ethanolivertroy

Knowledge about Compliance Trestle workspace structure, initialization, and directory conventions. Use when users ask about trestle workspaces, directory layout, .trestle config, model directories, or how to set up and organize an OSCAL compliance workspace.

Knowledge about writing control implementation responses, rules, parameters, component-level responses, inheritance, and leveraged SSPs in Compliance Trestle. Use when users ask about writing control responses, implementation status, rules, parameters, component definitions, SSP implementation details, or compliance documentation content.

Knowledge about OSCAL model types, their relationships, and how they are managed in Compliance Trestle. Use when users ask about OSCAL documents, model types, catalogs, profiles, SSPs, component definitions, or how different compliance models relate to each other.

Knowledge about Compliance Trestle validation, common errors, and troubleshooting. Use when users ask about validation errors, trestle validate failures, OSCAL schema validation, fixing compliance document issues, or troubleshooting trestle problems.

Convert, validate, and maintain OSCAL documents from legacy SSP/PDF/DOCX/Markdown source material.

Import a legacy SSP, PDF, DOCX, or Markdown package into a traceable OSCAL Document Workbench workspace using extraction, source mapping, Trestle bootstrap, and validation.

Review source-to-OSCAL mappings, triage needs_review rows, and update the review queue before treating generated OSCAL as ready for stakeholders.

Validate an OSCAL package or Compliance Trestle workspace and produce a validation report, failing loudly when required tools are missing.

Use when the user asks to copy drafted content to the clipboard, copy it again, prepare something for LinkedIn, paste rich text into a social composer, or stage plain text for X. This skill tells Pi when to use the rich clipboard extension and which format/target to choose.

This skill should be used when the user asks to "dump this conversation", "save this conversation to markdown", "output this conversation to a markdown file", "export this chat", "log this session to a file", "save this chat log", or similar. Produces a structured, readable capture of the current Pi conversation - user requests verbatim, assistant responses in full, commands plus key output inline, decisions preserved - not a brief summary. Distinct from mischief-managed, which writes a compact Obsidian session note.

Safely back up local folders to private Hugging Face Buckets using the installed hf CLI and the hf-buckets Pi extension. Use when the user asks to upload/archive/back up local data, training data, agent traces, model artifacts, checkpoints, corpora, or folders to Hugging Face storage, especially when privacy, buckets, quarantine, resume, monitoring, or deleting local copies is involved.

This skill should be used when the user asks to "jot this down", "add this to my daily note", "save this to today's note", "log this to obsidian", "note this down", "put this in my daily", or invokes /jot. Quickly appends any content - insights, thoughts, todos, links, ideas - to today's daily note in the configured Obsidian vault.

Use when managing Linear issues, projects, cycles, or team workflows. Triggers on creating, updating, triaging, or querying Linear tickets.

Perform a high-signal security code review of pending git/PR branch changes, focusing only on newly introduced HIGH/MEDIUM exploitable vulnerabilities and filtering false positives. Use when asked to security-review a branch, PR, diff, or pending changes.

Set up and run an autonomous experiment loop for any optimization target. Gathers what to optimize, then starts the loop immediately. Use when asked to "run autoresearch", "optimize X in a loop", "set up autoresearch for X", or "start experiments".

Finalize an autoresearch session into clean, reviewable branches. Use when asked to "finalize autoresearch", "clean up experiments", or "prepare autoresearch for review".

Read, inspect, export, and upload eMASS artifacts with the eMASSer CLI. Use when an agent needs to find local evidence files, validate them, upload artifacts, export existing artifacts, or verify uploaded evidence in eMASS.

Execute eMASSer CLI DELETE commands to remove data from the eMASS API. Use when deleting POA&Ms, removing milestones, deleting artifacts, removing hardware/software assets, or clearing cloud resource and container scan results.

Execute eMASSer CLI GET commands to retrieve data from the eMASS API. Use when querying systems, controls, POA&Ms, milestones, artifacts, test results, CAC/PAC status, hardware/software baseline, CMMC assessments, workflow definitions, or dashboards.

Execute eMASSer CLI POST commands to add data to the eMASS API. Use when registering certificates, uploading test results, creating POA&Ms, adding milestones, uploading artifacts, submitting CAC/PAC workflows, adding hardware/software assets, or uploading scan results (device scans, cloud resources, container scans, static code scans).

Execute eMASSer CLI PUT commands to update existing data in the eMASS API. Use when updating security controls, modifying POA&Ms, updating milestones, updating artifact metadata, or updating hardware/software baseline assets.

Set up and configure the eMASSer CLI tool for interacting with the eMASS (Enterprise Mission Assurance Support Service) API. Use when installing emasser, configuring environment variables, or troubleshooting connection issues.

Use when finishing a Pi, Codex, Cursor, Claude, or other coding-agent session and wanting to save a lean Markdown session note into your Obsidian vault with decisions, code changes, validation, caveats, and follow-ups.

Always use when the user asks to create, generate, draw, or design a diagram, flowchart, architecture diagram, ER diagram, sequence diagram, class diagram, network diagram, mockup, wireframe, UI sketch, draw.io/drawio/drawoi, .drawio files, or diagram export to PNG/SVG/PDF/JPG.

Use when querying or changing Drata/GRC data through the `drata` CLI, including compliance status, frameworks, certificates, Trust Center documents, controls, monitoring tests, evidence, risks, vendors, policies, personnel compliance, and background-check questions. Prefer versionless CLI commands, JSON output, read-only mode for reporting, secure auth sources, and dry-runs before mutations.

Use when a GRC engineer needs to create, review, or tighten ATO and compliance work products, including SSP outlines, control narratives, evidence requests, POA&M or risk items, architecture diagram prompts, and assessor-ready Q&A across FedRAMP Rev. 5, FedRAMP 20x, or CMMC contexts.

Analyze CISA Known Exploited Vulnerabilities with KEVin. Use when the user asks about KEVs, exploited CVEs, remediation advice, patch status, exploitability, or wants help triaging a vulnerability in the KEV catalog.