菜单
Conduct comprehensive security compliance audits for SOC 2, GDPR, HIPAA, PCI-DSS, and ISO 27001. Use when preparing for certification, annual audits, or compliance validation.
默认使用会先检查来源的 Prompt；你也可以切换为直接命令，或下载本地副本。
决定是否安装前，请先阅读 SKILL.md，以及 SkillsMP 当前展示的配套文件。
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
直接命令不会经过审查 Prompt；运行前请先检查来源。
npx skills add https://github.com/ForceInjection/domain-driven-design-skills --skill security-compliance-audit命令会保持在同一行。复制前请横向滚动并检查完整内容。
想先保存到本地？可下载 SkillsMP 当前能够提供的文件。
基于 SOC 职业分类
正在显示 SKILL.md
| name | security-compliance-audit |
| description | Conduct comprehensive security compliance audits for SOC 2, GDPR, HIPAA, PCI-DSS, and ISO 27001. Use when preparing for certification, annual audits, or compliance validation. |
Systematic evaluation of security controls, policies, and procedures to ensure compliance with industry standards and regulatory requirements.
# compliance_auditor.py
from dataclasses import dataclass, field
from typing import List, Dict
from enum import Enum
import json
from datetime import datetime
class ComplianceFramework(Enum):
SOC2 = "SOC 2"
GDPR = "GDPR"
HIPAA = "HIPAA"
PCI_DSS = "PCI-DSS"
ISO_27001 = "ISO 27001"
class ControlStatus():
COMPLIANT =
NON_COMPLIANT =
PARTIALLY_COMPLIANT =
NOT_APPLICABLE =
:
control_id:
framework: ComplianceFramework
category:
description:
requirement:
status: ControlStatus
evidence: [] = field(default_factory=)
findings: [] = field(default_factory=)
remediation: =
owner: =
due_date: =
:
():
.framework = framework
.controls: [Control] = []
.load_controls()
():
.framework == ComplianceFramework.SOC2:
.load_soc2_controls()
.framework == ComplianceFramework.GDPR:
.load_gdpr_controls()
.framework == ComplianceFramework.HIPAA:
.load_hipaa_controls()
.framework == ComplianceFramework.PCI_DSS:
.load_pci_dss_controls()
():
soc2_controls = [
{
: ,
: ,
: ,
:
},
{
: ,
: ,
: ,
:
},
{
: ,
: ,
: ,
:
},
{
: ,
: ,
: ,
:
},
{
: ,
: ,
: ,
:
}
]
ctrl soc2_controls:
.controls.append(Control(
control_id=ctrl[],
framework=.framework,
category=ctrl[],
description=ctrl[],
requirement=ctrl[],
status=ControlStatus.NOT_APPLICABLE
))
():
gdpr_controls = [
{
: ,
: ,
: ,
:
},
{
: ,
: ,
: ,
:
},
{
: ,
: ,
: ,
:
},
{
: ,
: ,
: ,
:
},
{
: ,
: ,
: ,
:
},
{
: ,
: ,
: ,
:
}
]
ctrl gdpr_controls:
.controls.append(Control(
control_id=ctrl[],
framework=.framework,
category=ctrl[],
description=ctrl[],
requirement=ctrl[],
status=ControlStatus.NOT_APPLICABLE
))
():
pci_controls = [
{
: ,
: ,
: ,
:
},
{
: ,
: ,
: ,
:
},
{
: ,
: ,
: ,
:
},
{
: ,
: ,
: ,
:
},
{
: ,
: ,
: ,
:
}
]
ctrl pci_controls:
.controls.append(Control(
control_id=ctrl[],
framework=.framework,
category=ctrl[],
description=ctrl[],
requirement=ctrl[],
status=ControlStatus.NOT_APPLICABLE
))
():
hipaa_controls = [
{
: ,
: ,
: ,
:
},
{
: ,
: ,
: ,
:
},
{
: ,
: ,
: ,
:
},
{
: ,
: ,
: ,
:
},
{
: ,
: ,
: ,
:
}
]
ctrl hipaa_controls:
.controls.append(Control(
control_id=ctrl[],
framework=.framework,
category=ctrl[],
description=ctrl[],
requirement=ctrl[],
status=ControlStatus.NOT_APPLICABLE
))
():
control .controls:
control.control_id == control_id:
control.status = status
control.evidence = evidence []
control.findings = findings []
control.remediation = remediation
control.owner = owner
control.due_date = due_date
() -> :
summary = {
: ,
: ,
: ,
:
}
categories = {}
control .controls:
summary[control.status.value] +=
control.category categories:
categories[control.category] = {
: [],
: ,
:
}
categories[control.category][].append({
: control.control_id,
: control.description,
: control.status.value,
: control.findings,
: control.remediation
})
control.status == ControlStatus.COMPLIANT:
categories[control.category][] +=
control.status == ControlStatus.NON_COMPLIANT:
categories[control.category][] +=
total_assessed = ([c c .controls c.status != ControlStatus.NOT_APPLICABLE])
compliance_rate = (summary[] / total_assessed * ) total_assessed >
{
: .framework.value,
: datetime.now().isoformat(),
: summary,
: ,
: categories,
: .get_action_items()
}
() -> []:
action_items = []
control .controls:
control.status [ControlStatus.NON_COMPLIANT, ControlStatus.PARTIALLY_COMPLIANT]:
action_items.append({
: control.control_id,
: control.category,
: control.description,
: control.status.value,
: control.findings,
: control.remediation,
: control.owner,
: control.due_date
})
(action_items, key= x: x[] == , reverse=)
():
report = .generate_report()
(filename, ) f:
json.dump(report, f, indent=)
()
__name__ == :
auditor = ComplianceAuditor(ComplianceFramework.SOC2)
auditor.assess_control(
,
ControlStatus.COMPLIANT,
evidence=[, ],
findings=[]
)
auditor.assess_control(
,
ControlStatus.PARTIALLY_COMPLIANT,
evidence=[],
findings=[],
remediation=,
owner=,
due_date=
)
auditor.assess_control(
,
ControlStatus.NON_COMPLIANT,
findings=[],
remediation=,
owner=,
due_date=
)
report = auditor.generate_report()
()
()
()
()
()
()
()
item report[][:]:
()
auditor.export_report()
// compliance-automation.js
const axios = require('axios');
const fs = require('fs').promises;
class ComplianceAutomation {
constructor() {
this.checks = [];
}
// Check encryption at rest
async checkEncryptionAtRest() {
console.log('Checking encryption at rest...');
const findings = [];
// Check database encryption
// Implementation would connect to actual database
const dbEncrypted = false;
if (!dbEncrypted) {
findings.push('Database encryption not enabled');
}
return {
control: 'Encryption at Rest',
compliant: findings.length === 0,
findings
};
}
// Check encryption in transit
async checkEncryptionInTransit() {
console.log('Checking encryption in transit...');
const findings = [];
const endpoints = ['https://api.example.com'];
for (const endpoint of endpoints) {
try {
const response = await axios.get(endpoint, {
httpsAgent: new (require('https')).Agent({
rejectUnauthorized: true,
minVersion: 'TLSv1.2'
})
});
// Check TLS version and cipher
const tls = response.request.socket.getProtocol();
const cipher = response.request.socket.getCipher();
if (!tls.includes('TLSv1.2') && !tls.includes('TLSv1.3')) {
findings.push(`Weak TLS version: ${tls}`);
}
if (cipher.name.includes('DES') || cipher.name.includes('RC4')) {
findings.push(`Weak cipher: ${cipher.name}`);
}
} catch (error) {
findings.push(`TLS check failed: ${error.message}`);
}
}
return {
control: 'Encryption in Transit',
compliant: findings.length === 0,
findings
};
}
// Check access controls
async checkAccessControls() {
console.log('Checking access controls...');
const findings = [];
// Check MFA
const mfaEnabled = true; // Check actual MFA status
if (!mfaEnabled) {
findings.push('MFA not enabled for all users');
}
// Check password policy
const passwordPolicy = {
minLength: 12,
requireUppercase: true,
requireNumbers: true,
requireSpecial: true
};
if (passwordPolicy.minLength < 12) {
findings.push('Password minimum length less than 12');
}
return {
control: 'Access Controls',
compliant: findings.length === 0,
findings
};
}
// Check audit logging
async checkAuditLogging() {
console.log('Checking audit logging...');
const findings = [];
// Check log retention
const logRetentionDays = 90;
if (logRetentionDays < 90) {
findings.push('Log retention less than 90 days');
}
// Check log events
const requiredEvents = [
'authentication',
'authorization',
'data_access',
'configuration_changes'
];
const loggedEvents = ['authentication', 'authorization'];
const missingEvents = requiredEvents.filter(e => !loggedEvents.includes(e));
if (missingEvents.length > 0) {
findings.push(`Missing log events: ${missingEvents.join(', ')}`);
}
return {
control: 'Audit Logging',
compliant: findings.length === 0,
findings
};
}
async runAllChecks() {
this.checks = [
await this.checkEncryptionAtRest(),
await this.checkEncryptionInTransit(),
await this.checkAccessControls(),
await this.checkAuditLogging()
];
return this.generateReport();
}
generateReport() {
const compliant = this.checks.filter(c => c.compliant).length;
const nonCompliant = this.checks.length - compliant;
const complianceRate = (compliant / this.checks.length) * 100;
return {
timestamp: new Date().toISOString(),
summary: {
total: this.checks.length,
compliant,
nonCompliant,
complianceRate: `${complianceRate.toFixed(2)}%`
},
checks: this.checks
};
}
}
// Usage
async function main() {
const automation = new ComplianceAutomation();
const report = await automation.runAllChecks();
console.log('\n=== Compliance Report ===');
console.log(`Compliance Rate: ${report.summary.complianceRate}`);
console.log(`Compliant: ${report.summary.compliant}/${report.summary.total}`);
await fs.writeFile('compliance-report.json', JSON.stringify(report, null, 2));
}
main().catch(console.error);