volcengine-compliance
火山引擎合规最佳实践助手：一是根据用户诉求（要满足的合规标准、关键词、关注的风险等级）， 从火山引擎官方内置的合规包模板里推荐该开启哪些、并标出哪些已开启；二是汇总账号当前的合规 态势，把已生效规则/合规包（官方内置 + 用户自定义）的评估结果按类别（法规 / 最佳实践 / 自定义）与严重度聚合成一份合规总览报告；三是当官方基线没覆盖时，指导用户写一条 Rego 策略 作为自定义合规规则并注册评估。可在用户确认后把推荐的模板部署为合规包。Use when 用户想做「合规检查 / 合规巡检 / 安全合规 / 合规最佳实践 / 该开哪些合规规则 / 等保合规 / 我火山账号合规吗 / 有哪些不合规 / 帮我写条自定义合规规则」，或提到火山引擎「配置审计 / Config / 合规包 / conformance pack / Rego 策略」。Trigger on 火山 / 火山引擎 / volcengine 关键词叠加合规场景。部署合规包 / 注册自定义规则属写操作，需用户确认；合规报告 与资源修复严格分离。
- Installs
- 57
- Last 24h
- —
- Trending rank
- —
- Security
- Not audited
Install
Works with every agent the skills CLI supports.
npx skills add https://github.com/volcengine/volcengine-agent-toolkit --skill volcengine-compliance- 01
Install
Run the command in your project. The CLI asks which agents to install for.
- 02
Describe the task
Ask your agent for something this skill covers. It loads volcengine-compliance automatically when relevant.
- 03
Review the result
The agent follows the SKILL.md steps, scripts and references bundled with the skill.
SKILL.md
The instructions your agent reads when the skill is triggered.
火山引擎合规最佳实践助手
本技能围绕火山引擎配置审计（Config）的合规能力，为用户提供三件事：
- 合规推荐：根据用户诉求，从火山引擎官方内置的合规包模板里推荐该开启哪些合规基线 （法规 / 最佳实践），并标出哪些已经开过，避免重复部署。
- 合规总览：汇总账号当前的合规态势——把已生效规则/合规包（官方内置 + 用户自定义） 的评估结果，按合规类别与严重度聚合成一份总览报告。
- 落地合规检查诉求：用户带着一个具体检查诉求来时，先在系统模板里找现成的推荐给他，没有 现成的再参考类似模板、或从零写一条 Rego 策略自定义并注册评估（详见 references/writing-config-rules.md）。
合规知识既来自火山官方内置基线，也覆盖用户自建规则；总览一视同仁，推荐只针对官方基线。
速查
| 项目 | 说明 |
|---|---|
| 适用场景 | 合规检查 / 合规巡检 / 合规最佳实践推荐 / 账号合规态势总览 / 写自定义合规规则 |
| 核心能力 | 合规推荐（只读）、合规总览（只读） |
| 可选写操作 | 把推荐模板部署为合规包、注册自定义规则（需确认） |
| 底层调用 | scripts/compliance.py 封装 ve config <Action>；写自定义规则直调 ve config |
能力
| 能力 | 做什么 | 子命令 | 参考 |
|---|---|---|---|
| 合规推荐 | 按标准/关键词/风险等级，从官方内置模板里推荐该开启哪些，标注已开启 | recommend | references/recommend.md |
| 合规总览 | 汇总账号已生效规则/合规包的评估结果，按类别+严重度出总览报告 | overview | references/overview.md |
| 部署合规包 | 把推荐的官方模板部署为合规包（写操作，确认门控） | apply | references/apply.md |
| 写自定义规则 | 落地一个具体合规检查诉求：先在系统模板里找现成的，没有再写 Rego 策略自定义并注册评估 | 无（ve config 直调） | references/writing-config-rules.md |
什么时候用
- 用户问「我该开哪些合规规则 / 想满足等保 / 有没有推荐的合规最佳实践」——用合规推荐。
- 用户问「我火山账号现在合规吗 / 有哪些不合规资源 / 给我一份合规报告」——用合规总览。
- 用户带着一个具体检查诉求来（「帮我检查 TOS 桶有没有对匿名用户开放写权限」这类）——按 references/writing-config-rules.md 先找现成模板，没有再自定义。
- 用户消息里出现「火山 / 火山引擎 / volcengine」且属于合规检查 / 配置审计 / Config 场景。
不适用：管理单条自建规则的增删改、执行具体资源的配置修复——修复是用户确认后的独立动作。
前置条件
veCLI 已安装并完成鉴权（ve configure或VOLCENGINE_ACCESS_KEY/SECRET_KEY）。见 references/auth.md。- 合规总览要求账号已启用**配置记录器（recorder）**并已有评估结果；部署合规包同样依赖 recorder，未启用时可在确认后一并启用。
- 调用方对目标账号 / 账号组有配置审计的读写权限。
工作流
所有动作通过 scripts/compliance.py 完成（命令相对本 skill 目录根执行）。
合规推荐（只读）
python3 scripts/compliance.py recommend # 全部官方内置基线
python3 scripts/compliance.py recommend --standard Law # 只看法规合规（如等保）
python3 scripts/compliance.py recommend --keyword 对象存储 # 按关键词过滤
python3 scripts/compliance.py recommend --risk-level High # 只看高风险基线
输出候选基线（ID / 名称 / 类别 / 风险等级 / 含多少规则模板 / 是否已开启），未开启的排前。 推荐口径与如何选基线见 references/recommend.md。
合规总览（只读）
python3 scripts/compliance.py overview # 全量已生效规则
python3 scripts/compliance.py overview --no-detail # 只看规则级统计，更快
python3 scripts/compliance.py overview --conformance-pack-id <合规包ID> # 只看某合规包
产出 md / csv / json 三份产物（stdout 只回摘要 + 路径），按合规类别分节、节内按严重度 降序，每条标注来源（BuiltIn / Custom）。定级与解读见 references/overview.md。
部署合规包（写操作，需确认）
# 先 dry-run 看将要创建什么
python3 scripts/compliance.py apply --template-id <模板ID> --name my-baseline --enable-recorder
# 用户明确同意后才真正执行
python3 scripts/compliance.py apply --template-id <模板ID> --name my-baseline --enable-recorder --confirm
--confirm 才真正写入；不加只 dry-run。--enable-recorder 在 recorder 未启用时一并启用。
部署细节与安全边界见 references/apply.md。
部署后资源评估异步进行，
apply完成不代表立刻有结果；overview若显示无结果，稍等再跑。
agent 执行流程
- 判断诉求：用户是想「该开哪些」（推荐）、「现在合规吗」（总览），还是「官方没覆盖、要自己写规则」（自定义规则）？单账号还是账号组？有无指定标准（等保 / 最佳实践）。
- 检查鉴权：
ve未登录按 references/auth.md 引导，不要盲目重试。 - 推荐场景：
recommend给用户看候选基线，讲清每个覆盖什么、哪些已开启，建议先开高风险/未覆盖的。 - 部署（可选）：用户想开时先
applydry-run 给他看，明确同意后才--confirm。 - 总览场景：
overview后读 markdown 产物，按类别与严重度汇报，先讲 Critical/High。 - 合规检查诉求场景：用户带具体检查诉求来时，按 references/writing-config-rules.md 先用
ListRuleTemplates/recommend找现成模板；没有再摸清资源字段结构（ListSupportedResourceType→DescribeSupportedResourceTypes/GetResourceConfigHistory）、写 Rego 策略、本地自测，经用户确认后注册规则（创建后自动异步评估）。 - 给整改建议、不代执行修复：讲清每条不合规要求什么、怎么改；具体资源修复交用户确认后另行执行。
优先级分级
| 优先级 | 处理建议 |
|---|---|
| Critical | 高危暴露，需立即整改 |
| High | 数日内处理以降低风险 |
| Medium | 排入下个迭代解决 |
| Low | 日常维护中跟踪修复 |
（严重度由规则风险等级映射：High→Critical、Medium→High、Low→Medium。）
写操作边界（重要）
- 只读：
recommend/overview永远不改任何东西。 - 写操作：
apply（部署合规包）、--enable-recorder（启用记录器）会改变账号状态， 必须--confirm才执行，且执行前必须让用户明确同意。不加--confirm只 dry-run。 - 注册自定义规则：
CreateRuleTemplate/CreateRule也是写操作，会在账号里落库规则， 同样要用户明确同意后才执行（详见 references/writing-config-rules.md）。 规则创建后由平台自动触发评估（异步，有几秒延迟），本技能不手动调StartRuleEvaluation。 - 修复：改具体资源配置 / 触发自动修正不在本技能内执行，只作为整改建议给出，由用户 确认后另行操作。合规「报告」与「修复」严格分离。
报错处理
| 现象 | 处理 |
|---|---|
ve 未登录 / 会话过期 | 按 references/auth.md 引导登录，不要盲目重试 |
SingleAccountRecorderNotEnabled / OrganizationRecorderNotEnabled | recorder 未启用，用 apply --enable-recorder（确认后 --confirm） |
NotFound.ConformancePackTemplate | 模板 ID 错误或不可见，重新 recommend 取正确 ID |
QuotaExceeded.Rule | 规则配额不足，减少部署范围或清理无用规则 |
| apply 提示缺省必填参数 | 补齐 InputParameters 再部署 |
overview 无结果 | 尚无已生效规则或评估进行中；先 recommend → apply，或稍后重试 |
CreateRuleTemplate 报策略编译错 | Rego 语法/语义错误，按 references/writing-config-rules.md 的契约与常见坑排查 |
| 自定义规则评估结果不符预期 | 多为字段路径/大小写/标量数组假设错，用 GetResourceConfigHistory 核对真实快照 |
合规最佳实践（运营建议）
- 定期跑合规总览（周度 / 月度），跟踪不合规趋势与整改效果。
- 合规推荐优先补齐未覆盖的法规/最佳实践基线，再逐步收敛高风险项。
- 合规报告与修复动作分离：先出报告对齐范围，再由用户决策与执行修复。
- 报告与产物中不得出现 AK / SK / Authorization / 会话 token 等凭证。
- 资源 ID 对外脱敏时保留固定前缀、抽象随机段（如
i-<id>、cp-<id>、ag-<id>）。
FAQ
What does the volcengine-compliance skill do?
火山引擎合规最佳实践助手：一是根据用户诉求（要满足的合规标准、关键词、关注的风险等级）， 从火山引擎官方内置的合规包模板里推荐该开启哪些、并标出哪些已开启；二是汇总账号当前的合规 态势，把已生效规则/合规包（官方内置 + 用户自定义）的评估结果按类别（法规 / 最佳实践 / 自定义）与严重度聚合成一份合规总览报告；三是当官方基线没覆盖时，指导用户写一条 Rego 策略 作为自定义合规规则并注册评估。可在用户确认后把推荐的模板部署为合规包。Use when 用户想做「合规检查 / 合规巡检 / 安全合规 / 合规最佳实践 / 该开哪些合规规则 / 等保合规 / 我火山账号合规吗 / 有哪些不合规 / 帮我写条自定义合规规则」，或提到火山引擎「配置审计 / Config / 合规包 / conformance pack / Rego 策略」。Trigger on 火山 / 火山引擎 / volcengine 关键词叠加合规场景。部署合规包 / 注册自定义规则属写操作，需用户确认；合规报告 与资源修复严格分离。
How do I install volcengine-compliance?
Run npx skills add https://github.com/volcengine/volcengine-agent-toolkit --skill volcengine-compliance in your project. The skills CLI detects the agents you use and copies the skill into the right folder. For Claude Code you can also place the skill folder at ~/.claude/skills/volcengine-compliance/ (personal) or .claude/skills/volcengine-compliance/ (project).
Which AI agents can use volcengine-compliance?
Any agent that supports the open Agent Skills format (a folder with a SKILL.md file), including Claude Code, Codex, Cursor, GitHub Copilot, Gemini CLI, Windsurf, Cline, OpenCode and more.
Is volcengine-compliance safe to install?
No partner security audit is available yet. Skills can run commands and scripts, so read the SKILL.md and any bundled files before installing.
Who maintains volcengine-compliance?
It is published by volcengine in volcengine/volcengine-agent-toolkit. It has 57 recorded installs.
More from volcengine/volcengine-agent-toolkit
volcengine-cli
volcengine/volcengine-agent-toolkit
Create and manage Volcengine cloud resources using the Volcengine CLI (ve command). Supports all Volcengine services including ECS, VPC, CLB, RDS, Redis, and more. Trigger this skill whenever the user asks to create, query, modify, or delete cloud resources on Volcengine, mentions the ve command, says "volcengine CLI", or describes infrastructure tasks such as "create an ECS instance", "set up a VPC", "list security groups", "allocate an EIP". Also trigger on Chinese prompts mentioning "火山引擎" or "火山" (e.g., "火山引擎上有哪些 ECS"、"查一下我火山的云服务器"、 "火山引擎创建一个 VPC"、"火山的 Redis 实例列一下"). Also trigger when the user encounters errors from ve commands and needs troubleshooting help. Also use for TOS bucket/object operations, tosutil (sometimes written tosutils), Ark CLI / arkcli model discovery, inference, generation, endpoints, fine-tuning, plans, or usage, and TLS (日志服务) / volclog log search, analysis, ingest, export, or LogCollector collection, through ve tosutil, ve arkcli and ve volclog.
volcengine-tosutil
volcengine/volcengine-agent-toolkit
Open the skill to read its SKILL.md instructions.
volcengine-knowledge-search
volcengine/volcengine-agent-toolkit
使用 ve docs search/fetch 检索火山引擎官方文档并获取全文。Use when 用户咨询火山引擎产品的概念、用法、计费规则、部署步骤、最佳实践或服务条款，或提供 www.volcengine.com/docs/、docs.volcengine.com/docs/ 链接需要阅读正文时。
volcengine-api
volcengine/volcengine-agent-toolkit
Query and answer questions about Volcengine API specifications. Use when the user asks about API parameters, error codes, request methods, enum values, required fields, response structures, pagination, parameter dependencies, service capability lists, API availability, or API comparisons, even if they do not explicitly say "API". Typical intent includes checking what an action supports, which fields are required, what values a parameter accepts, why an API returns a specific error, how to pass nested or body parameters, how pagination works, what an API response contains, whether a batch operation exists, what services or versions expose an operation, or how two APIs differ. Use API Explorer data as the authoritative source and preserve constraints, examples, and caveats found in the spec. Answer in Chinese or English. When the user needs runnable SDK code, language-specific examples, or SDK configuration, hand off to volcengine-sdk-generator. When they need CLI operations, hand off to
volcengine-troubleshooting
volcengine/volcengine-agent-toolkit
Open the skill to read its SKILL.md instructions.
volcengine-find-skills
volcengine/volcengine-agent-toolkit
List, select, and install Volcengine skills from the volcengine-skills marketplace. Use when a user asks which Volcengine skill or plugin handles a task, wants to browse every available skill, needs an optional skill that is not currently installed, or asks to install or check the installation status of a Volcengine skill. Also use to discover any core skill, including this finder. Use as a fallback during a Volcengine operation when the currently loaded or installed skills cannot cover the required product, tool, or workflow; inspect the full catalog, select the missing capability, and install it.
Popular security skills
azure-compliance
microsoft/azure-skills
Run Azure compliance and security audits with azqr plus Key Vault expiration checks. Covers best-practice assessment, resource review, policy/compliance validation, and security posture checks. WHEN: compliance scan, security audit, BEFORE running azqr (compliance cli tool), Azure best practices, Key Vault expiration check, expired certificates, expiring secrets, orphaned resources, compliance assessment.
minimal-run-and-audit
lllllllama/rigorpilot-skills
Rigor Run skill for README-first deep learning repo reproduction. Use when the task is specifically to capture or normalize evidence from the selected smoke test or documented inference or evaluation command and write standardized reprooutputs/ files, including patch notes when repository files changed. Do not use for training execution, initial repo intake, generic environment setup, paper lookup, target selection, hidden scientific-meaning changes, or end-to-end orchestration by itself.
seo-audit
coreyhaines31/marketingskills
When the user wants to audit, review, or diagnose SEO issues on their site. Also use when the user mentions "SEO audit," "technical SEO," "why am I not ranking," "SEO issues," "on-page SEO," "meta tags review," "SEO health check," "my traffic dropped," "lost rankings," "not showing up in Google," "site isn't ranking," "Google update hit me," "page speed," "core web vitals," "crawl errors," "indexing issues," "stuck on page 2," "striking distance keywords," "title tag rewrite," "low CTR," "local SEO," "Google Business Profile," or "map pack." Use this even if the user just says something vague like "my SEO is bad" or "help with SEO" — start with an audit. For building pages at scale to target keywords, see programmatic-seo. For adding structured data, see schema. For AI search optimization, see ai-seo.
firebase-security-rules-auditor
firebase/agent-skills
Audits Firebase (Firestore, Cloud Storage) security rules for vulnerabilities, privilege escalation, role bypasses, create vs update inconsistencies, resource exhaustion, type safety, size limits, and hasOnly ownership checks. Use when auditing/reviewing rules, running red-team rule assessments, or scoring against auditor checklists. Don't use for Firebase CLI (login, deploy), Auth, Crashlytics, Remote Config, or database queries.
audit
pbakaus/impeccable
Run technical quality checks across accessibility, performance, theming, responsive design, and anti-patterns. Generates a scored report with P0-P3 severity ratings and actionable plan. Use when the user wants an accessibility check, performance audit, or technical quality review.
competitors
coreyhaines31/marketingskills
When the user wants to create competitor comparison or alternative pages for SEO and buyer-facing use. Also use when the user mentions 'alternative page,' 'vs page,' 'competitor comparison,' 'comparison page,' '[Product] vs [Product],' '[Product] alternative,' 'competitive landing pages,' 'how do we compare to X,' 'competitor teardown,' 'audit our competitor pages,' 'are our comparison pages out of date,' or 'competitive asset audit.' Use this for any content that positions your product against competitors. Covers four formats: singular alternative, plural alternatives, you vs competitor, and competitor vs competitor. For auditing existing claims (not researching competitors from scratch, which is competitor-profiling; not technical SEO on these pages, which is seo-audit), use the asset audit here. For internal battle cards and sales-specific competitor docs, see sales-enablement.