_...');\n\n        const {token, error} = await stripe.createToken({\n            card: {\n                number: '4242424242424242',\n                exp_month: 12,\n                exp_year: 2024,\n                cvc: '123'\n            }\n        });\n\n        \u002F\u002F Send token.id to server (NOT card details)\n        \"\"\"\n        pass\n\n    @staticmethod\n    def charge_with_token(token_id, amount):\n        \"\"\"Charge using token (server-side).\"\"\"\n        # Your server only sees the token, never the card number\n        stripe.api_key = \"sk_...\"\n\n        charge = stripe.Charge.create(\n            amount=amount,\n            currency=\"usd\",\n            source=token_id,  # Token instead of card details\n            description=\"Payment\"\n        )\n\n        return charge\n\n    @staticmethod\n    def store_payment_method(customer_id, payment_method_token):\n        \"\"\"Store payment method as token for future use.\"\"\"\n        stripe.Customer.modify(\n            customer_id,\n            source=payment_method_token\n        )\n\n        # Store only customer_id and payment_method_id in your database\n        # NEVER store actual card details\n        return {\n            'customer_id': customer_id,\n            'has_payment_method': True\n            # DO NOT store: card number, CVV, etc.\n        }\n```\n\n### Custom Tokenization (Advanced)\n```python\nimport secrets\nfrom cryptography.fernet import Fernet\n\nclass TokenVault:\n    \"\"\"Secure token vault for card data (if you must store it).\"\"\"\n\n    def __init__(self, encryption_key):\n        self.cipher = Fernet(encryption_key)\n        self.vault = {}  # In production: use encrypted database\n\n    def tokenize(self, card_data):\n        \"\"\"Convert card data to token.\"\"\"\n        # Generate secure random token\n        token = secrets.token_urlsafe(32)\n\n        # Encrypt card data\n        encrypted = self.cipher.encrypt(json.dumps(card_data).encode())\n\n        # Store token -> encrypted data mapping\n        self.vault[token] = encrypted\n\n        return token\n\n    def detokenize(self, token):\n        \"\"\"Retrieve card data from token.\"\"\"\n        encrypted = self.vault.get(token)\n        if not encrypted:\n            raise ValueError(\"Token not found\")\n\n        # Decrypt\n        decrypted = self.cipher.decrypt(encrypted)\n        return json.loads(decrypted.decode())\n\n    def delete_token(self, token):\n        \"\"\"Remove token from vault.\"\"\"\n        self.vault.pop(token, None)\n```\n\n## Encryption\n\n### Data at Rest\n```python\nfrom cryptography.hazmat.primitives.ciphers.aead import AESGCM\nimport os\n\nclass EncryptedStorage:\n    \"\"\"Encrypt data at rest using AES-256-GCM.\"\"\"\n\n    def __init__(self, encryption_key):\n        \"\"\"Initialize with 256-bit key.\"\"\"\n        self.key = encryption_key  # Must be 32 bytes\n\n    def encrypt(self, plaintext):\n        \"\"\"Encrypt data.\"\"\"\n        # Generate random nonce\n        nonce = os.urandom(12)\n\n        # Encrypt\n        aesgcm = AESGCM(self.key)\n        ciphertext = aesgcm.encrypt(nonce, plaintext.encode(), None)\n\n        # Return nonce + ciphertext\n        return nonce + ciphertext\n\n    def decrypt(self, encrypted_data):\n        \"\"\"Decrypt data.\"\"\"\n        # Extract nonce and ciphertext\n        nonce = encrypted_data[:12]\n        ciphertext = encrypted_data[12:]\n\n        # Decrypt\n        aesgcm = AESGCM(self.key)\n        plaintext = aesgcm.decrypt(nonce, ciphertext, None)\n\n        return plaintext.decode()\n\n# Usage\nstorage = EncryptedStorage(os.urandom(32))\nencrypted_pan = storage.encrypt(\"4242424242424242\")\n# Store encrypted_pan in database\n```\n\n### Data in Transit\n```python\n# Always use TLS 1.2 or higher\n# Flask\u002FDjango example\napp.config['SESSION_COOKIE_SECURE'] = True  # HTTPS only\napp.config['SESSION_COOKIE_HTTPONLY'] = True\napp.config['SESSION_COOKIE_SAMESITE'] = 'Strict'\n\n# Enforce HTTPS\nfrom flask_talisman import Talisman\nTalisman(app, force_https=True)\n```\n\n## Access Control\n\n```python\nfrom functools import wraps\nfrom flask import session\n\ndef require_pci_access(f):\n    \"\"\"Decorator to restrict access to cardholder data.\"\"\"\n    @wraps(f)\n    def decorated_function(*args, **kwargs):\n        user = session.get('user')\n\n        # Check if user has PCI access role\n        if not user or 'pci_access' not in user.get('roles', []):\n            return {'error': 'Unauthorized access to cardholder data'}, 403\n\n        # Log access attempt\n        audit_log(\n            user=user['id'],\n            action='access_cardholder_data',\n            resource=f.__name__\n        )\n\n        return f(*args, **kwargs)\n\n    return decorated_function\n\n@app.route('\u002Fapi\u002Fpayment-methods')\n@require_pci_access\ndef get_payment_methods():\n    \"\"\"Retrieve payment methods (restricted access).\"\"\"\n    # Only accessible to users with pci_access role\n    pass\n```\n\n## Audit Logging\n\n```python\nimport logging\nfrom datetime import datetime\n\nclass PCIAuditLogger:\n    \"\"\"PCI-compliant audit logging.\"\"\"\n\n    def __init__(self):\n        self.logger = logging.getLogger('pci_audit')\n        # Configure to write to secure, append-only log\n\n    def log_access(self, user_id, resource, action, result):\n        \"\"\"Log access to cardholder data.\"\"\"\n        entry = {\n            'timestamp': datetime.utcnow().isoformat(),\n            'user_id': user_id,\n            'resource': resource,\n            'action': action,\n            'result': result,\n            'ip_address': request.remote_addr\n        }\n\n        self.logger.info(json.dumps(entry))\n\n    def log_authentication(self, user_id, success, method):\n        \"\"\"Log authentication attempt.\"\"\"\n        entry = {\n            'timestamp': datetime.utcnow().isoformat(),\n            'user_id': user_id,\n            'event': 'authentication',\n            'success': success,\n            'method': method,\n            'ip_address': request.remote_addr\n        }\n\n        self.logger.info(json.dumps(entry))\n\n# Usage\naudit = PCIAuditLogger()\naudit.log_access(user_id=123, resource='payment_methods', action='read', result='success')\n```\n\n## Security Best Practices\n\n### Input Validation\n```python\nimport re\n\ndef validate_card_number(card_number):\n    \"\"\"Validate card number format (Luhn algorithm).\"\"\"\n    # Remove spaces and dashes\n    card_number = re.sub(r'[\\s-]', '', card_number)\n\n    # Check if all digits\n    if not card_number.isdigit():\n        return False\n\n    # Luhn algorithm\n    def luhn_checksum(card_num):\n        def digits_of(n):\n            return [int(d) for d in str(n)]\n\n        digits = digits_of(card_num)\n        odd_digits = digits[-1::-2]\n        even_digits = digits[-2::-2]\n        checksum = sum(odd_digits)\n        for d in even_digits:\n            checksum += sum(digits_of(d * 2))\n        return checksum % 10\n\n    return luhn_checksum(card_number) == 0\n\ndef sanitize_input(user_input):\n    \"\"\"Sanitize user input to prevent injection.\"\"\"\n    # Remove special characters\n    # Validate against expected format\n    # Escape for database queries\n    pass\n```\n\n## PCI DSS SAQ (Self-Assessment Questionnaire)\n\n### SAQ A (Least Requirements)\n- E-commerce using hosted payment page\n- No card data on your systems\n- ~20 questions\n\n### SAQ A-EP\n- E-commerce with embedded payment form\n- Uses JavaScript to handle card data\n- ~180 questions\n\n### SAQ D (Most Requirements)\n- Store, process, or transmit card data\n- Full PCI DSS requirements\n- ~300 questions\n\n## Compliance Checklist\n\n```python\nPCI_COMPLIANCE_CHECKLIST = {\n    'network_security': [\n        'Firewall configured and maintained',\n        'No vendor default passwords',\n        'Network segmentation implemented'\n    ],\n    'data_protection': [\n        'No storage of CVV, track data, or PIN',\n        'PAN encrypted when stored',\n        'PAN masked when displayed',\n        'Encryption keys properly managed'\n    ],\n    'vulnerability_management': [\n        'Anti-virus installed and updated',\n        'Secure development practices',\n        'Regular security patches',\n        'Vulnerability scanning performed'\n    ],\n    'access_control': [\n        'Access restricted by role',\n        'Unique IDs for all users',\n        'Multi-factor authentication',\n        'Physical security measures'\n    ],\n    'monitoring': [\n        'Audit logs enabled',\n        'Log review process',\n        'File integrity monitoring',\n        'Regular security testing'\n    ],\n    'policy': [\n        'Security policy documented',\n        'Risk assessment performed',\n        'Security awareness training',\n        'Incident response plan'\n    ]\n}\n```\n\n## Resources\n\n- **references\u002Fdata-minimization.md**: Never store prohibited data\n- **references\u002Ftokenization.md**: Tokenization strategies\n- **references\u002Fencryption.md**: Encryption requirements\n- **references\u002Faccess-control.md**: Role-based access\n- **references\u002Faudit-logging.md**: Comprehensive logging\n- **assets\u002Fpci-compliance-checklist.md**: Complete checklist\n- **assets\u002Fencrypted-storage.py**: Encryption utilities\n- **scripts\u002Faudit-payment-system.sh**: Compliance audit script\n\n## Common Violations\n\n1. **Storing CVV**: Never store card verification codes\n2. **Unencrypted PAN**: Card numbers must be encrypted at rest\n3. **Weak Encryption**: Use AES-256 or equivalent\n4. **No Access Controls**: Restrict who can access cardholder data\n5. **Missing Audit Logs**: Must log all access to payment data\n6. **Insecure Transmission**: Always use TLS 1.2+\n7. **Default Passwords**: Change all default credentials\n8. **No Security Testing**: Regular penetration testing required\n\n## Reducing PCI Scope\n\n1. **Use Hosted Payments**: Stripe Checkout, PayPal, etc.\n2. **Tokenization**: Replace card data with tokens\n3. **Network Segmentation**: Isolate cardholder data environment\n4. **Outsource**: Use PCI-compliant payment processors\n5. **No Storage**: Never store full card details\n\nBy minimizing systems that touch card data, you reduce compliance burden significantly.\n",{"name":5,"risk":30,"source":37,"date_added":46,"description":7},"2026-02-27","main","7a38d8e7073e61c16eda85681cb32fb68a8657a5","skills-store\u002Fglobal\u002Fpci-compliance","https:\u002F\u002Fgithub.com\u002Fsapsapshen\u002Fai-memory-router","https:\u002F\u002Fgithub.com\u002Fsapsapshen","2026-04-14 21:12:12",{"source":8,"skillName":5,"commands":54,"prompt":64,"zipAvailable":65},[55,58,61],{"tool":56,"command":57},"npx","npx skills add sapsapshen\u002Fai-memory-router --skill pci-compliance",{"tool":59,"command":60},"bunx","bunx skills add sapsapshen\u002Fai-memory-router --skill pci-compliance",{"tool":62,"command":63},"pnpm","pnpm dlx skills add sapsapshen\u002Fai-memory-router --skill pci-compliance","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fsapsapshen\u002Fai-memory-router\u002Fblob\u002Fmain\u002Fskills-store\u002Fglobal\u002Fpci-compliance\u002FSKILL.md",true,[],[68,87,112,122,135,154],{"skillNo":69,"name":70,"nameZh":6,"description":71,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":72,"categories":73,"keywords":75,"publishedAt":41},"01M71ATQRKG48SH06FQ697T5G9","wechat-search","Search WeChat Official Account articles using OpenClaw's web search and fetch capabilities with compliance-focused design.","https:\u002F\u002Fgithub.com\u002Fsapsapshen\u002Fai-memory-router\u002Fblob\u002Fmain\u002Fskills-store\u002Fopenclaw\u002Fwechat-search-release\u002FSKILL.md",[74],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[76,77,78,79,80,81,82,24,83,84,85,86],"wechat search","wechat","search","capabilities","openclaw","design","web search","web","official","fetch","with",{"skillNo":88,"name":89,"nameZh":6,"description":90,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":91,"categories":92,"keywords":93,"publishedAt":41},"01M71ATNAVGZB35PFYM2GC5N00","trend-tap","Real-time trending topics aggregator across 7 platforms (X\u002FTwitter, Reddit, Google Trends, Hacker News, Zhihu, Bilibili, Weibo). Trigger: when user says 'trend', 'trends', 'trend tap', '热点', '热搜', or asks what is trending\u002Fhot. Do NOT use web_search — this skill already fetches live data from all platforms with zero API keys.","https:\u002F\u002Fgithub.com\u002Fsapsapshen\u002Fai-memory-router\u002Fblob\u002Fmain\u002Fskills-store\u002Fopenclaw\u002Ftrend-tap\u002FSKILL.md",[],[94,95,96,97,98,99,78,100,101,102,103,104,105,106,39,107,108,109,110,111],"trend","trend tap","tap","api keys","Bash","time","trending","hacker","aggregator","do","when","brew","live","google","install","read","across","api",{"skillNo":113,"name":114,"nameZh":6,"description":115,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":116,"categories":117,"keywords":118,"publishedAt":41},"01M71ATJ9AM5KM15AA8PS302EB","trend-radar","Real-time trending topics aggregator across 7 platforms (X\u002FTwitter, Reddit, Google Trends, Hacker News, Zhihu, Bilibili, Weibo). Trigger: when user says 'trend', 'trends', 'trend pulse', '热点', '热搜', or asks what is trending\u002Fhot. Do NOT use web_search — this skill already fetches live data from all platforms with zero API keys.","https:\u002F\u002Fgithub.com\u002Fsapsapshen\u002Fai-memory-router\u002Fblob\u002Fmain\u002Fskills-store\u002Fopenclaw\u002Ftrend-radar\u002FSKILL.md",[],[119,120,94,105,106,39,107,98,78,109,121,110,111,104,102,101,100,108,99,97],"trend radar","radar","pulse",{"skillNo":123,"name":124,"nameZh":6,"description":125,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":126,"categories":127,"keywords":128,"publishedAt":41},"01M71ATGF095N3EJM9G8SD0BB5","tech-news-daily","每日科技新闻汇——从全球多个 RSS 源抓取最新科技新闻，翻译（英→中）、去重、排版成每日简报。当用户询问科技新闻、科技新鲜事、每日科技、技术动态、Daily Tech News 或类似表达时触发此技能。","https:\u002F\u002Fgithub.com\u002Fsapsapshen\u002Fai-memory-router\u002Fblob\u002Fmain\u002Fskills-store\u002Fopenclaw\u002Ftech-news-daily\u002FSKILL.md",[],[129,130,131,132,133,134],"news","tech","tech news daily","daily","rss","翻译",{"skillNo":136,"name":137,"nameZh":6,"description":138,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":139,"categories":140,"keywords":146,"publishedAt":41},"01M71ATFAEAMQ17M70NQNY7SR8","summarize","Summarize URLs or files with the summarize CLI (web, PDFs, images, audio, YouTube).","https:\u002F\u002Fgithub.com\u002Fsapsapshen\u002Fai-memory-router\u002Fblob\u002Fmain\u002Fskills-store\u002Fopenclaw\u002Fsummarize\u002FSKILL.md",[141],{"categoryNo":142,"categoryName":143,"taxonomyType":144,"taxonomyTypeDesc":145},"01JBSEEDCAT000000000000021","资料检索与研究","SCENARIO","使用场景",[137,83,147,148,149,86,105,150,151,152,96,153,108],"Audio","cli","youtube","images","https","files","pdfs",{"skillNo":155,"name":156,"nameZh":6,"description":157,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":158,"categories":159,"keywords":160,"publishedAt":41},"01M71ATDNS3R0M4H936PACQAWZ","sonoscli","Control Sonos speakers (discover\u002Fstatus\u002Fplay\u002Fvolume\u002Fgroup).","https:\u002F\u002Fgithub.com\u002Fsapsapshen\u002Fai-memory-router\u002Fblob\u002Fmain\u002Fskills-store\u002Fopenclaw\u002Fsonoscli\u002FSKILL.md",[],[156,161,162,163,108,164,151,165,166,167,168,169],"status","play","go","latest","github","discover","control","cmd","volume"]