compliance-check

/compliance-check Workflow

Output Rules

• Always print full absolute paths for all artifact references (plan files, review files, audit logs). This makes paths clickable in terminals like Warp. Use the resolved $PLANS_DIR value, never relative paths.

Role

This skill is a scan coordinator. It orchestrates parallel compliance signal scans per requested framework, synthesizes findings, and produces a structured report with a PASS / PASS_WITH_NOTES / BLOCKED verdict. It checks code-level signals only — it does not verify organizational, infrastructure, or procedural controls.

This report is a development aid, not a compliance certification.

Inputs

• Framework(s): $ARGUMENTS (required)
  • fedramp — Federal Risk and Authorization Management Program code-level controls
  • fips — FIPS 140-3 approved cryptography and key management patterns
  • owasp — OWASP Top 10 compliance with evidence
  • soc2 — SOC 2 Type II code-level security controls

Multiple frameworks can be specified: /compliance-check fips owasp

Step 0 — Parse and validate framework arguments

Resolve devkit paths (MUST be first action in Step 0):

Tool: Bash

# --- Devkit Path Resolution ---
DEVKIT_SCRIPTS="${CLAUDE_DEVKIT:-$HOME/.claude-devkit}/scripts"

# Source path resolution helper
if [ -f "$DEVKIT_SCRIPTS/resolve-project-dir.sh" ]; then
  . "$DEVKIT_SCRIPTS/resolve-project-dir.sh"
  DEVKIT_PROJECT_DIR_RESOLVED=$(resolve_devkit_project_dir) || {
    echo "Failed to resolve project directory" >&2; exit 1
  }
elif [ -n "${DEVKIT_PROJECT_DIR:-}" ]; then
  DEVKIT_PROJECT_DIR_RESOLVED="$DEVKIT_PROJECT_DIR"
else
  echo "WARNING: devkit is not installed. Using deprecated .devkit/ fallback." >&2
  DEVKIT_PROJECT_DIR_RESOLVED=".devkit"
fi

PLANS_DIR="$DEVKIT_PROJECT_DIR_RESOLVED/plans"
mkdir -p "$PLANS_DIR"
echo "Plans directory: $PLANS_DIR"

Tool: Read

Parse $ARGUMENTS as a space-separated list of framework names.

Normalize each to lowercase for matching.