payment-pci-security — Claude Code skill: setup and features
Enforces PCI DSS requirements and Secure Proxy routing when building payment connectors that handle card authorization, token exchange, and post-auth requests.
npx skills add vtex/skills --skill payment-pci-security -a claude-codeWhat payment-pci-security does
In non-certified environments, connectors must send card requests through secureProxyUrl. The proxy replaces tokenized values like numberToken with actual customer credentials. Direct calls with raw card data are banned.
The proxy URL appears solely during payment authorization. Post-authorization actions like refunds avoid card records entirely. They use transaction identifiers instead. Direct API requests handle these stages without proxy endpoints.
Datastores may only keep the first six digits from card.bin alongside the card expiration. Leaking raw card numbers into server logs triggers compliance fines starting at $100K monthly. Security auditing stops these leaks.
What it helps with
- route card authorization calls via
secureProxyUrl - separate authorization proxying from direct post-auth capture and refunds
- block sensitive card numbers from application logs and datastores
- audit payment connectors against core PCI DSS constraints
Example prompts for the agent
- Inspect our Create Payment routine to ensure card tokens route through secureProxyUrl
- Implement a refund handler calling the acquirer API directly without proxy tokens
- Audit our connector storage rules to ensure only allowed card fields are persisted
How to install payment-pci-security
1Skills CLI (Vercel)
npx skills add vtex/skills --skill payment-pci-security -a claude-code2Manually: put the files in place
~/.claude/skills/payment-pci-security/SKILL.mdCopy the whole skill folder; for one project use .claude/skills/payment-pci-security/
1Skills CLI (Vercel)
npx skills add vtex/skills --skill payment-pci-security -a codex2Manually: put the files in place
.agents/skills/payment-pci-security/SKILL.mdFor all projects use ~/.agents/skills/
1Skills CLI (Vercel)
npx skills add vtex/skills --skill payment-pci-security -a cursor2Manually: put the files in place
.cursor/skills/payment-pci-security/SKILL.mdCursor also reads .agents/skills/ and .claude/skills/
1GitHub CLI
gh skill install vtex/skills payment-pci-security2Manually: put the files in place
.github/skills/payment-pci-security/SKILL.md1Skills CLI (Vercel)
npx skills add vtex/skills --skill payment-pci-security -a gemini-cli2Platform CLI
gemini skills install https://github.com/vtex/skills --path skills/payment-pci-securityManually: put the files in place
.devin/skills/payment-pci-security/SKILL.mdThe legacy .windsurf/skills/ path still works
Skills CLI (Vercel)
npx skills add vtex/skills --skill payment-pci-security -a opencodeClaude.ai
Zip the folder and upload it in Settings → Capabilities → Skills
Step by step, with commands for each platform: How to install skills in Claude Code: five ways
Questions about payment-pci-security
How to install payment-pci-security in Claude Code?
Run npx skills add vtex/skills --skill payment-pci-security -a claude-code in your terminal.
What does payment-pci-security do?
It provides architecture rules for payment connectors, ensuring non-certified environments use proxying for tokenized card authorizations and direct calls for subsequent operations.
Can secureProxyUrl be used for settlement or refund calls?
No. The proxy URL is exclusively supplied during authorization. Post-authorization actions carry transaction IDs rather than card numbers, so they communicate directly with provider APIs.
