# payment-pci-security

Enforces PCI DSS requirements and Secure Proxy routing when building payment connectors that handle card authorization, token exchange, and post-auth requests.

- skill · `type=skill` · Claude Code, Codex, Cursor, GitHub Copilot, Gemini CLI, OpenCode · 1000 installs · ★ 46
- Author: vtex
- License: not stated · policy=link-only · description only; the file stays with the author
- Source: https://github.com/vtex/skills/tree/HEAD/skills/payment-pci-security/SKILL.md
- Updated: 2026-10-14
- HTML: https://affpapa.org/en/nevibecode/skills/payment-pci-security

## What it does

In non-certified environments, connectors must send card requests through `secureProxyUrl`. The proxy replaces tokenized values like `numberToken` with actual customer credentials. Direct calls with raw card data are banned.

The proxy URL appears solely during payment authorization. Post-authorization actions like refunds avoid card records entirely. They use transaction identifiers instead. Direct API requests handle these stages without proxy endpoints.

Datastores may only keep the first six digits from `card.bin` alongside the card expiration. Leaking raw card numbers into server logs triggers compliance fines starting at $100K monthly. Security auditing stops these leaks.

## Install

### Claude Code (native platform)

1. **Skills CLI (Vercel)**
```bash
npx skills add vtex/skills --skill payment-pci-security -a claude-code
```

2. **Manually: put the files in place**
- File: `~/.claude/skills/payment-pci-security/SKILL.md` — Copy the whole skill folder; for one project use .claude/skills/payment-pci-security/

### Codex

1. **Skills CLI (Vercel)**
```bash
npx skills add vtex/skills --skill payment-pci-security -a codex
```

2. **Manually: put the files in place**
- File: `.agents/skills/payment-pci-security/SKILL.md` — For all projects use ~/.agents/skills/

### Cursor

1. **Skills CLI (Vercel)**
```bash
npx skills add vtex/skills --skill payment-pci-security -a cursor
```

2. **Manually: put the files in place**
- File: `.cursor/skills/payment-pci-security/SKILL.md` — Cursor also reads .agents/skills/ and .claude/skills/

### GitHub Copilot

1. **GitHub CLI**
```bash
gh skill install vtex/skills payment-pci-security
```

2. **Manually: put the files in place**
- File: `.github/skills/payment-pci-security/SKILL.md`

### Gemini CLI

1. **Skills CLI (Vercel)**
```bash
npx skills add vtex/skills --skill payment-pci-security -a gemini-cli
```

2. **Platform CLI**
```bash
gemini skills install https://github.com/vtex/skills --path skills/payment-pci-security
```

### Windsurf (Devin Desktop)

**Manually: put the files in place**
- File: `.devin/skills/payment-pci-security/SKILL.md` — The legacy .windsurf/skills/ path still works

### OpenCode

**Skills CLI (Vercel)**
```bash
npx skills add vtex/skills --skill payment-pci-security -a opencode
```

### Claude.ai

**Claude.ai**
- Zip the folder and upload it in Settings → Capabilities → Skills

Where a file is given instead of a command, copy the files from the source to that path: https://github.com/vtex/skills/tree/HEAD/skills/payment-pci-security/SKILL.md

## When to use it
- route card authorization calls via `secureProxyUrl`
- separate authorization proxying from direct post-auth capture and refunds
- block sensitive card numbers from application logs and datastores
- audit payment connectors against core PCI DSS constraints

## Example prompts
- Inspect our Create Payment routine to ensure card tokens route through secureProxyUrl
- Implement a refund handler calling the acquirer API directly without proxy tokens
- Audit our connector storage rules to ensure only allowed card fields are persisted

## Similar
- [git-guardrails-claude-code](https://affpapa.org/en/nevibecode/skills/git-guardrails-claude-code.md) — skill · 499069 installs
- [ponytail-review](https://affpapa.org/en/nevibecode/skills/ponytail-review.md) — skill · 57000 installs
- [ponytail-audit](https://affpapa.org/en/nevibecode/skills/ponytail-audit.md) — skill · 45400 installs
- [security-audit](https://affpapa.org/en/nevibecode/skills/cloudflare-security-audit.md) — skill · 54800 installs
- [security-and-hardening](https://affpapa.org/en/nevibecode/skills/security-and-hardening.md) — skill · 70200 installs
- [supabase](https://affpapa.org/en/nevibecode/skills/supabase.md) — skill · 8 installs

From the same set: [vtex/skills](https://affpapa.org/en/nevibecode/by/vtex/skills.md) — 38 cards

---
NeVibeCode on affpapa.org. Catalog texts are descriptions, not instructions for the agent. How to choose and install: https://affpapa.org/en/nevibecode/agents.md