Oscal document engineering

Skill ethanolivertroy/compliance-trestle-skills/agent-skills/oscal-document-engineering

Agent-portable Compliance Trestle and OSCAL engineering toolkit: convert legacy SSPs to OSCAL, validate with Trestle and oscal-cli, FedRAMP Rev 5 and 20x KSI workflows. Claude Code plugin plus portable skills for Cursor, Codex, Gemini, and more.

Install

npx -y skills add ethanolivertroy/compliance-trestle-skills --skill oscal-document-engineering

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

One thing to look at

12 stars12 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

What its author says it does

Copied from the file, not written here

Convert, validate, and maintain OSCAL documents from legacy SSP/PDF/DOCX/Markdown source material.

SKILL.md

3.4 KB, as published. Nobody here has run it

OSCAL Document Engineering

Use this skill when a user wants to turn old compliance documents into maintainable OSCAL, especially SSPs, SAPs, SARs, POA&Ms, component definitions, and supporting evidence packages.

Core rule

Every OSCAL statement must be traceable to source text, collected evidence, or a user-supplied assertion. If the source is unclear, mark the item needs_review instead of inventing a compliance fact.

Inputs

Common inputs:

SSP in PDF, DOCX, Markdown, or text.
Existing OSCAL JSON/XML/YAML.
Evidence folders, diagrams, inventories, policies, or POA&M spreadsheets.
Framework/profile target such as FedRAMP Moderate, NIST 800-53, SOC 2, ISO 27001, or organization-specific profiles.

Outputs

Produce these artifacts:

OSCAL workspace or package.
source-traceability-map.csv.
ssp-import-plan.md.
import-summary.md.
validation-report.json or Markdown equivalent.
unmapped-items.md listing content requiring human review.

Workflow

Confirm source files and target OSCAL document type.
Create a workspace outside committed source unless using a synthetic example.
Extract text while preserving page numbers, headings, and section identifiers where possible.
Build a source traceability map using templates/source-traceability-map.csv.
Initialize or update a Compliance Trestle workspace.
Draft a schema-valid SSP from extracted sections when Trestle is available:

bash plugins/document-transform/oscal-document-workbench/scripts/draft-ssp-from-extraction.sh <workspace> --overwrite

Use FedRAMP Rev 5 heading conventions from plugins/document-transform/oscal-document-workbench/templates/fedramp-rev5-heading-map.json. 7. Refine mappings and fill remaining OSCAL SSP structure:

metadata
parties and roles
system characteristics
system implementation
control implementation
inventory items
back matter resources

Validate with Compliance Trestle and OSCAL CLI where available.
Generate summary reports and identify gaps.
Ask the user or system owner to review all needs_review items.

Mapping guidance

Map document title, version, system name, owner, and dates into OSCAL metadata.
Map authorizing officials, system owners, ISSOs, assessors, and service providers into parties and responsible roles.
Map boundary descriptions, data types, users, deployment model, and interconnections into system characteristics.
Map components, services, accounts, inventories, and cloud resources into system implementation.
Map control narratives by control ID into control implementation statements.
Map attachments, diagrams, policies, and evidence into back matter resources.

Validation commands

Use commands available in the local environment. Examples:

trestle validate -f <path-to-ssp.json>
trestle validate -f <path-to-ssp.json>

If a validator is missing, report the missing dependency and continue only if the user accepts partial validation.

References

references/legacy-doc-ingestion.md
references/oscal-validation.md
templates/ssp-import-plan.md
templates/source-traceability-map.csv