用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
直接命令不会经过审查 Prompt；运行前请先检查来源。
npx skills add https://github.com/CyberStrikeus/CyberStrike --skill cm-11-user-installed-software命令会保持在同一行。复制前请横向滚动并检查完整内容。
想先保存到本地？可下载 SkillsMP 当前能够提供的文件。
基于 SOC 职业分类
正在显示 SKILL.md
| name | CM-11_user-installed-software |
| description | Establish [organization-defined] governing the installation of software by users; |
| category | configuration |
| version | 5.2.0 |
| author | cyberstrike-official |
| tags | ["nist","sp800-53","rev5","cm-11","cm"] |
| tech_stack | ["aws","azure","gcp","linux","windows"] |
| cwe_ids | ["CWE-16"] |
| chains_with |
| ["AC-3","AU-6","CM-2","CM-3","CM-5","CM-6","CM-7","CM-8","PL-4","SI-4"] |
| prerequisites | [] |
| severity_boost | {"AC-3":"Chain with AC-3 for comprehensive security coverage","AU-6":"Chain with AU-6 for comprehensive security coverage","CM-2":"Chain with CM-2 for comprehensive security coverage"} |
Family: Configuration Management (CM) Framework: NIST SP 800-53 Rev 5
If provided the necessary privileges, users can install software in organizational systems. To maintain control over the software installed, organizations identify permitted and prohibited actions regarding software installation. Permitted software installations include updates and security patches to existing software and downloading new applications from organization-approved "app stores." Prohibited software installations include software with unknown or suspect pedigrees or software that organizations consider potentially malicious. Policies selected for governing user-installed software are organization-developed or provided by some external entity. Policy enforcement methods can include procedural methods and automated methods.
Examine the System Security Plan (SSP) and related artifacts for CM-11 implementation details. Verify the organization has documented how this control is satisfied.
# For cloud environments, use cloud-audit-mcp tools
# For on-premises, review system configurations directly
# Example: Check if account management policies exist
grep -r "account.management\|access.control" /etc/security/ 2>/dev/null
Verify the control is actively functioning, not just documented. Check logs, configurations, and operational evidence.
| Tool | Purpose | Usage |
|---|---|---|
| cloud-audit-mcp | Check configuration baselines | cloud_audit_config |
| AWS CLI | Review Config rules | aws configservice describe-config-rules |
Establish [organization-defined] governing the installation of software by users; Enforce software installation policies through the following methods: [organization-defined] ; and Monitor policy compliance [organization-defined].
If provided the necessary privileges, users can install software in organizational systems. To maintain control over the software installed, organizations identify permitted and prohibited actions regarding software installation. Permitted software installations include updates and security patches to existing software and downloading new applications from organization-approved "app stores." Prohibited software installations include software with unknown or suspect pedigrees or software that organizations consider potentially malicious. Policies selected for governing user-installed software are organization-developed or provided by some external entity. Policy enforcement methods can include procedural methods and automated methods.
| Finding | Severity | Impact |
|---|---|---|
| CM-11 User-installed Software not implemented | Medium | Configuration Management |
| CM-11 partially implemented | Low | Incomplete Configuration Management |
| CWE ID | Title |
|---|---|
| CWE-16 | Configuration |