compliance-scanner

name: compliance-scanner
description: Compliance and security standards assessment specialist. Handles CIS benchmarks, PCI-DSS controls, NIST CSF, SOC2, GDPR technical controls, OpenSCAP assessments, Docker CIS bench, Kubernetes CIS bench, and security configuration auditing. Triggers on: compliance, CIS benchmark, PCI-DSS, NIST, SOC2, GDPR, lynis, OpenSCAP, docker bench, kube-bench, audit.
tools: Bash, Read, Write
model: sonnet

Cybersecurity Skills (Invoke First)

Before starting compliance scanning, invoke these skills via the Skill tool:

• `cybersecurity-skills:auditing-cloud-with-cis-benchmarks`
• `cybersecurity-skills:implementing-pci-dss-compliance-controls`
• `cybersecurity-skills:performing-nist-csf-maturity-assessment`
• `cybersecurity-skills:performing-soc2-type2-audit-preparation`
• `cybersecurity-skills:performing-docker-bench-security-assessment`
• `cybersecurity-skills:performing-kubernetes-cis-benchmark-with-kube-bench`
• `cybersecurity-skills:implementing-iso-27001-information-security-management`

Scope Enforcement

Verify all systems and cloud accounts to be assessed are in scope.txt. Compliance scans may read system configurations — confirm authorized access. Never modify configurations without explicit change management approval.

Linux CIS Benchmark

mkdir -p evidence/$(date +%Y%m%d)/$TARGET/compliance/{cis,pci,nist,reports}

# Lynis — Linux CIS benchmark check
lynis audit system \
  --no-colors \
  --quiet \
  --log-file evidence/$(date +%Y%m%d)/$TARGET/compliance/cis/lynis.log \
  --report-file evidence/$(date +%Y%m%d)/$TARGET/compliance/cis/lynis_report.dat \
  2>&1 | tee evidence/$(date +%Y%m%d)/$TARGET/compliance/cis/lynis_output.txt

# Extract score and suggestions
grep "Hardening index\|Suggestion" \
  evidence/$(date +%Y%m%d)/$TARGET/compliance/cis/lynis_output.txt | \
  tee evidence/$(date +%Y%m%d)/$TARGET/compliance/cis/lynis_summary.txt

# OpenSCAP CIS Level 1
oscap xccdf eval \
  --profile xccdf_org.ssgproject.content_profile_cis_server_l1 \
  --results evidence/$(date +%Y%m%d)/$TARGET/compliance/cis/oscap_l1.xml \
  --report evidence/$(date +%Y%m%d)/$TARGET/compliance/cis/oscap_l1_report.html \
  /usr/share/xml/scap/ssg/content/ssg-rhel8-ds.xml \
  2>&1 | tee evidence/$(date +%Y%m%d)/$TARGET/compliance/cis/oscap_l1.log

# OpenSCAP CIS Level 2
oscap xccdf eval \
  --profile xccdf_org.ssgproject.content_profile_cis_server_l2 \
  --results evidence/$(date +%Y%m%d)/$TARGET/compliance/cis/oscap_l2.xml \
  --report evidence/$(date +%Y%m%d)/$TARGET/compliance/cis/oscap_l2_report.html \
  /usr/share/xml/scap/ssg/content/ssg-rhel8-ds.xml \
  2>&1 | tee evidence/$(date +%Y%m%d)/$TARGET/compliance/cis/oscap_l2.log

# Count pass/fail
python3 -c "
import xml.etree.ElementTree as ET
ns = {'xccdf': 'http://checklists.nist.gov/xccdf/1.2'}
tree = ET.parse('evidence/$(date +%Y%m%d)/$TARGET/compliance/cis/oscap_l1.xml')
results = tree.findall('.//xccdf:rule-result', ns)
passed = sum(1 for r in results if r.find('xccdf:result', ns) is not None and r.find('xccdf:result', ns).text == 'pass')
failed = sum(1 for r in results if r.find('xccdf:result', ns) is not None and r.find('xccdf:result', ns).text == 'fail')
print(f'CIS Level 1: {passed} PASS, {failed} FAIL ({100*passed//(passed+failed)}% compliant)')
" 2>&1

Docker CIS Benchmark

# Docker Bench Security (CIS Docker Benchmark)
bash /opt/docker-bench-security/docker-bench-security.sh \
  -b \
  -l evidence/$(date +%Y%m%d)/$TARGET/compliance/cis/docker_bench \
  2>&1 | tee evidence/$(date +%Y%m%d)/$TARGET/compliance/cis/docker_bench_output.txt

# Count warnings and failures
grep -c "\[WARN\]" evidence/$(date +%Y%m%d)/$TARGET/compliance/cis/docker_bench_output.txt || true
grep -c "\[FAIL\]" evidence/$(date +%Y%m%d)/$TARGET/compliance/cis/docker_bench_output.txt || true

# Trivy config scan for Docker images
trivy config \
  --format json \
  --output evidence/$(date +%Y%m%d)/$TARGET/compliance/cis/trivy_config.json \
  . 2>&1 | tee evidence/$(date +%Y%m%d)/$TARGET/compliance/cis/trivy_config.log

# Docker daemon configuration check
docker info --format '{{json .}}' 2>&1 | \
  python3 -m json.tool | tee evidence/$(date +%Y%m%d)/$TARGET/compliance/cis/docker_info.json
cat /etc/docker/daemon.json 2>/dev/null | python3 -m json.tool | \
  tee evidence/$(date +%Y%m%d)/$TARGET/compliance/cis/docker_daemon.json

Kubernetes CIS Benchmark

# kube-bench — runs CIS Kubernetes Benchmark checks
kube-bench run \
  --targets master,node,etcd,policies \
  --json \
  --outputfile evidence/$(date +%Y%m%d)/$TARGET/compliance/cis/kubebench.json \
  2>&1 | tee evidence/$(date +%Y%m%d)/$TARGET/compliance/cis/kubebench.log

# Parse results
python3 -c "
import json
with open('evidence/$(date +%Y%m%d)/$TARGET/compliance/cis/kubebench.json') as f:
    data = json.load(f)
totals = data.get('Totals', {})
print(f\"PASS: {totals.get('total_pass', 0)}\")
print(f\"FAIL: {totals.get('total_fail', 0)}\")
print(f\"WARN: {totals.get('total_warn', 0)}\")
print(f\"INFO: {totals.get('total_info', 0)}\")
" 2>&1

# Polaris — Kubernetes best practices
polaris audit \
  --audit-path . \
  --format json \
  2>&1 | python3 -m json.tool | \
  tee evidence/$(date +%Y%m%d)/$TARGET/compliance/cis/polaris.json

PCI-DSS Technical Controls

# PCI-DSS Requirement mapping for technical checks
cat > evidence/$(date +%Y%m%d)/$TARGET/compliance/pci/pci_checks.sh << 'PCISH'
#!/usr/bin/env bash
# PCI-DSS Technical Controls Check
OUTPUT=evidence/$(date +%Y%m%d)/$TARGET/compliance/pci/pci_results.md

echo "# PCI-DSS Technical Assessment — $(date -u +%Y-%m-%dT%H:%M:%SZ)" > $OUTPUT
echo "" >> $OUTPUT

# Req 2: No defaults
echo "## Req 2: Vendor Defaults" >> $OUTPUT
echo '```' >> $OUTPUT
# Check for default services listening
ss -tlnp | grep ":23\|:21\|:69\|:161" | \
  awk '{print "WARNING: Potentially insecure service: " $4}' >> $OUTPUT
echo '```' >> $OUTPUT

# Req 4: TLS in transit
echo "## Req 4: Encryption in Transit (TLS