Using Compliance Agent Skills

Using Compliance Agent Skills

Overview

This skill is the routing and orchestration layer for the compliance-agent-skills repository. It teaches the agent how to discover, load, and chain specialized skills without inventing regulatory steps. The repository implements progressive disclosure via Pydantic AI SkillsCapability: only load skills whose scope matches the user's task.

The compliance agent enforces a mandatory PHI redaction gate (redaction.py / Presidio) before any user text reaches the LLM. Skills operate on redacted input; authorized outputs may be deanonymized via the deanonymize_response tool.

Lifecycle commands (user-facing or scripted):

When to Use

Use this skill when:

• The user asks a broad compliance question without naming a framework ("Are we compliant?")
• You need to select among framework skills (HIPAA, PCI-DSS, SOC 2, ISO 27001, NIST CSF, CCPA, FedRAMP, SOX, CMMC, GLBA)
• Configuring MCP servers (Playwright, Postgres, Slack, Presidio) for an audit run
• Starting a new engagement and defining scope before deep work
• Chaining skills (e.g., scope → PHI redaction → PCI script audit → evidence bundle)
• The user references presets or lifecycle commands (/scope, /audit, etc.)

Do not use this skill when:

• The task maps cleanly to one specialized skill (load it directly)
• The user needs only PHI redaction configuration (use hipaa-phi-redaction-pipeline)
• The task is pure third-party vendor review (use hipaa-baa-vendor-assessment or vendor-third-party-risk)

Core Process

Execute the following steps in order for every new engagement.

Step 1: Intake and framework detection

1. Parse the user request for:
   • Framework signals: HIPAA (PHI, BAA), PCI-DSS (CDE, PAN, scripts), SOC 2 (TSC), ISO 27001 (Annex A, SoA), NIST CSF (Govern/Identify/Protect), CCPA/CPRA (DSAR, opt-out), FedRAMP (SSP, 800-53), SOX (ITGC, 404), CMMC (CUI, 800-171), GLBA (NPI, Safeguards)
   • Artifact type: policy review, technical control test, incident, vendor assessment
   • Environment: production vs staging, cloud provider, MCP availability
2. If multiple frameworks apply, list them explicitly and propose a sequenced plan (scope first, then deepest-risk skill).
3. Record engagement metadata: UTC timestamp, auditor/run ID, target systems, authorization to scan.

Step 2: Scope definition (/scope)

1. Document in-scope:
   • Systems, URLs, databases, MCP servers, identity providers
   • Data classifications (ePHI, CHD/SAD, confidential processing data)
   • Applicable regulations and TSC categories
2. Document out-of-scope with rationale (reduces audit creep and false positives).
3. Identify blocking dependencies: missing BAA, no scan authorization, Playwright MCP offline.
4. Emit a scope artifact: scope-{engagement-id}.json with version and approver field.

Step 3: Skill routing matrix

Load exactly one primary skill per audit thread; add secondary skills only when scope requires:

4. Call load_skill for the primary skill and follow its Core Process verbatim.

Step 4: MCP preset configuration

Before /audit, confirm MCP servers required by the loaded skill:

If a required MCP is unavailable, stop and document a blocking finding—do not substitute undocumented tools.

Step 5: Execute audit (/audit)

1. Ensure upstream PHI redaction ran (agent default in agent.py).
2. Execute the loaded skill's Core Process without skipping steps.
3. Log each step completion with artifact IDs in UTC.

Step 6: Evidence packaging (/evidence)

1. Collect artifacts from all executed skills.
2. Apply SHA-256 to each file; record in manifest.
3. Store with immutable audit ID suitable for QSA or SOC 2 auditor review.
4. Cross-reference controls to evidence items (control ID → artifact path → hash).

Step 7: Remediation (/remediate)

1. For each FAIL or UNKNOWN finding, draft:
   • Root cause, compensating controls (if any), remediation owner, target date
   • Residual risk if deferred
2. Prioritize by regulatory severity (e.g., PCI IOC, HIPAA transmission gap, SOC 2 CC6.1 MFA gap).

Step 8: Report (/report)

1. Produce:
   • Executive summary: scope, frameworks, pass/fail counts, top risks
   • Technical appendix: control-by-control status with evidence links
   • Open items: remediation backlog with owners
2. Deanonymize only for authorized recipients via deanonymize_response; never include raw PHI in reports sent to unapproved channels.

Common Rationalizations

Red Flags

• Engagement proceeds without documented scope or scan authorization
• User text bypasses PHI redaction before reaching the model
• Agent invents control IDs or regulatory citations not in loaded skills
• Primary skill skipped in favor of generic advice
• Evidence bundle missing hashes or UTC timestamps
• Deanonymized PHI appears in Slack or unencrypted channels
• PCI IOC or breach indicators routed to /report without /remediate and incident skills

Verification

Do not mark this skill complete until all exit criteria are confirmed:

• Framework(s) identified and documented in scope artifact
• /scope completed with in-scope/out-of-scope systems and data classifications
• Primary skill selected via routing matrix and loaded successfully
• Required MCP servers confirmed available or blocking finding recorded
• PHI redaction gate confirmed active for all user-provided text
• Loaded skill's Core Process executed (not abbreviated)
• /evidence manifest includes SHA-256 for every artifact
• FAIL/UNKNOWN findings have remediation entries with owners and dates
• /report delivered with executive summary and evidence cross-reference
• Deanonymization applied only where authorization is documented