菜单
This skill should be used when the user asks about "compliance mapping", "PCI-DSS", "HIPAA", "SOC 2", "NIST CSF", "regulatory requirements", "compliance report", or needs to map security findings to compliance framework requirements.
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
基于 SOC 职业分类
| name | Compliance Mapping |
| description | This skill should be used when the user asks about "compliance mapping", "PCI-DSS", "HIPAA", "SOC 2", "NIST CSF", "regulatory requirements", "compliance report", or needs to map security findings to compliance framework requirements. |
| version | 1.0.0 |
Map VulnScout security findings to compliance framework requirements. This enables security teams to understand the regulatory impact of discovered vulnerabilities and prioritize remediation based on compliance obligations.
Payment Card Industry Data Security Standard for organizations handling cardholder data.
| Requirement | Description | VulnScout Finding Types |
|---|---|---|
| 6.2.1 | Secure development practices | All code-level findings |
| 6.2.2 | Software security training | Recurring pattern findings |
| 6.2.3 | Code review before release | Unverified findings in diff |
| 6.2.4 | Prevent common vulnerabilities | sql-injection, xss, command-injection, path-traversal |
| 6.3.1 | Identify vulnerabilities via scanning | All findings from /scan |
| 6.3.2 | Maintain inventory of custom software | Framework detection results |
| 6.4.1 | Public-facing web app protection | ssrf, xss, csrf, open-redirect |
| 6.4.2 | Automated technical solution for web attacks | WAF findings, missing CSP |
| 6.5.1-6.5.6 | Address common coding vulnerabilities | Injection, auth bypass, XSS, access control |
Health Insurance Portability and Accountability Act technical safeguards.
| Section | Description | VulnScout Finding Types |
|---|---|---|
| 164.312(a)(1) | Access Control | access-control, idor, business-logic |
| 164.312(a)(2)(i) | Unique User Identification | auth-bypass, session fixation |
| 164.312(a)(2)(iii) | Automatic Logoff | session management findings |
| 164.312(a)(2)(iv) | Encryption at Rest | cryptographic-failures, hardcoded-secret |
| 164.312(b) | Audit Controls | logging-failures |
| 164.312(c)(1) | Integrity Controls | sql-injection, deserialization, ssti |
| 164.312(c)(2) | Authentication of ePHI | auth-bypass, hardcoded-secret |
| 164.312(d) | Person/Entity Authentication | auth-bypass, insecure-randomness |
| 164.312(e)(1) | Transmission Security | cryptographic-failures, ssrf |
| 164.312(e)(2)(i) | Integrity Controls (transmission) | ssti, xss, command-injection |
| 164.312(e)(2)(ii) | Encryption in Transit | cryptographic-failures |
Service Organization Control 2 for SaaS and cloud service providers.
| Criteria | Description | VulnScout Finding Types |
|---|---|---|
| CC6.1 | Logical and Physical Access | access-control, idor, auth-bypass |
| CC6.2 | Credential Management | hardcoded-secret, insecure-randomness |
| CC6.3 | Access Roles and Responsibilities | access-control, business-logic |
| CC6.6 | System Boundary Protection | ssrf, open-redirect, cors-misconfig |
| CC6.7 | Data Flow Restrictions | path-traversal, xxe, deserialization |
| CC6.8 | Malicious Software Prevention | command-injection, code-injection, ssti |
| CC7.1 | System Monitoring | logging-failures, exception-handling |
| CC7.2 | Anomaly Detection | insecure-randomness, race-condition |
| CC7.3 | Security Event Evaluation | logging-failures |
| CC7.4 | Incident Response | All critical/high findings |
| CC8.1 | Change Management | Findings in diff (--since-commit) |
| Function | Category | VulnScout Finding Types |
|---|---|---|
| Identify | ID.AM - Asset Management | Framework detection, scope results |
| Identify | ID.RA - Risk Assessment | Threat model, STRIDE analysis |
| Protect | PR.AC - Access Control | access-control, idor, auth-bypass |
| Protect | PR.DS - Data Security | sql-injection, path-traversal, cryptographic-failures |
| Protect | PR.IP - Protective Processes | All remediated findings |
| Protect | PR.MA - Maintenance | Diff-aware scan results |
| Detect | DE.AE - Anomalies and Events | logging-failures, exception-handling |
| Detect | DE.CM - Continuous Monitoring | /scan --since-commit results |
| Respond | RS.AN - Analysis | Verified findings with evidence |
| Recover | RC.IM - Improvements | Patch advisor recommendations |
| Finding Type | PCI-DSS | HIPAA | SOC 2 | NIST CSF |
|---|---|---|---|---|
| sql-injection | 6.2.4, 6.5.1 | 164.312(c)(1) | CC6.8 | PR.DS |
| xss | 6.2.4, 6.4.1 | 164.312(e)(2)(i) | CC6.8 | PR.DS |
| command-injection | 6.2.4 | 164.312(e)(2)(i) | CC6.8 | PR.DS |
| path-traversal | 6.2.4 | 164.312(a)(1) | CC6.7 | PR.DS |
| ssrf | 6.4.1 | 164.312(e)(1) | CC6.6 | PR.DS |
| deserialization | 6.2.4 | 164.312(c)(1) | CC6.7 | PR.DS |
| ssti | 6.2.4 | 164.312(c)(1) | CC6.8 | PR.DS |
| xxe | 6.2.4 | 164.312(c)(1) | CC6.7 | PR.DS |
| access-control | 6.5.4 | 164.312(a)(1) | CC6.1 | PR.AC |
| auth-bypass | 6.5.3 | 164.312(d) | CC6.1 | PR.AC |
| hardcoded-secret | 6.2.4 | 164.312(a)(2)(iv) | CC6.2 | PR.AC |
| cryptographic-failures | 6.2.4 | 164.312(e)(2)(ii) | CC6.2 | PR.DS |
| logging-failures | 6.2.4 | 164.312(b) | CC7.1 | DE.AE |
| insecure-randomness | 6.2.4 | 164.312(d) | CC7.2 | PR.DS |
| idor | 6.5.4 | 164.312(a)(1) | CC6.1 | PR.AC |
| ldap-injection | 6.2.4, 6.5.1 | 164.312(c)(1) | CC6.8 | PR.DS |
When generating a compliance-aware report, use the --compliance flag:
/vuln-scout:report --compliance pci-dss,hipaa,soc2
This appends a Compliance Impact section to the report:
## Compliance Impact
### PCI-DSS v4.0
| Requirement | Status | Findings |
|-------------|--------|----------|
| 6.2.4 | FAIL | 3 injection findings |
| 6.4.1 | PASS | No public-facing web app findings |
### HIPAA 164.312
| Section | Status | Findings |
|---------|--------|----------|
| 164.312(a)(1) | FAIL | 2 access control findings |
| 164.312(c)(1) | FAIL | 1 SQL injection finding |
Ask the user which compliance frameworks apply to their organization.
/vuln-scout:full-audit .
Use the mapping table above to categorize each finding by its compliance impact.
Findings that affect multiple frameworks should be prioritized higher.
Include both the technical finding details and the compliance requirement references.
Use this skill when the user is auditing a decompiled Android application — directory structure includes `jadx_out/` / `apktool_out/`, files end in `.smali` / are jadx-renamed to `defpackage/*.java`, or the conversation mentions an APK / xAPK / `com.example.*` package. Covers the high-signal vulnerability classes vuln-scout detects in decompiled APKs and the conventions for running the unified mobile-audit workflow.
Use this skill when the user is auditing an iOS application — directory contains `.ipa`, `Info.plist`, `*.swift`, `*.m`, `*.mm`, or an `xcodeproj`. Also activates when the conversation mentions WKWebView, NSURLSession, Keychain, App Transport Security, or any `com.apple.*` / `bundleidentifier`-style iOS package name.
Use this skill when reviewing mobile code that handles card data, payment tokenization, or third-party payment SDK integrations (Braintree, Stripe, Adyen, Google Pay, Apple Pay, FirstData-style iframe encryptors). The skill catalogues the high-signal attack patterns vuln-scout detects in mobile payment flows — server-controlled tokenization URLs, JavaScript-injection-into-WebView card-data exfiltration, JS-bridge token construction, and payment scope mismatches — and maps each to the detector that fires.
This skill should be used when the user asks about "business logic", "workflow vulnerability", "trust boundary", "state machine", "authorization bypass", "multi-step process", "workflow bypass", "application logic flaw", or needs to identify business logic vulnerabilities during whitebox security review.
This skill should be used when the user asks about "cache poisoning", "web cache deception", "CDN cache", "proxy cache", "nginx cache", "varnish", "cache key manipulation", "response caching", or needs to find cache-related vulnerabilities during whitebox security review.
This skill should be used when the user asks about "cloud security", "AWS security", "GCP security", "Azure security", "Kubernetes security", "IMDS", "instance metadata", "S3 bucket policy", "IAM", "serverless security", "Lambda security", "container security", "cloud misconfiguration", "SSRF to cloud metadata", or needs to identify cloud-native security issues during whitebox security review.