pci-compliance Skill for Claude: What It Does and How to Install It

Makes Claude apply PCI DSS rules when it writes payment code: what card data never to store, tokenization and encryption.

Installs: 10.8K; on skills.sh
Stars: 42.1K; on GitHub
Files: 1; besides SKILL.md
Updated: Oct 2026; last repo commit

This skill is a PCI DSS guide for Claude, from wshobson's agents collection. SKILL.md lists the 12 core requirements and four compliance levels by yearly transaction volume. It states which card data must never be stored (full track data, CVV, PIN) and shows tokenization, a token vault, AES-256-GCM encryption and HTTPS settings in Python.

references/details.md adds access control, audit logging, input validation, three self-assessment questionnaire types (SAQ A, A-EP and D) and a compliance checklist. It loads when you build payment systems, handle card data, reduce PCI scope or prepare for an assessment.

Good for

Developers building payment flows
Engineers preparing for a PCI DSS assessment
Teams trying to reduce their PCI scope
Security reviewers checking how card data is handled

Install pci-compliance

Claude Code

Copy this prompt.

Install the pci-compliance skill in Claude Code. Run this command:

/plugin marketplace add wshobson/agents
/plugin install payment-processing@claude-code-workflows

Then check that it loaded and tell me how to use it.

2
Paste it into Claude Code. It shows the change and asks before running it.

Pick one route. The plugin routes install the whole payment-processing plugin: 1 agent and 4 skills (counted from the plugin folder in the repo tree, which has no hooks or MCP config files). The skills-only routes install just this skill, with no agents or commands. The skill's code examples are in Python and use the stripe and cryptography packages.

From the project README. Source.

What's in the skill

When it loads

Implement PCI DSS compliance requirements for secure handling of payment card data and payment systems. Use when securing payment processing, achieving PCI compliance, or implementing payment card security measures.

Sections in SKILL.md

When to Use This Skill
PCI DSS Requirements (12 Core Requirements)
Build and Maintain Secure Network
Protect Cardholder Data
Maintain Vulnerability Management
Implement Strong Access Control
Monitor and Test Networks
Maintain Information Security Policy
Compliance Levels
Data Minimization (Never Store)
Tokenization
Using Payment Processor Tokens
Custom Tokenization (Advanced)
Encryption
Data at Rest
Data in Transit

Key facts

Author: wshobson (repo owner)
License: MIT
Installs on skills.sh: 10,764 (Nov 2, 2026)
GitHub stars: 42,081 for the whole wshobson/agents repo (Nov 2, 2026)
Last repo commit: Oct 30, 2026
What it includes: 2 files including SKILL.md: references/details.md (no scripts)
Needs: Python for the code examples. They import stripe and cryptography, and one uses Flask
Part of: The payment-processing plugin (version 1.2.3) in wshobson/agents. Counted from the plugin folder: 1 agent and 4 skills
Works in: Claude Code, Codex CLI, Cursor, OpenCode, Antigravity CLI, GitHub Copilot and Pi, per the README. Skills-only installers ask which tool you use

What it includes

PCI DSS requirements grouped in six goals
Lists all 12 requirements, from firewall configuration to an information security policy.
Read · The 12 core requirements
Four merchant levels by transactions per year
Level 1 is over 6 million transactions a year and needs an annual ROC. Level 2 is 1 to 6 million with an annual SAQ.
Read · Compliance levels
Never store track data, CVV or PIN; log masking
A Python example that masks card numbers in logs and raises an error if prohibited fields are stored.
Try: “Review this checkout code for card data we should not store.”
Write · Data minimization
Use processor tokens so the server never sees card numbers
An example that charges with a token through stripe.Charge.create and saves a customer payment method as a token.
Write · Tokenization with Stripe
A Fernet-based vault for card data you must keep
An in-memory example. A code comment says to use an encrypted database in production.
Write · Custom token vault
AES-256-GCM storage class
Encrypts and decrypts values with a random nonce and a 32-byte key.
Write · Encryption at rest
TLS 1.2 or higher with secure cookies and Flask-Talisman
Sets secure, HTTP-only and strict same-site cookies, and forces HTTPS.
Write · Encryption in transit
A Flask decorator that requires a pci_access role
Returns 403 for users without the role and writes an audit log entry for each access attempt.
Write · Access control (details.md)
A PCIAuditLogger class for access and sign-in events
Logs time, user, resource, action, result and IP address as JSON, with a comment to write to a secure, append-only log.
Write · Audit logging (details.md)
Card number format check and input sanitizing
Includes a Luhn checksum function and a sanitize_input function.
Write · Input validation (details.md)
SAQ A, A-EP and D, and a compliance checklist (details.md)
Describes the three questionnaires and a checklist grouped by network security, data protection and more.
Read · SAQ types and checklist

From the official docs

Permissions

Medium risk

What it can do

Read your data
Create and change things
Delete things
Read-only mode

Watch out for

Examples set a Stripe secret key inline
The tokenization example sets stripe.api_key to a placeholder in code. Load real keys from an environment variable or secrets manager and never paste them into chat. github.com
The Stripe example can create charges
charge_with_token calls stripe.Charge.create with an amount in usd and a token. It charges the Stripe account whose key you set, so test with Stripe test keys first. github.com
The token vault example keeps data in memory
TokenVault stores encrypted card data in a Python dict, and a code comment says to use an encrypted database in production. github.com
The plugin route installs more than this skill
The payment-processing plugin has 1 agent and 4 skills. We found no hooks or MCP config files in its folder. The skills-only routes install only this skill. github.com

Security advisories

No published security advisories as of Nov 2, 2026.

Technical details

Turning on read-only	No read-only mode. Use version control.
Talks to	Stripe API, if you run the Stripe example
Sign-in and keys	SKILL.md does not mention any account. The Stripe example sets stripe.api_key inline to a placeholder.
Scopes	Claude can write payment-handling code in your project when you ask The Stripe example calls stripe.Charge.create and stripe.Customer.modify when run with a real key The token vault and encryption examples handle card numbers in code

Questions

What does the pci-compliance skill do?

It gives Claude a PCI DSS playbook for payment code. Claude uses it to avoid storing prohibited card data, use tokens, encrypt what must be stored and prepare for an assessment.

How do I install pci-compliance?

Use the install box at the top of this page. Pick a skills-only route to get just this skill, or the plugin route to get the whole payment-processing plugin.

Is this skill from Anthropic?

No. It is in wshobson/agents, a community collection. The skill sits in the payment-processing plugin there.

Does it make my app PCI compliant?

No. It is a guide for Claude, not an assessment or a certificate. SKILL.md lists the requirements and examples, and the SAQ section in details.md describes the questionnaires you complete.

Does it charge cards?

Its Stripe example would, if you ran it with a real secret key. It uses stripe.Charge.create with an amount and a token, and the key in the example is a placeholder (sk_...). The skill itself bundles no scripts.

Does it work in the Claude app?

The install box has no Claude app upload for it, because the skill is built around Python code that runs in your own project. Use Claude Code or Codex. The README also lists Cursor, OpenCode, Antigravity CLI, GitHub Copilot and Pi.

Is it safe?

It bundles no scripts: just SKILL.md and one reference file. When you ask for code, Claude writes it in your project. Keep real Stripe keys and card numbers out of the chat and out of code (our advice).

Information

updated Nov 2, 2026

Repository: wshobson/agents
Folder: plugins/payment-processing/skills/pci-compliance

wshobson/agents skills.sh

Sources

Docs, issue trackers and discussions this page is built from.

Show all 4

pci-compliance SKILL.md · github.com
wshobson/agents README · github.com
payment-processing plugin.json · github.com
pci-compliance references/details.md · github.com