pci-dss-scoping — Claude Code skill: PCI DSS scoping
Walks an agent through PCI DSS scoping: cardholder data flows, segmentation checks and a v4.0 requirements matrix. Built for audit prep.
npx skills add securityskills/skills --skill pci-dss-scoping -a claude-codeWhat pci-dss-scoping does
The skill runs through five steps. First it traces the payment path end to end — capture, transmission, processing, storage, destruction — and hunts for PAN in databases, logs, backups, ticket systems and dev environments. Then it defines the CDE: every system that stores, processes or transmits cardholder data, plus connected services such as AD, DNS, NTP and monitoring.
Segmentation gets its own section. The skill asks you to document the controls and calls the segmentation penetration test mandatory under v4.0, verifying boundaries from out-of-scope zones in both directions. Skip segmentation and the whole network becomes the CDE, which usually costs more.
After that comes requirements mapping for v4.0: network controls, stored data protection, cryptography in transit, MFA for CDE access, logging, and targeted risk analysis for check frequencies. Output is data-flow diagrams, a scope document with in/out justification, a segmentation test plan and an evidence matrix. It prepares the paperwork — the assessor still signs off.
What it helps with
- trace PAN from capture to destruction
- find cardholder data hiding in logs and backups
- prove segmentation between the CDE and the rest of the network
- map PCI DSS v4.0 requirements to evidence
- assemble an evidence matrix for an assessment
Example prompts for the agent
- Scope our payment service for PCI DSS: trace the cardholder data flows and define the CDE
- Check our segmentation — what do we need to prove to keep the dev zone out of scope?
- Build the v4.0 requirements and evidence matrix for our assessment
How to install pci-dss-scoping
1Skills CLI (Vercel)
npx skills add securityskills/skills --skill pci-dss-scoping -a claude-code2Manually: put the files in place
~/.claude/skills/pci-dss-scoping/SKILL.mdCopy the whole skill folder; for one project use .claude/skills/pci-dss-scoping/
1Skills CLI (Vercel)
npx skills add securityskills/skills --skill pci-dss-scoping -a codex2Manually: put the files in place
.agents/skills/pci-dss-scoping/SKILL.mdFor all projects use ~/.agents/skills/
1Skills CLI (Vercel)
npx skills add securityskills/skills --skill pci-dss-scoping -a cursor2Manually: put the files in place
.cursor/skills/pci-dss-scoping/SKILL.mdCursor also reads .agents/skills/ and .claude/skills/
1GitHub CLI
gh skill install securityskills/skills pci-dss-scoping2Manually: put the files in place
.github/skills/pci-dss-scoping/SKILL.md1Skills CLI (Vercel)
npx skills add securityskills/skills --skill pci-dss-scoping -a gemini-cli2Platform CLI
gemini skills install https://github.com/securityskills/skills --path compliance/pci-dss/pci-dss-scopingManually: put the files in place
.devin/skills/pci-dss-scoping/SKILL.mdThe legacy .windsurf/skills/ path still works
Skills CLI (Vercel)
npx skills add securityskills/skills --skill pci-dss-scoping -a opencodeClaude.ai
Zip the folder and upload it in Settings → Capabilities → Skills
Step by step, with commands for each platform: How to install skills in Claude Code: five ways
Questions about pci-dss-scoping
How do I install pci-dss-scoping in Claude?
Run npx skills add securityskills/skills --skill pci-dss-scoping -a claude-code. The skill lands in ~/.claude/skills/pci-dss-scoping/SKILL.md.
What does pci-dss-scoping do?
It guides an agent through PCI DSS scoping: finding cardholder data, defining the CDE, validating segmentation, mapping v4.0 requirements and preparing evidence.
Is the segmentation penetration test required?
The skill calls it mandatory for PCI DSS v4.0, run from out-of-scope zones and in both directions.
