Help us improve
Share bugs, ideas, or general feedback.
From vuln-scout
Maps VulnScout security findings to PCI-DSS v4.0, HIPAA Security Rule, and SOC 2 requirements to assess regulatory impact and prioritize remediation.
npx claudepluginhub allsmog/vuln-scout --plugin whitebox-pentestHow this skill is triggered — by the user, by Claude, or both
Slash command
/vuln-scout:compliance-mappingThe summary Claude sees in its skill listing — used to decide when to auto-load this skill
Map VulnScout security findings to compliance framework requirements. This enables security teams to understand the regulatory impact of discovered vulnerabilities and prioritize remediation based on compliance obligations.
Generates compliance reports for PCI DSS, HIPAA, SOC 2, GDPR, ISO 27001 by scanning codebases and configs for security controls, assessing gaps, and producing audit-ready Markdown.
Checks code against OWASP Top 10, CWE, NIST, PCI-DSS, HIPAA, GDPR, and secure coding practices. Generates compliance reports with checklists and gap analysis.
Scans codebases for compliance-relevant patterns, classifies data sensitivity, audits against SOC2/HIPAA/GDPR controls, and generates gap analysis reports with remediation plans.
Share bugs, ideas, or general feedback.
Map VulnScout security findings to compliance framework requirements. This enables security teams to understand the regulatory impact of discovered vulnerabilities and prioritize remediation based on compliance obligations.
Payment Card Industry Data Security Standard for organizations handling cardholder data.
| Requirement | Description | VulnScout Finding Types |
|---|---|---|
| 6.2.1 | Secure development practices | All code-level findings |
| 6.2.2 | Software security training | Recurring pattern findings |
| 6.2.3 | Code review before release | Unverified findings in diff |
| 6.2.4 | Prevent common vulnerabilities | sql-injection, xss, command-injection, path-traversal |
| 6.3.1 | Identify vulnerabilities via scanning | All findings from /scan |
| 6.3.2 | Maintain inventory of custom software | Framework detection results |
| 6.4.1 | Public-facing web app protection | ssrf, xss, csrf, open-redirect |
| 6.4.2 | Automated technical solution for web attacks | WAF findings, missing CSP |
| 6.5.1-6.5.6 | Address common coding vulnerabilities | Injection, auth bypass, XSS, access control |
Health Insurance Portability and Accountability Act technical safeguards.
| Section | Description | VulnScout Finding Types |
|---|---|---|
| 164.312(a)(1) | Access Control | access-control, idor, business-logic |
| 164.312(a)(2)(i) | Unique User Identification | auth-bypass, session fixation |
| 164.312(a)(2)(iii) | Automatic Logoff | session management findings |
| 164.312(a)(2)(iv) | Encryption at Rest | cryptographic-failures, hardcoded-secret |
| 164.312(b) | Audit Controls | logging-failures |
| 164.312(c)(1) | Integrity Controls | sql-injection, deserialization, ssti |
| 164.312(c)(2) | Authentication of ePHI | auth-bypass, hardcoded-secret |
| 164.312(d) | Person/Entity Authentication | auth-bypass, insecure-randomness |
| 164.312(e)(1) | Transmission Security | cryptographic-failures, ssrf |
| 164.312(e)(2)(i) | Integrity Controls (transmission) | ssti, xss, command-injection |
| 164.312(e)(2)(ii) | Encryption in Transit | cryptographic-failures |
Service Organization Control 2 for SaaS and cloud service providers.
| Criteria | Description | VulnScout Finding Types |
|---|---|---|
| CC6.1 | Logical and Physical Access | access-control, idor, auth-bypass |
| CC6.2 | Credential Management | hardcoded-secret, insecure-randomness |
| CC6.3 | Access Roles and Responsibilities | access-control, business-logic |
| CC6.6 | System Boundary Protection | ssrf, open-redirect, cors-misconfig |
| CC6.7 | Data Flow Restrictions | path-traversal, xxe, deserialization |
| CC6.8 | Malicious Software Prevention | command-injection, code-injection, ssti |
| CC7.1 | System Monitoring | logging-failures, exception-handling |
| CC7.2 | Anomaly Detection | insecure-randomness, race-condition |
| CC7.3 | Security Event Evaluation | logging-failures |
| CC7.4 | Incident Response | All critical/high findings |
| CC8.1 | Change Management | Findings in diff (--since-commit) |
| Function | Category | VulnScout Finding Types |
|---|---|---|
| Identify | ID.AM - Asset Management | Framework detection, scope results |
| Identify | ID.RA - Risk Assessment | Threat model, STRIDE analysis |
| Protect | PR.AC - Access Control | access-control, idor, auth-bypass |
| Protect | PR.DS - Data Security | sql-injection, path-traversal, cryptographic-failures |
| Protect | PR.IP - Protective Processes | All remediated findings |
| Protect | PR.MA - Maintenance | Diff-aware scan results |
| Detect | DE.AE - Anomalies and Events | logging-failures, exception-handling |
| Detect | DE.CM - Continuous Monitoring | /scan --since-commit results |
| Respond | RS.AN - Analysis | Verified findings with evidence |
| Recover | RC.IM - Improvements | Patch advisor recommendations |
| Finding Type | PCI-DSS | HIPAA | SOC 2 | NIST CSF |
|---|---|---|---|---|
| sql-injection | 6.2.4, 6.5.1 | 164.312(c)(1) | CC6.8 | PR.DS |
| xss | 6.2.4, 6.4.1 | 164.312(e)(2)(i) | CC6.8 | PR.DS |
| command-injection | 6.2.4 | 164.312(e)(2)(i) | CC6.8 | PR.DS |
| path-traversal | 6.2.4 | 164.312(a)(1) | CC6.7 | PR.DS |
| ssrf | 6.4.1 | 164.312(e)(1) | CC6.6 | PR.DS |
| deserialization | 6.2.4 | 164.312(c)(1) | CC6.7 | PR.DS |
| ssti | 6.2.4 | 164.312(c)(1) | CC6.8 | PR.DS |
| xxe | 6.2.4 | 164.312(c)(1) | CC6.7 | PR.DS |
| access-control | 6.5.4 | 164.312(a)(1) | CC6.1 | PR.AC |
| auth-bypass | 6.5.3 | 164.312(d) | CC6.1 | PR.AC |
| hardcoded-secret | 6.2.4 | 164.312(a)(2)(iv) | CC6.2 | PR.AC |
| cryptographic-failures | 6.2.4 | 164.312(e)(2)(ii) | CC6.2 | PR.DS |
| logging-failures | 6.2.4 | 164.312(b) | CC7.1 | DE.AE |
| insecure-randomness | 6.2.4 | 164.312(d) | CC7.2 | PR.DS |
| idor | 6.5.4 | 164.312(a)(1) | CC6.1 | PR.AC |
| ldap-injection | 6.2.4, 6.5.1 | 164.312(c)(1) | CC6.8 | PR.DS |
When generating a compliance-aware report, use the --compliance flag:
/whitebox-pentest:report --compliance pci-dss,hipaa,soc2
This appends a Compliance Impact section to the report:
## Compliance Impact
### PCI-DSS v4.0
| Requirement | Status | Findings |
|-------------|--------|----------|
| 6.2.4 | FAIL | 3 injection findings |
| 6.4.1 | PASS | No public-facing web app findings |
### HIPAA 164.312
| Section | Status | Findings |
|---------|--------|----------|
| 164.312(a)(1) | FAIL | 2 access control findings |
| 164.312(c)(1) | FAIL | 1 SQL injection finding |
Ask the user which compliance frameworks apply to their organization.
/whitebox-pentest:full-audit .
Use the mapping table above to categorize each finding by its compliance impact.
Findings that affect multiple frameworks should be prioritized higher.
Include both the technical finding details and the compliance requirement references.