git:20260712.a867952 to git:20260911.7afa6ea
6 added, 0 removed. Audit A to A.
---
name: ecommerce-platform-audit-requirements
description: Use when scoping or specifying an e-commerce platform, payment, API, security, AI, data protection, integration, and remediation audit for SMEs or cross-border digital trade programmes.
metadata:
portable: true
compatible_with:
- claude-code
- codex
---
# E-Commerce Platform Audit Requirements
Acknowledgement: Shared by Peter Bamuhigire, techguypeter.com, +256 784 464178.
<!-- dual-compat-start -->
## Overview
Use this skill to define a requirements-level audit protocol for e-commerce platforms. It gives the audit a standard, scope, evidence model, legal table, payment scope, integration review, AI review, and remediation backlog so the output is actionable and defensible.
## Use When
- Auditing or scoping an audit of an e-commerce website, app, marketplace presence, payment integration, logistics integration, API, data flow, or AI feature.
- Producing remediation requirements for SMEs in a donor or technical assistance programme.
- Reviewing cross-border readiness involving payment, data protection, consent, consumer trust, and platform security.
## Do Not Use When
- The task is only visual UX feedback or marketing copy.
- You cannot access enough system, process, or owner interview evidence to support findings.
- Legal advice is required. This skill identifies compliance issues and escalation needs; it does not replace counsel.
## Required Inputs
- Platform URLs/apps, architecture notes, payment/logistics providers, data flows, user journeys, admin roles, and support workflows.
- Countries where customers, operations, data processing, or partners are located.
- Known AI/recommendation/fraud/personalisation tools.
- Existing policies: privacy notice, terms, returns, consent, security, incident handling.
## Workflow
1. Define audit scope and evidence access.
2. Set standards baseline: OWASP Top 10, OWASP API Security Top 10, OWASP ASVS, CVSS, PCI-DSS where payment card scope exists, and NIST AI RMF for AI use.
3. Map architecture, integrations, data flows, roles, permissions, and third-party dependencies.
4. Scope payment security. Identify hosted redirect, embedded checkout, card data exposure, mobile money/gateway flows, reconciliation, settlement, refunds, and chargebacks.
5. Map privacy and consumer-protection obligations by jurisdiction using the verified EAC data-protection table and escalate uncertain legal questions.
6. Review AI use for data provenance, human oversight, bias, explainability, security, and EU AI Act exposure where relevant.
7. Produce a remediation backlog with severity, business impact, owner, effort, dependency, and acceptance criteria.
8. Write a founder-readable executive summary and a technical appendix.
## Quality Standards
- Every finding maps to a named standard, law/regime, policy, or observed evidence.
- PCI scope matches the real payment architecture.
- Country legal statuses use the verified table and are dated.
- AI review states whether AI exists, what data it uses, and what risk class/escalation applies.
- The remediation backlog is prioritised, owned, and testable.
## Anti-Patterns
- Vibes-based security review with no standard.
- Over-scoping PCI for a company that never touches card data.
- Using stale data-protection-law status.
- Proposing a payment rail without country coverage and reconciliation checks.
- Findings with no severity, owner, or acceptance criteria.
## Outputs
- Audit scope and evidence request list.
- Security, API, payment, integration, privacy, AI, and data-flow audit checklist.
- Verified EAC data-protection table reference.
- Remediation backlog.
- Founder executive summary and technical appendix requirements.
## References
- `references/audit-scope-and-standards.md`: Scope, standards, evidence, and payment/AI review.
- `references/eac-data-protection-table.md`: Verified EAC data-protection status table and legal-use rules.
- `references/remediation-backlog-template.md`: Backlog fields, severity, business impact, and acceptance criteria.
+ ## Evidence Produced
+
+ | Category | Artifact | Format | Example |
+ | --- | --- | --- | --- |
+ | Correctness | E-commerce requirement and evidence matrix | Markdown table | journey, requirement, risk, oracle, evidence owner, and disposition |
+
<!-- dual-compat-end -->
## Inputs
| Input | Required | Purpose |
|---|---|---|
| Markets, actors, and data flows | yes | Bound the audit |
| Payment, integration, and hosting inventory | yes | Identify controls |
| Evidence access and legal constraints | conditional | Set assurance depth |
## Decision rules
| Condition | Action |
|---|---|
| Payment or personal-data scope unclear | Stop and resolve scope |
| Evidence supports a conclusion | Record finding and evidence |
| Evidence absent | Mark not assessed |
## Degraded mode
If systems or evidence are unavailable, issue a document-only gap assessment with untested controls separated from findings; do not provide compliance assurance.