菜单
Guardrails for edits to core/security/compliance-manager.js that preserve PCI/GDPR/PSD2/SOX/HIPAA controls (masking, encryption, SCA, consent checks, and audit logging). Use when changing compliance validators, security handling, or audit flows.
默认使用会先检查来源的 Prompt；你也可以切换为直接命令，或下载本地副本。
决定是否安装前，请先阅读 SKILL.md，以及 SkillsMP 当前展示的配套文件。
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
直接命令不会经过审查 Prompt；运行前请先检查来源。
npx skills add https://github.com/thefixer3x/onasis-gateway --skill compliance-manager命令会保持在同一行。复制前请横向滚动并检查完整内容。
想先保存到本地？可下载 SkillsMP 当前能够提供的文件。
Use this skill when recording, recalling, or analyzing behavioral workflow patterns via the LanOnasis MaaS API. Trigger when the user or an agent wants to save a successful workflow for future reuse, recall past patterns before starting a task, analyze how Claude has handled similar tasks before, or when working with the `@lanonasis/mem-intel-sdk` behavior features. Also trigger when the user says things like "remember how I did this", "what's my usual pattern for X", "log this workflow", or "use my previous approach."
Use this skill when adding new methods, tools, or schema changes to the `@lanonasis/mem-intel-sdk`. Trigger when the user wants to extend the SDK with new capabilities, add a new MCP tool to mcp-core, add a new intelligence endpoint, or migrate the behavior_patterns schema. Also trigger when the user says things like "add a new tool to the SDK", "extend mem-intel-sdk", "add behavior X to the MCP server", or "update the SDK schema." Do NOT use for general behavior pattern recording/recall — use the behavior-memory skill for that.
Guardrails for edits to core/base-client.js covering auth injection, retries, circuit breaker behavior, and request/response events. Use when modifying the universal API client or its auth/retry/error handling.
正在显示 SKILL.md
基于 SOC 职业分类
| name | compliance-manager |
| description | Guardrails for edits to core/security/compliance-manager.js that preserve PCI/GDPR/PSD2/SOX/HIPAA controls (masking, encryption, SCA, consent checks, and audit logging). Use when changing compliance validators, security handling, or audit flows. |
Apply this skill when modifying core/security/compliance-manager.js.
The Compliance Manager provides:
cvv, cvv2, cvc, cvc2, cid, cav2pin, pinBlocktrack1, track2, magneticStripe*.// Must mask showing only first 6 and last 4
maskCardNumber(cardNumber) {
const cleaned = cardNumber.replace(/\D/g, '');
const first6 = cleaned.substring(0, 6);
const last4 = cleaned.substring(cleaned.length - 4);
const masked = '*'.repeat(cleaned.length - 10);
return `${first6}${masked}${last4}`;
}
// Example: 4111111111111111 -> 411111******1111
// Must use AES-256-GCM
encryptSensitiveData(data) {
const algorithm = 'aes-256-gcm'; // Do not change
const key = process.env.ENCRYPTION_KEY;
if (!key) throw new Error('ENCRYPTION_KEY is required');
// 12-byte IV is recommended for GCM
const iv = crypto.randomBytes(12);
// Prefer @onasis/security-sdk for key handling if available
// If ENCRYPTION_KEY is a passphrase, derive a 32-byte key via scrypt.
const keyBuf = (key.length === 64 && /^[0-9a-f]+$/i.test(key))
? Buffer.from(key, 'hex')
: crypto.scryptSync(key, 'onasis-gateway', 32);
const cipher = crypto.createCipheriv('aes-256-gcm', keyBuf, iv);
cipher.setAAD(Buffer.from('compliance-encryption'));
const plaintext = typeof data === 'string' ? data : JSON.stringify(data);
const ciphertext = Buffer.concat([cipher.update(plaintext, 'utf8'), cipher.final()]);
const authTag = cipher.getAuthTag();
return {
encrypted: ciphertext.toString('base64'),
iv: iv.toString('hex'),
authTag: authTag.toString('hex'),
algorithm
};
}
// Must require 2+ factors
validateSCA(data) {
const factors = [];
if (data.password || data.pin) factors.push('knowledge');
if (data.deviceId || data.token) factors.push('possession');
if (data.biometric || data.fingerprint) factors.push('inherence');
return factors.length >= 2; // PSD2 requirement
}
// Must apply all applicable protections
enforceDataHandling(serviceId, data, operation) {
let processedData = { ...data };
if (service?.compliance?.pci) {
processedData = this.applyPCIProtections(processedData, operation);
}
if (service?.compliance?.gdpr) {
processedData = this.applyGDPRProtections(processedData, operation);
}
if (service?.compliance?.psd2) {
processedData = this.applyPSD2Protections(processedData, operation);
}
return processedData;
}
// Must create audit entry for all compliance events
logAuditEntry(action, details) {
const entry = {
timestamp: new Date(),
action,
details,
id: crypto.randomUUID()
};
this.auditLog.push(entry);
this.emit('audit:logged', entry);
this.persistAuditEntry(entry); // Must persist
}
| Field | Regulation | Storage | Logging | Transmission |
|---|---|---|---|---|
| cvv, cvv2, cvc, cvc2 | PCI-DSS 3.2 | Never | Never | HTTPS only |
| pin, pinBlock | PCI-DSS 3.4 | Never | Never | Encrypted |
| track1, track2 | PCI-DSS 3.2 | Never | Never | Never |
| magneticStripe | PCI-DSS 3.2 | Never | Never | Never |
| Full card number | PCI-DSS 3.4 | Encrypted | Masked | Encrypted |
| Component | Integration Method |
|---|---|
| Base Client | Data passed through enforceDataHandling() |
| Metrics Collector | compliance_violations_total metric |
| API Routes | Middleware for request validation |
| Database | Audit entries persisted to audit.compliance_log |
Before deploying changes: