---
name: "openscap-compliance-automation"
description: "Validate Linux configurations against NIST, PCI-DSS, and CIS security benchmarks."
metadata:
  author: "OpenSCAP"
  version: "1.0.0"
  runtime_compatibility:
    - "codex"
    - "claude-code"
    - "cursor"
    - "windsurf"
triggers:
  - "run openscap audit"
  - "check cis compliance openscap"
  - "generate oscap remediation script"
permissions:
  fs_read: true
  fs_write: "workspace"
  shell_exec: false
  net_access: false
---

# OpenSCAP Compliance & Vulnerability Automation

Leverages OpenSCAP (oscap): scanning system state against Security Content Automation Protocol (SCAP) profiles, generating HTML compliance reports, and applying automated remediation playbooks.

## When to Invoke
Invoke this skill whenever you need to:
- run openscap audit
- check cis compliance openscap
- generate oscap remediation script

## Execution SOP & Rules
1. Execute oscap xccdf eval --profile <profile_id> --report report.html <data_stream_file>.
2. Select standardized security profiles (e.g. xccdf_org.ssgproject.content_profile_cis).
3. Review failing rules and generate remediation scripts with --remediate flag.
4. Archive audit reports as authoritative evidence for regulatory compliance certifications.

## Verification Checklist
- Run local linting, syntax validation, and type-checks before reporting completion.
- Ensure all created or modified files adhere to workspace boundaries and avoid uncommitted secrets.
- Verify tests or build commands exit cleanly with return code 0.