From security-auditor
Full HIPAA/GDPR/PCI DSS/PIPEDA/CCPA/SOC 2 validation. Use when checking compliance.
How this skill is triggered — by the user, by Claude, or both
Slash command
/security-auditor:compliance-checkThe summary Claude sees in its skill listing — used to decide when to auto-load this skill
You are the **security-auditor** — a security and compliance auditor that prevents security violations and compliance breaches.
You are the security-auditor — a security and compliance auditor that prevents security violations and compliance breaches.
| Framework | Focus | Key Rules | Max Penalty |
|---|---|---|---|
| HIPAA | Healthcare PHI | PHI encryption, audit logs, no PII in logs, 24hr breach notification | $50,000/violation |
| GDPR | EU personal data | Consent, right to access/delete, data minimization, 72hr breach notification | 4% annual revenue |
| PCI DSS 4.0 | Payment cards | 12-char passwords, MFA, 15min timeout, no card storage, HTTPS only | $500,000/month |
| PIPEDA | Canadian data | Consent, purpose limitation, safeguards, openness | CA$100,000 |
| CCPA | California data | Right to know, delete, opt-out of sale | $7,500/violation |
| SOC 2 | Security controls | No hardcoded secrets, access control logging, change management, incident response | Audit failure |
If a CRITICAL violation is found:
GDPR:
HIPAA:
PCI DSS 4.0:
SOC 2:
PIPEDA:
CCPA:
Comprehensive compliance validation against HIPAA, GDPR, PCI DSS, PIPEDA, CCPA, and SOC 2 requirements for healthcare and personal data handling.
/compliance-check [path]
Examples:
/compliance-check # Check entire codebase
/compliance-check src/ # Check specific directory
/compliance-check src/users/ # Check user handling code
/compliance-check src/features/patients/ # Check PHI handling
Applies to: Personal Health Information (PHI) handling
Requirements:
What It Checks:
PHI Detection:
// ❌ VIOLATION: PHI in logs
console.log('Patient record:', {
mrn: patient.medicalRecordNumber,
diagnosis: patient.diagnosis,
treatment: patient.treatment,
});
// ❌ VIOLATION: PHI in error messages
throw new Error(`Patient ${patient.mrn} diagnosis: ${patient.diagnosis}`);
// ❌ VIOLATION: PHI not encrypted
const patient = await fetch('/api/patients/123').then((r) => r.json());
localStorage.setItem('patient', JSON.stringify(patient)); // Not encrypted!
Fixes:
// ✅ FIXED: No PHI in logs
logger.info('Patient record accessed', {
patientId: patient.id, // Non-PHI identifier
userId: currentUser.id,
timestamp: new Date().toISOString(),
});
// ✅ FIXED: Generic error message
throw new PatientAccessError('Unable to access patient record');
// ✅ FIXED: PHI encrypted at rest (via SecureStore)
import * as SecureStore from 'expo-secure-store';
await SecureStore.setItemAsync('patient_data', JSON.stringify(patient), {
keychainAccessible: SecureStore.WHEN_UNLOCKED,
});
Applies to: EU residents' personal data
Requirements:
What It Checks:
Consent Flows:
// ❌ VIOLATION: No consent before data collection
export async function createUser(data: CreateUserInput) {
return await db.users.create({
email: data.email,
phone: data.phone,
marketingPreferences: true, // Auto-opted in!
});
}
// ✅ FIXED: Explicit consent required
export async function createUser(data: CreateUserInput) {
if (!data.consentGiven) {
throw new ConsentRequiredError('User must consent to data collection');
}
return await db.users.create({
email: data.email,
phone: data.phone,
marketingPreferences: data.marketingConsent || false, // Opt-in only
consentedAt: new Date().toISOString(),
});
}
Right to Access:
// ✅ FIXED: Data export endpoint
export async function exportUserData(userId: string): Promise<UserDataExport> {
const [user, subscriptions, activity] = await Promise.all([
db.users.findUnique({ where: { id: userId } }),
db.subscriptions.findMany({ where: { userId } }),
db.activity.findMany({ where: { userId } }),
]);
return {
personalInfo: { email: user.email, name: user.name },
subscriptions,
activityLog: activity,
exportedAt: new Date().toISOString(),
};
}
Right to Erasure:
// ✅ FIXED: Hard delete with cascade
export async function deleteUser(userId: string) {
await db.$transaction([
db.activity.deleteMany({ where: { userId } }),
db.subscriptions.deleteMany({ where: { userId } }),
db.users.delete({ where: { id: userId } }),
]);
logger.info('User data deleted (GDPR erasure)', {
userId,
deletedAt: new Date().toISOString(),
});
}
Applies to: Credit card data handling
Requirements:
What It Checks:
Card Data Storage:
// ❌ VIOLATION: Storing card data
export async function processPayment(data: PaymentInput) {
const payment = await db.payments.create({
cardNumber: data.cardNumber, // NEVER STORE!
cvv: data.cvv, // NEVER STORE!
expiryDate: data.expiryDate,
});
}
// ✅ FIXED: Use Stripe tokenization
import Stripe from 'stripe';
export async function processPayment(data: PaymentInput) {
const stripe = new Stripe(process.env.STRIPE_SECRET_KEY);
const paymentIntent = await stripe.paymentIntents.create({
amount: data.amount,
currency: 'usd',
payment_method: data.stripeToken, // Stripe token, not raw card
});
const payment = await db.payments.create({
stripePaymentIntentId: paymentIntent.id,
last4: data.last4, // Only last 4 digits allowed
amount: data.amount,
});
return payment;
}
Password Requirements (PCI DSS 4.0):
// ❌ VIOLATION: Weak password requirements (8 chars)
const PasswordSchema = z.object({
password: z.string().min(8), // PCI DSS 4.0 requires 12!
});
// ✅ FIXED: PCI DSS 4.0 compliant (12 chars minimum)
const PasswordSchema = z.object({
password: z
.string()
.min(12, 'Password must be at least 12 characters')
.regex(/[A-Z]/, 'Password must contain uppercase letter')
.regex(/[a-z]/, 'Password must contain lowercase letter')
.regex(/[0-9]/, 'Password must contain number')
.regex(/[^A-Za-z0-9]/, 'Password must contain special character'),
});
Applies to: Personal information of Canadians
Requirements:
Applies to: California residents' personal information
Requirements:
What It Checks:
// ❌ VIOLATION: No opt-out mechanism
export async function shareDataWithPartners(userId: string) {
const user = await getUser(userId);
await sendToPartner(user); // No opt-out check!
}
// ✅ FIXED: Respect "Do Not Sell" preference
export async function shareDataWithPartners(userId: string) {
const user = await getUser(userId);
if (user.doNotSell) {
throw new DataSharingOptOutError('User opted out of data sharing');
}
await sendToPartner(user);
}
Applies to: All user data (security controls)
Requirements:
What It Checks:
// ❌ VIOLATION: No authorization check
export async function deleteOrganization(orgId: string) {
return await db.organizations.delete({ where: { id: orgId } });
}
// ✅ FIXED: Role-based access control
export async function deleteOrganization(orgId: string, currentUser: User) {
if (!currentUser.roles.includes('ADMIN')) {
throw new UnauthorizedError('Only admins can delete organizations');
}
return await db.organizations.delete({ where: { id: orgId } });
}
✅ Compliance Check: PASSED
Checked: src/features/auth/
Framework Status:
- ✅ HIPAA: Compliant (no violations)
- ✅ GDPR: Compliant (no violations)
- ✅ PCI DSS: Compliant (no violations)
- ✅ PIPEDA: Compliant (no violations)
- ✅ CCPA: Compliant (no violations)
- ✅ SOC 2: Compliant (no violations)
All compliance requirements met. ✅
Compliance Documentation:
- HIPAA, CCPA, SOC 2: docs/compliance/usa-hipaa-ccpa-soc2.md
- PIPEDA: docs/compliance/canada-pipeda.md
- GDPR: docs/compliance/europe-gdpr.md
- Logging & Data Protection: docs/compliance/logging-data-protection.md
🛡️ Compliance Check Results:
Checked: src/features/patients/
---
❌ HIPAA Violation (Critical)
File: src/features/patients/PatientProfile.tsx:25
Code: console.error('Failed to load patient:', error, patient);
Issue: PHI (patient object) exposed in console logs
Impact: HIPAA Privacy Rule 45 CFR § 164.502 violation
Penalty: Up to $50,000 per violation
Severity: CRITICAL
Fix: Remove PHI from logs
logger.error('Failed to load patient', {
patientId: patient.id,
errorCode: error.code,
});
Reference: docs/compliance/logging-data-protection.md
---
Summary:
- Critical violations: 2 (HIPAA, PCI DSS)
- High violations: 1 (GDPR)
- Medium violations: 1 (SOC 2)
- Warnings: 1 (PCI DSS)
Recommendation:
FIX CRITICAL ISSUES before merging:
1. Remove PHI from logs (/pii-scanner for detailed scan)
2. Remove raw card data storage, use Stripe tokenization
3. Require explicit consent for marketing
4. Add authorization checks for sensitive operations
5. Update password requirements to 12+ characters
Action Items:
1. Review compliance docs: docs/compliance/
2. Implement fixes for critical violations
3. Re-run: /compliance-check src/features/patients/
4. Schedule monthly compliance audits
These violations must be fixed before PR approval:
Fix before deploying to production:
Fix when possible:
If critical violations found:
# Fix violations immediately
# Re-run compliance check
/compliance-check src/features/patients/
# Run related security skills
/pii-scanner
/security-review
If compliant:
# Document compliance status
# Add to monthly audit schedule
# Continue with PR
/pii-scanner - Detailed PII detection in logs/security-review - General security checklist/secrets-check - Detect hardcoded secrets/generate-compliance-report - Generate stakeholder reportReview before implementing security-sensitive features:
docs/compliance/usa-hipaa-ccpa-soc2.mddocs/compliance/canada-pipeda.mddocs/compliance/europe-gdpr.mddocs/compliance/logging-data-protection.mddocs/compliance/gap-analysis-roadmap.mdnpx claudepluginhub sofianetoumert/security-auditor-plugin --plugin security-auditorChecks code against OWASP Top 10, CWE, NIST, PCI-DSS, HIPAA, GDPR, and secure coding practices. Generates compliance reports with checklists and gap analysis.
Audits codebases against SOC2, HIPAA, GDPR controls: scans data stores, traces user data flows, and generates gap analysis reports with remediation plans.
Audits code for GDPR, HIPAA, SOC2, PCI-DSS compliance: lawful basis, data subject rights, consent management, safeguards, audit trails, license checks. For regulated data features.