euCanneuCann/OSCAL-GRC-SKILLS/skills/oscal-visualizer/SKILL.md

oscal-visualizer

Skill8 starsChanged 10 months agoMITView on GitHub

Create visual diagrams and representations of OSCAL documents including control hierarchies, component relationships, implementation flows, and SSP overviews. Inspired by oscal-diagrams and community visualization tools.

In this repository15 other files it gives its agents.
- advanced-oscal-validatorSkill
- compliance-report-generatorSkill
- component-definition-builderSkill
- control-implementation-generatorSkill
- control-mapperSkill
- controls-extractorSkill
- evidence-collectorSkill
- oscal-catalog-providerSkill
- oscal-control-mapperSkill
- oscal-parserSkill
- oscal-ssp-validatorSkill
- oscal-text-converterSkill
- oscal-validatorSkill
- risk-assessorSkill
- workflow-orchestratorSkill

The file

We split this skill into the rules it gives an agent

4 rules. About 0 are common, 4 are distinctive, and 0 are very specific to this project.

≈0
Common · estimate
Many files like this have a rule of this kind.
≈4
Distinctive · estimate
This author's own choices. Worth a look.
0
Very specific
Tied to their project's names, files or tools. Probably skip.

Common
Distinctive
Very specific

Distinctive:
Create visual representations of OSCAL documents to help understand control structures, relationships, and compliance status.
line 8
Distinctive:
Use this skill when you need to:
line 12
Distinctive:
Create SSP overview diagrams
line 16
Distinctive:
When asked "Visualize the control coverage in this SSP":
line 216

≈ “Common” is an estimate: at least 1 in 5 of the 350,495 skill files we read have a rule of the same kind, not the same words. “Very specific” is our guess from the words: it names a file, a command, a setting or the project itself.

Keep what fits and drop the rest. Your version, ready for your agents.

Files

SKILL.md

OSCAL Visualizer Skill

Create visual representations of OSCAL documents to help understand control structures, relationships, and compliance status.

When to Use This Skill

Use this skill when you need to:

Visualize control hierarchies and families
Show component relationships
Display implementation coverage
Create SSP overview diagrams
Generate assessment flow charts
Produce compliance dashboards

✅ Data Source Principle

This skill creates visualizations from documents you provide. All diagram content reflects your OSCAL data — no compliance information is generated from training knowledge.

Diagram Types

Type	Purpose	Best For
Control Hierarchy	Show control families and relationships	Catalogs, profiles
Component Relationships	Map components to controls	Component definitions
Implementation Flow	Show how controls are implemented	SSPs
Profile Inheritance	Display profile layering	Profiles
SSP Overview	System security summary	SSPs
Assessment Flow	Assessment process visualization	SAP, SAR

Visualization Color Schemes

Control Families

Family	Color	Hex
AC (Access Control)	Red	#FF6B6B
AU (Audit)	Teal	#4ECDC4
CM (Config Mgmt)	Green	#96CEB4
IA (Auth)	Purple	#DDA0DD
SC (Sys/Comm)	Med Purple	#9370DB
SI (Integrity)	Turquoise	#00CED1

Implementation Status

Status	Color	Symbol
Implemented	Green	✅
Partial	Yellow	⚠️
Planned	Blue	🔵
Not Applicable	Gray	➖
Missing	Red	❌

How to Create Visualizations

Control Hierarchy Diagram

For catalogs and profiles:

NIST 800-53 Rev 5
├── Access Control (AC) [20 controls]
│   ├── AC-1: Policy and Procedures
│   ├── AC-2: Account Management
│   │   ├── AC-2(1): Automated Management
│   │   ├── AC-2(2): Automated Temporary Accounts
│   │   └── AC-2(3): Disable Accounts
│   └── AC-3: Access Enforcement
│       └── AC-3(1): Restricted Access
├── Audit and Accountability (AU) [16 controls]
│   ├── AU-1: Policy and Procedures
│   └── AU-2: Event Logging
...

Component Relationship Diagram

┌─────────────────────────────────────────────────┐
│                   SYSTEM                         │
├─────────────────────────────────────────────────┤
│                                                  │
│  ┌──────────┐    ┌──────────┐    ┌──────────┐  │
│  │ Azure AD │────│ App Svc  │────│ Azure DB │  │
│  └────┬─────┘    └────┬─────┘    └────┬─────┘  │
│       │               │               │         │
│  ┌────┴─────┐    ┌────┴─────┐    ┌────┴─────┐  │
│  │ AC-2,IA-2│    │ SC-7,CM-6│    │ SC-28,AU-2│  │
│  │ IA-5,AU-2│    │ SI-3,SI-4│    │ AC-3,SC-8 │  │
│  └──────────┘    └──────────┘    └──────────┘  │
│                                                  │
└─────────────────────────────────────────────────┘

Implementation Status Heatmap

CONTROL IMPLEMENTATION STATUS
=============================

     AC  AT  AU  CA  CM  CP  IA  IR  MA  MP  PE  PL  PM  PS  RA  SA  SC  SI
    ┌───┬───┬───┬───┬───┬───┬───┬───┬───┬───┬───┬───┬───┬───┬───┬───┬───┬───┐
Imp │███│███│███│███│███│░░░│███│███│███│███│░░░│███│███│███│███│███│███│███│
Par │░░░│░░░│░░░│░░░│░░░│███│░░░│░░░│░░░│░░░│███│░░░│░░░│░░░│░░░│░░░│░░░│░░░│
Pln │░░░│░░░│░░░│░░░│░░░│░░░│░░░│░░░│░░░│░░░│░░░│░░░│░░░│░░░│░░░│░░░│░░░│░░░│
N/A │░░░│░░░│░░░│░░░│░░░│░░░│░░░│░░░│░░░│░░░│░░░│░░░│░░░│░░░│░░░│░░░│░░░│░░░│
    └───┴───┴───┴───┴───┴───┴───┴───┴───┴───┴───┴───┴───┴───┴───┴───┴───┴───┘

Legend: ███ = Present  ░░░ = None

SSP Overview Diagram

┌─────────────────────────────────────────────────────────────┐
│                    SYSTEM SECURITY PLAN                      │
│                   [System Name v1.0.0]                       │
├─────────────────────────────────────────────────────────────┤
│                                                              │
│  ┌─────────────┐      ┌─────────────┐      ┌─────────────┐  │
│  │  METADATA   │      │   PROFILE   │      │   SYSTEM    │  │
│  │             │      │   IMPORT    │      │   CHARS     │  │
│  │ FedRAMP Mod │──────│ NIST 800-53 │──────│ Cloud SaaS  │  │
│  │ v2024.01    │      │ Moderate    │      │ Boundary    │  │
│  └─────────────┘      └─────────────┘      └─────────────┘  │
│                              │                               │
│                              ▼                               │
│  ┌───────────────────────────────────────────────────────┐  │
│  │            CONTROL IMPLEMENTATION                      │  │
│  │                                                        │  │
│  │  Controls: 325     Implemented: 287 (88%)             │  │
│  │  Partial: 25       Planned: 10      N/A: 3            │  │
│  │                                                        │  │
│  │  ┌────────┐ ┌────────┐ ┌────────┐ ┌────────┐         │  │
│  │  │AC: 100%│ │AU: 95% │ │CM: 90% │ │SC: 85% │         │  │
│  │  └────────┘ └────────┘ └────────┘ └────────┘         │  │
│  └───────────────────────────────────────────────────────┘  │
│                                                              │
└─────────────────────────────────────────────────────────────┘

Profile Inheritance Diagram

                    ┌──────────────────┐
                    │   NIST 800-53    │
                    │   (Catalog)      │
                    │   1189 controls  │
                    └────────┬─────────┘
                             │
              ┌──────────────┼──────────────┐
              ▼              ▼              ▼
      ┌───────────┐  ┌───────────┐  ┌───────────┐
      │   LOW     │  │ MODERATE  │  │   HIGH    │
      │ Baseline  │  │ Baseline  │  │ Baseline  │
      │ 200 ctrls │  │ 325 ctrls │  │ 421 ctrls │
      └─────┬─────┘  └─────┬─────┘  └─────┬─────┘
            │              │              │
            ▼              ▼              ▼
      ┌───────────┐  ┌───────────┐  ┌───────────┐
      │ FedRAMP   │  │ FedRAMP   │  │ FedRAMP   │
      │ LOW       │  │ MODERATE  │  │ HIGH      │
      │ +tailored │  │ +tailored │  │ +tailored │
      └───────────┘  └───────────┘  └───────────┘

Compliance Dashboard View

╔═══════════════════════════════════════════════════════════╗
║              COMPLIANCE DASHBOARD                          ║
╠═══════════════════════════════════════════════════════════╣
║                                                            ║
║  OVERALL COMPLIANCE          RISK LEVEL                   ║
║  ┌────────────────┐          ┌────────────────┐           ║
║  │      88%       │          │    MODERATE    │           ║
║  │   ████████░░   │          │    ▲▲▲░░       │           ║
║  └────────────────┘          └────────────────┘           ║
║                                                            ║
║  CONTROL STATUS                POA&M STATUS               ║
║  ┌──────────────────┐         ┌──────────────────┐        ║
║  │ ✅ Impl:    287  │         │ Open:        15  │        ║
║  │ ⚠️  Partial:  25  │         │ In Progress:  8  │        ║
║  │ 🔵 Planned:  10  │         │ Overdue:      3  │        ║
║  │ ➖ N/A:       3  │         │ Closed (30d): 12 │        ║
║  └──────────────────┘         └──────────────────┘        ║
║                                                            ║
║  FAMILY COVERAGE                                          ║
║  AC ████████████████████ 100%                             ║
║  AU ██████████████████░░  95%                             ║
║  CM ████████████████░░░░  90%                             ║
║  IA ██████████████████░░  95%                             ║
║  SC █████████████████░░░  85%                             ║
║                                                            ║
╚═══════════════════════════════════════════════════════════╝

Output Formats

Format	Use Case
ASCII	Terminal display, text reports
Mermaid	Documentation, GitHub
DOT/Graphviz	Complex relationships
SVG	Web display
Markdown tables	Documentation

Example Usage

When asked "Visualize the control coverage in this SSP":

Parse the SSP document
Extract control implementations
Group by family
Calculate percentages by status
Generate appropriate visualization
Include legend and summary statistics

Download now (ZIP)

Does it work?

Reviews from people and from AI agents that ran it: what they used it for, and whether it worked.

No reviews yet

People and AI agents can review whether this works in practice. Say what you used it for, and whether it worked.

It worked
Partly
It didn't

What did you use it for? e.g. Reviewing pull requests in a Rails app

Using an agent? It can post a review for you after it has run the file: the MCP tool registry_write, action report. How to connect one.

Your trail

Files you open will collect here, so you can find them again.

Open two or more, and you can remix the rules you like from each into one list. Kept in this browser only.

Now do this for your own.

Bring your CLAUDE.md, AGENTS.md or skills. agentleFS shows which of your rules are common, which are yours and which only fit one project, and keeps one version your agents read everywhere.

Check your setup, free