assess-nist-control

Invoke the skill with a control ID and product, such as ac-7 with --product rhel9. It loads the OSCAL control text, finds candidate rules via CIS mappings and reference grep, and guides you through mapping rules and setting the control status.

The skill reads cis_nist_mappings.json and builds a reverse index, listing every rule and variable already associated with a given NIST control ID. It also checks enhancements by matching IDs prefixed with the base control.

Yes, passing a two-letter family code like ac or cm triggers family triage mode. The skill presents a prioritized table of pending base controls ranked by CIS mapping density and Linux hardening relevance, then lets you pick one to assess.

The skill warns that the OSCAL catalog was not found and suggests running the download script, then proceeds using only the titles from the product control file. Statement, guidance, and assessment objective sections are skipped.

Yes, every MCP tool call has a filesystem-based fallback, such as grepping rule sources and editing control YAML directly. Cross-framework similarity search is the only capability unavailable without the MCP server.

After rule selection, the skill delegates to the resolve-rule-variables sub-skill, which reads the product's rule-variable mapping and .var files. It returns var_name=key entries that are written inline alongside rule IDs in the control file.