Compliance Skill

Analyze code and systems for regulatory compliance.

Runtime

Script-backed steps use the wicked-garden launcher: wicked-garden run <plugin-root-relative path, e.g. scripts/…> [args]. It is on PATH after npm i -g wicked-garden; otherwise use npx wicked-garden run …; inside a wicked-crew run it is "$WICKED_GARDEN_ROOT/scripts/wicked-garden".
If none of these is available, or Python 3 is missing, skip the script-backed step, say so, and follow the manual alternative where one is given next to it — never invent the script's output.
Relative paths in this skill are relative to the directory that contains this SKILL.md.

When to Use

• Code handles sensitive data (PII, PHI, payment data)
• Pre-deployment compliance verification
• User mentions regulatory frameworks
• User says "is this compliant", "compliance check", "regulatory requirements"

Supported Frameworks

Framework	Focus	Key Requirements
SOC2	Security, Availability	Access controls, encryption, logging, monitoring
HIPAA	Protected Health Info	PHI safeguards, access logs, encryption, BAA
GDPR	Personal Data	Consent, minimization, deletion, DPO
PCI DSS	Payment Card Data	Encryption, network segmentation, access control

See refs/frameworks.md for detailed framework requirements.

Run it inline (no dispatch)

Invoked as <framework> [path]:

1. Parse args: <framework> [path] (framework = soc2|hipaa|gdpr|pci).
2. Read refs/compliance.md (relative to this skill's base directory) —
   data-classification scan commands, per-framework control matrix
   (SOC2/HIPAA/GDPR/PCI), gap checklist, bus emit, output format.
3. For detailed per-framework checklists:
   Read refs/checklists.md.
   For framework-specific patterns: refs/frameworks.md.
4. Apply the rubric directly: scan for sensitive data, verify each control,
   classify gaps P0/P1/P2, emit the bus event, and produce the compliance
   assessment report.

Analysis Process

1. Identify Sensitive Data

Scan for:

• PII: Names, emails, SSN, addresses
• PHI: Medical records, health data
• Payment: Credit cards, bank accounts
• Credentials: Passwords, API keys

2. Verify Controls

Access Control:

• Authentication required
• Authorization checks (RBAC)
• Least privilege

Data Protection:

• Encryption at rest (AES-256)
• Encryption in transit (TLS 1.2+)
• Secure key management

Logging & Monitoring:

• Access logs
• Audit trails
• Security events
• Log retention

Data Lifecycle:

• Consent mechanisms (GDPR)
• Retention policies
• Secure deletion
• Data minimization

3. Detect Violations

Common issues:

• PII/PHI in logs or errors
• Hardcoded secrets
• Missing encryption
• Insufficient access controls
• Missing audit trails

See refs/checklists.md for detailed verification checklists.

4. Generate Report

Output:

• Status: COMPLIANT / NEEDS ATTENTION / NON-COMPLIANT
• Findings: Violations by priority (P0, P1, P2)
• Evidence: Code references
• Remediation: Required fixes

Integration

With wicked-crew

Auto-triggered at phase gates

With the harness's task list

Append [compliance] {framework}: {status} to the task description — the harness's task list where it has one (the wicked-garden-workflow skill's refs/integration.md carries the field list and the harness-specific Hand-off), else your working notes.

With the memory layer (wicked-estate)

Hand-off — open the wicked-garden-mem skill and run its recall action with compliance {framework} as the query; on Claude Code this is the Skill tool, on any other seat open the named skill from your catalog and carry it out inline, then continue here.

With the platform domain skill

For an ad hoc vulnerability scan of the same target, run the security
action of skills/platform/SKILL.md (real scanners + triage).

Output Format

## Compliance Analysis: {Framework}

**Target**: {scope}
**Status**: {COMPLIANT|NEEDS ATTENTION|NON-COMPLIANT}
**Framework**: {SOC2|HIPAA|GDPR|PCI}

### Critical (P0)
- {violation} - {file}:{line}
  Remediation: {fix}

### High Priority (P1)
- {gap} - {file}:{line}
  Recommendation: {guidance}

### Medium Priority (P2)
- {improvement} - {suggestion}

### Controls Verified
- [x] Encryption at rest
- [ ] Data retention policy

### Next Steps
{Recommended actions}

External Integration Discovery

Compliance checking can leverage available integrations by capability:

Capability	Discovery Patterns	Provides
Security scanning	snyk, semgrep, sast	Vulnerability detection
Secrets	vault, secrets	Credential management audit
SBOM	trivy, sbom, cyclonedx	Supply chain compliance

Discover available integrations via capability detection. When none are available, fall back to manual analysis against the control checklist above.

Quality Standards

Good analysis:

• Specific code references
• Clear violation descriptions
• Actionable remediation
• Prioritized by risk

Bad analysis:

• Generic checklists
• No code evidence
• Vague recommendations