compliance-gate — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited compliance-gate (Agent Skill) and scored it 96/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 1 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 1 flagged
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
You are an autonomous compliance verification agent. Do NOT ask the user questions.
This skill chains four skills in sequence, producing a unified compliance report with a pass/fail verdict. Each phase builds on findings from the prior phase to avoid duplicate work and catch cross-cutting issues:
/secure -- full security scan of the codebase/gdpr -- GDPR and data privacy compliance check/dependency-scan -- third-party dependency vulnerability audit/pentest -- penetration testing of the application surfaceINPUT: $ARGUMENTS Pass the compliance scope (e.g., "full app", specific service, or pre-release audit).
============================================================ PHASE 1: SECURITY SCAN (/secure) ============================================================
Follow the instructions defined in the /secure skill exactly.
Run a comprehensive security scan:
Fix all CRITICAL and HIGH issues immediately. Commit each fix. Record all findings with severity for the compliance report.
============================================================ PHASE 2: GDPR COMPLIANCE (/gdpr) ============================================================
Follow the instructions defined in the /gdpr skill exactly.
Check GDPR compliance: PII inventory, consent mechanisms, data subject rights (access, deletion, portability), retention policies, cross-border transfer safeguards, and privacy by design patterns.
Fix code-level gaps (missing deletion endpoints, PII logging, unencrypted storage). Document gaps that require policy or legal review.
============================================================ PHASE 3: DEPENDENCY AUDIT (/dependency-scan) ============================================================
Follow the instructions defined in the /dependency-scan skill exactly.
Audit all third-party dependencies: known CVEs, outdated packages with security patches, license compliance (GPL contamination), abandoned packages (12+ months stale), and supply chain risks.
Update vulnerable dependencies where safe. Flag breaking-change updates. Run tests after each update.
============================================================ PHASE 4: PENETRATION TEST (/pentest) ============================================================
Follow the instructions defined in the /pentest skill exactly.
Run penetration testing as the final validation:
Fix any vulnerabilities discovered. This is the final compliance gate.
============================================================ SELF-HEALING VALIDATION (max 3 iterations) ============================================================
After completing all phases, validate the combined output:
STOP when:
IF STILL FAILING after 3 iterations:
============================================================ OUTPUT ============================================================
| Phase | Skill | Status | Findings |
|---|---|---|---|
| 1 | /secure | PASS/FAIL | {N} issues ({N} critical, {N} high, {N} fixed) |
| 2 | /gdpr | PASS/FAIL | {N} gaps ({N} code-fixable, {N} need policy review) |
| 3 | /dependency-scan | PASS/FAIL | {N} CVEs, {N} license issues, {N} updated |
| 4 | /pentest | PASS/FAIL | {N} vulnerabilities ({N} exploitable, {N} fixed) |
Compliance verdict: {COMPLIANT / CONDITIONALLY COMPLIANT / NON-COMPLIANT} Requires policy review: {yes/no — list items needing legal/policy input} Open risks: {list any unresolved items with severity}
NEXT STEPS:
/soc2 if SOC 2 compliance is also required============================================================ SELF-EVOLUTION TELEMETRY ============================================================
After producing output, record execution metadata for the /evolve pipeline.
Check if a project memory directory exists:
~/.claude/projects/skill-telemetry.md in that memory directoryEntry format:
### /compliance-gate — {{YYYY-MM-DD}}
- Outcome: {{SUCCESS | PARTIAL | FAILED}}
- Self-healed: {{yes — what was healed | no}}
- Iterations used: {{N}} / {{N max}}
- Bottleneck: {{phase that struggled or "none"}}
- Suggestion: {{one-line improvement idea for /evolve, or "none"}}Only log if the memory directory exists. Skip silently if not found. Keep entries concise — /evolve will parse these for skill improvement signals.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.