菜单
Orchestrate complex multi-step OSCAL compliance workflows by combining multiple skills. Use this skill for end-to-end compliance automation like FedRAMP package reviews, continuous monitoring, and gap assessments.
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
基于 SOC 职业分类
| name | workflow-orchestrator |
| description | Orchestrate complex multi-step OSCAL compliance workflows by combining multiple skills. Use this skill for end-to-end compliance automation like FedRAMP package reviews, continuous monitoring, and gap assessments. |
Orchestrate complex, multi-step compliance workflows that combine multiple skills for comprehensive OSCAL processing and analysis.
Use this skill when you need to:
Workflows operate on user-provided documents and chain other skills together.
| Workflow | Required Documents |
|---|---|
| FedRAMP Review | SSP, POA&M, Baseline Profile |
| Gap Analysis | Baseline Catalog + SSP |
| Continuous Monitoring | Current SSP, Previous SSP, POA&M |
| SSP Review | SSP + Baseline Profile |
| Multi-Framework Mapping | Source catalog + Target mapping document |
Each skill invoked in a workflow inherits its own authoritative data requirements. If a workflow step needs a baseline catalog, the workflow will stop and request it.
| Workflow | Purpose | Skills Used |
|---|---|---|
| FedRAMP Review | Review authorization package | Parser, Validator, Extractor, Risk Assessor |
| Gap Analysis | Identify missing controls | Parser, Extractor, Mapper, Report Generator |
| Continuous Monitoring | Regular compliance check | Parser, Validator, Risk Assessor, Report Generator |
| SSP Review | Validate SSP completeness | Parser, Validator, Extractor, Evidence Collector |
| Multi-Framework Mapping | Map across standards | Parser, Extractor, Mapper, Report Generator |
Individual steps that execute a skill:
task:
id: parse-ssp
name: Parse SSP Document
skill: oscal-parser
parameters:
file: fedramp_ssp.json
depends_on: []
Tasks can depend on other tasks:
task:
id: extract-controls
name: Extract Controls
skill: controls-extractor
depends_on:
- parse-ssp # Must complete first
Outputs passed between tasks:
artifacts:
- name: parsed_data
from: parse-ssp
to: extract-controls
CRITICAL: Workflows that generate OSCAL documents MUST include validation gates.
task:
id: validate-output
name: Validate Generated OSCAL
skill: oscal-validator
depends_on:
- generate-component
validation_checks:
- uuid_format
- metadata_complete
- schema_valid
- references_valid
Required Validation Tasks:
oscal-validator for basic checksoscal-ssp-validator) for detailed checksExample with Validation:
workflow:
- task: generate-component-def
skill: component-definition-builder
- task: validate-component # ← REQUIRED
skill: oscal-validator
parameters:
document: output-from-generate-component-def
stop_on_error: true
- task: next-step
skill: ...
depends_on: [validate-component] # Only proceeds if valid
Purpose: Comprehensive review of FedRAMP authorization package
Steps:
Output:
FEDRAMP PACKAGE REVIEW
======================
System: [Name]
Baseline: [Moderate]
Review Date: [Date]
Document Validation:
- SSP: ✅ Valid
- SAR: ✅ Valid
- POA&M: ⚠️ 2 issues
Control Coverage:
- Required: 325
- Documented: 320 (98.5%)
- Missing: 5
Risk Summary:
- High Risks: 3
- Moderate Risks: 8
- POA&M Items: 15
Recommendation: [READY / NOT READY]
Purpose: Identify compliance gaps against a framework
Steps:
Output:
GAP ANALYSIS REPORT
==================
Current: NIST 800-53 Low
Target: NIST 800-53 Moderate
New Controls Required: 125
Already Implemented: 200
Estimated Effort: 480 hours
Priority Gaps:
1. SI-4 - Security Monitoring (HIGH)
2. CA-7 - Continuous Monitoring (HIGH)
3. IR-4 - Incident Handling (MEDIUM)
Purpose: Regular automated compliance check
Steps:
Frequency: Daily/Weekly/Monthly
Choose appropriate workflow for the task.
Collect required documents:
Run each task in dependency order:
If a task fails:
Aggregate outputs from all tasks into comprehensive report.
Create custom workflows:
workflow:
id: custom-review
name: Quarterly Compliance Review
description: Q4 compliance status assessment
tasks:
- id: parse-ssp
skill: oscal-parser
params:
file: current_ssp.json
- id: validate
skill: oscal-validator
depends_on: [parse-ssp]
- id: extract
skill: controls-extractor
depends_on: [parse-ssp]
- id: assess-risk
skill: risk-assessor
depends_on: [extract]
- id: report
skill: compliance-report-generator
depends_on: [validate, extract, assess-risk]
params:
format: markdown
type: executive-summary
output:
format: markdown
destination: reports/q4-review.md
| Status | Meaning |
|---|---|
| Pending | Not started |
| Running | In progress |
| Completed | Successfully finished |
| Failed | Error encountered |
| Cancelled | Manually stopped |
When asked "Review this FedRAMP package for readiness":
Create and manage OSCAL component definitions for reusable security control implementations. Inspired by CivicActions components and community patterns. Use for building component libraries and shared control implementations.
Generate detailed control implementation guidance, technical steps, and implementation plans for OSCAL security controls. Use this skill to create implementation narratives, technical procedures, and deployment plans.
Create and analyze OSCAL Control Mapping documents to establish formal relationships between controls across different frameworks (NIST 800-53, ISO 27001, CIS, PCI-DSS, etc.). Use this skill to document control equivalencies, gaps, and harmonization for multi-framework compliance.
Perform comprehensive OSCAL validation using community-inspired patterns including JSON schema validation, business rule validation, cross-reference checking, and best practices from IBM Trestle, oscal-pydantic, and Lula. Use for thorough document quality assurance.
Fetch official NIST 800-53 and FedRAMP OSCAL catalogs from authoritative sources
Validates OSCAL System Security Plan documents against NIST 800-18 Rev 1 requirements and FedRAMP baselines. Identifies missing elements, quality issues, and provides remediation guidance for achieving ATO compliance.