Secure payment processing requires meeting PCI DSS standards. This skill provides comprehensive guidance on encryption, tokenization, access controls, and audit logging to protect cardholder data.
تنزيل ZIP المهارة
رفع في Claude
اذهب إلى Settings → Capabilities → Skills → Upload skill
فعّل وابدأ الاستخدام
اختبرها
استخدام "pci-compliance". What data can I legally store after a payment is processed?
النتيجة المتوقعة:
- You CAN store (if encrypted): Primary Account Number (PAN), cardholder name, expiration date, service code.
- You CANNOT store: Full magnetic stripe track data, CVV/CVC codes, PIN or PIN blocks.
- Best practice: Use tokenization to avoid storing PAN entirely - let your payment processor handle sensitive data storage.
استخدام "pci-compliance". How do I reduce my PCI compliance scope?
النتيجة المتوقعة:
- Use hosted payment pages (SAQ A - minimal requirements)
- Implement client-side tokenization with Stripe.js or similar
- Never transmit card data through your servers
- Segment your network to isolate any systems that touch card data
- Outsource payment processing to PCI-certified providers
التدقيق الأمني
آمنAll static analysis findings are false positives. The detected 'backtick execution' patterns are markdown code fence syntax (```), not shell commands. The 'env_access' and 'sensitive' detections reference placeholder values in educational code examples. This skill is documentation teaching secure payment handling practices including encryption, tokenization, and access control - promoting security rather than introducing risks.
درجة الجودة
ماذا يمكنك بناءه
Payment System Development
Developers building payment processing systems can use this skill to implement PCI-compliant data handling, encryption, and tokenization from the start.
Compliance Audit Preparation
Security teams preparing for PCI DSS assessments can use the checklists and requirements documentation to identify gaps and remediation needs.
E-commerce Integration
Teams integrating payment gateways can learn how to minimize PCI scope using hosted payment pages and tokenization strategies.
جرّب هذه الموجهات
Explain the 12 PCI DSS requirements and which ones apply to my e-commerce store that uses Stripe Checkout.
Show me how to encrypt cardholder data at rest using AES-256 in Python, including key management best practices.
Compare Stripe tokenization versus building a custom token vault. What are the PCI scope implications of each approach?
Create a PCI-compliant audit logging system that tracks all access to payment data, including the required fields and log retention policies.
أفضل الممارسات
- Never store CVV, PIN, or full track data under any circumstances
- Use TLS 1.2 or higher for all data transmission involving cardholder information
- Implement role-based access control and log all access to payment data
تجنب
- Logging full card numbers or CVV codes in application logs
- Using weak encryption algorithms like DES or RC4 for cardholder data
- Sending card data to your own server instead of directly to the payment processor