prowler-compliance
This skill handles end-to-end compliance framework authoring, from choosing between universal (multi-provider, zero Python code) or legacy (single-provider, existing families) schemas to syncing with upstream sources, mapping checks to controls, and fixing JSON bugs. Use it when creating new frameworks, adding ConfigRequirements guardrails, auditing check mappings, or troubleshooting compliance output in the UI.
prowler-compliance creates, syncs, and audits compliance frameworks across multiple cloud providers using universal or legacy JSON schemas.
AI-generated summary based on this skill's SKILL.md
Decision gist · record as of 2026-07-27
prowler-compliance creates, syncs, and audits compliance frameworks across multiple cloud providers using universal or legacy JSON schemas. This skill handles end-to-end compliance framework authoring, from choosing between universal (multi-provider, zero Python code) or legacy (single-provider, existing families) schemas to syncing with upstream sources, mapping checks to controls, and fixing JSON bugs. Use it when creating new frameworks, adding ConfigRequirements guardrails, auditing check mappings, or troubleshooting compliance output in the UI.
Use it when
- prowler-compliance offers two schema types.
- prowler-compliance supports check-to-requirement mapping through its framework structure.
Verify before relying
Read SKILL.md below before installing (17 files). Open directory: indexed for reading, not audited.
Install
prowler-cloud/prowler/prowler-compliance · repository language: Python
Open directory. Skills are indexed for reading, not audited. Review a skill's body before installing it.
Frequently asked questions
AI-generated answers based on this skill's SKILL.md and metadata
How do I create compliance frameworks in prowler?
prowler-compliance handles end-to-end framework authoring. Choose between universal schemas (multi-provider, zero Python code) for new frameworks or legacy schemas (single-provider, existing families) for updates. Universal frameworks let you define requirements once and map checks across AWS, Azure, and GCP without coding. Legacy frameworks work within established provider families. Both support syncing with upstream sources like CIS, NIST, and CSA CCM.
What's the difference between universal and legacy compliance schemas?
prowler-compliance offers two schema types. Universal frameworks are multi-provider, require no Python code, and let you map a single requirement to checks across AWS, Azure, and GCP simultaneously. Legacy frameworks are single-provider, use existing families, and require Python code for provider-specific logic. Choose universal for new, cross-cloud frameworks; use legacy when extending established provider families or maintaining backward compatibility.
How do I map checks to compliance requirements in prowler?
prowler-compliance supports check-to-requirement mapping through its framework structure. Define requirements, then map each to one or more checks per provider. Use ConfigRequirements guardrails to prevent loosened configurations from satisfying stricter controls. Audit mappings by reviewing the compliance JSON, validating schema structure, and testing output in the UI. The skill handles both universal (cross-provider) and legacy (single-provider) mapping patterns.
What are ConfigRequirements guardrails and how do I add them?
prowler-compliance's ConfigRequirements guardrails prevent weakened configurations from falsely satisfying compliance requirements. Add them to your framework to enforce stricter validation logic beyond basic check results. This ensures that even if a check passes, the guardrail can fail if the underlying config doesn't meet the requirement's intent. Use guardrails when mapping checks to high-assurance controls or when a single check result isn't sufficient for compliance.
How do I sync compliance frameworks with upstream catalogs like CIS or NIST?
prowler-compliance enables syncing frameworks with upstream sources (CIS, NIST, CSA CCM, PCI-DSS). Define your framework requirements to align with upstream control IDs and descriptions. The skill supports validation to ensure mappings stay current and accurate. When upstream catalogs update, audit your check-to-requirement mappings to maintain compliance. Use the framework structure to track which upstream source each requirement comes from.
How do I fix compliance JSON bugs and validate framework structure?
prowler-compliance includes JSON schema validation and bug-fixing tools. Common issues include duplicate IDs, malformed requirement definitions, and invalid check mappings. Validate your framework against the universal or legacy schema to catch structural errors. Use the compliance output formatter to test how your framework renders in the UI. Fix bugs by correcting JSON syntax, ensuring unique IDs, and verifying all check references exist in your provider's check catalog.
SKILL.md
Rendered from the published skill. Quoted content, verbatim.
name: prowler-compliance description: > Creates, syncs, audits and manages Prowler compliance frameworks end-to-end. Covers the two supported JSON schemas (universal multi-provider and legacy per-provider), the SDK model tree (legacy attribute classes, universal ComplianceFramework, ConfigRequirements guardrails), output formatters (legacy per-framework + universal data-driven), API/UI consumption, upstream sync workflows, and cloud-auditor check-mapping reviews. Trigger: When working with compliance frameworks (CIS, CIS Controls, NIST, PCI-DSS, SOC2, GDPR, ISO27001, ENS, MITRE ATT&CK, CCC, C5, CSA CCM, DORA, KISA ISMS-P, ASD Essential Eight, DISA STIG, CISA SCuBA, SecNumCloud, FedRAMP, HIPAA, NIS2, Prowler ThreatScore), creating a universal multi-provider framework, adding ConfigRequirements guardrails, syncing with upstream catalogs, auditing check-to-requirement mappings, adding output formatters, or fixing compliance JSON bugs (duplicate IDs, empty Version, wrong Section, stale check refs). license: Apache-2.0 metadata: author: prowler-cloud version: "2.0" scope: [root, sdk] auto_invoke: - "Creating/updating compliance frameworks"
(truncated - see the full file via the links below)
File tree — 15 files
skills/prowler-compliance/SKILL.md
skills/prowler-compliance/assets/audit_framework_template.py
skills/prowler-compliance/assets/build_inventory.py
skills/prowler-compliance/assets/cis_framework.json
skills/prowler-compliance/assets/configs/ccc.yaml
skills/prowler-compliance/assets/dump_section.py
skills/prowler-compliance/assets/ens_framework.json
skills/prowler-compliance/assets/generic_framework.json
skills/prowler-compliance/assets/iso27001_framework.json
skills/prowler-compliance/assets/mitre_attack_framework.json
skills/prowler-compliance/assets/parsers/__init__.py
skills/prowler-compliance/assets/parsers/finos_ccc.py
skills/prowler-compliance/assets/prowler_threatscore_framework.json
skills/prowler-compliance/assets/query_checks.py
skills/prowler-compliance/assets/sync_framework.py
Let your AI agent find skills like this
Example. Real query, live index.
You found this page by searching. An agent finds it by wishing: SkillFed indexes 56,283 agent skills by what they can do, searchable in plain language.
wish › “Create or update compliance frameworks (universal or legacy)”
Give your agent the search over MCP, or paste the wish link into any chat. No install? Search from any chat →
Related skills
This skill streamlines pull request reviews for compliance framework updates by validating JSON syntax, checking for duplicate requirement IDs, and ensuring framework metadata completeness. It applies a structured checklist covering file location, changelog fragments, and dashboard patterns to catch issues before merge.
Prowler-docs provides the authoring standards and formatting conventions for creating consistent Prowler documentation. It covers brand voice principles, markdown formatting, SEO best practices, and MDX component usage across feature docs, tutorials, API references, and compliance guides.
Prowler-provider guides you through adding new cloud providers or services to the Prowler SDK. It provides the required directory structure, class templates for providers and services, and patterns for handling authentication and CLI arguments securely.
This skill guides implementation of Prowler's multi-tenant API architecture, covering row-level security enforcement, role-based access control, provider validation, and async task patterns. Learn the 4-database setup, RLS model constraints, M2M through-model requirements, and critical decorator ordering for tenant-isolated operations.
This skill documents testing conventions for Prowler SDK checks and services across multiple cloud providers. It covers AWS testing with moto mocking, Azure and GCP testing with MagicMock, and establishes provider-specific patterns for fixtures, client patching, and assertion structures.
Prowler-changelog automates changelog management across UI, API, MCP Server, and SDK components using a fragment-based system that prevents merge conflicts on concurrent PRs. Each change gets its own fragment file under `changelog.d/` directories, which compile into versioned `CHANGELOG.md` files at release time. The skill enforces semantic versioning rules, validates fragment format, and requires explicit confirmation before any changelog edits.