Cmmc Assessment Objectives
320 verbatim NIST 800-171A Rev 2 assessment objectives plus a Rev 2 to Rev 3 crosswalk
Otestováno · Funguje
Co umí
A single self-contained reference file carrying the full text of all 320 NIST SP 800-171A Rev 2 assessment objectives, indexed by control ID down to the lettered scoreable unit (3.1.1[c], 3.12.4[g]), together with a Rev 2 to Rev 3 control crosswalk, a withdrawn-controls table, and Examine/Interview/Test method definitions. Triggers on objective-level CMMC Level 2 lookups, evidence and POA&M planning, and questions about where a Rev 2 control lands in 800-171 Rev 3. Program-level CMMC topics such as SPRS scoring and scoping are deliberately routed to the companion cmmc-expert skill.
Testovací report
Cloned the repo and installed into an isolated temp HOME; SKILL.md landed at ~/.claude/skills/cmmc-assessment-objectives/SKILL.md, frontmatter parsed via yaml.safe_load to name+description+allowed-tools, no hardcoded /Users or /home paths, no scripts or external file references, and no curl|sh, base64, credential or prompt-injection patterns. I script-counted the body: 110 control lines and 320 lettered objective lines, and all 14 per-family counts matched the skill's own header table exactly. Output test (both artifacts in scratchpad: cmmcao_baseline.md vs cmmcao_skill.md) was an objective-level Satisfied/Other-Than-Satisfied table for 3.12.4 and 3.7.5 — the baseline reconstructed 6 objectives for 3.12.4 and hedged "roughly 6", while the file has 8, and the two the baseline missed ([d] non-applicable requirements identified, and the split of [g] frequency-defined from [h] updated-at-that-frequency) are precisely the ones the scenario fails, so the baseline under-reported the POA&M scope; the baseline also dropped "via external network connections" from 3.7.5[b]. Docs lose a point for two contradictory rows: the MP crosswalk maps 3.8.8 to 03.08.06 "into 03.08.05" while the Quick Reference Withdrawn table says 03.08.08 "into 03.08.07" (same conflict for 3.8.6), plus a hardcoded "As of 2026-05-17" and a plugin.json calling CMMC 2.0 a 5-level model; the skill is otherwise unusually honest, flagging 11 of 14 crosswalk families as training-knowledge rather than PDF-verified.
Testováno: 2026-07-21 · Claude Code 2.x (agent harness)
Instalace
git clone --depth 1 https://github.com/GRCEngClub/claude-grc-engineering.git /tmp/cmmc-assessment-objectives-src
mkdir -p ~/.claude/skills
cp -R /tmp/cmmc-assessment-objectives-src/plugins/frameworks/cmmc/skills/cmmc-assessment-objectives ~/.claude/skills/cmmc-assessment-objectives
# No dependencies, no API keys, no scripts. One self-contained 72KB SKILL.md.
# frontmatter: allowed-tools: Read, Glob, Grep, Write
# The body cross-references a companion skill for program-level CMMC topics
# (SPRS scoring, POA&M rules, scoping, C3PAO lifecycle). Install it too:
# cp -R /tmp/cmmc-assessment-objectives-src/plugins/frameworks/cmmc/skills/cmmc-expert ~/.claude/skills/cmmc-expert
# Plugin-marketplace alternative: the repo ships .claude-plugin/marketplace.json
# ("grc-engineering-suite") with a "cmmc" plugin at ./plugins/frameworks/cmmc
# that bundles both skills plus 5 slash commands (assess, level-select,
# practice-check, domain-guidance, evidence-checklist).
# Note: 72KB loads into context on trigger — heavy but functional. Příkazy a ukázkové prompty
/cmmc-assessment-objectives320 verbatim NIST 800-171A Rev 2 assessment objectives plus a Rev 2 to Rev 3 crosswalk
Skilly se spouštějí běžnými požadavky — žádné příkazy k zapamatování. Po instalaci ho aktivují prompty jako tyto (anglicky):
Look up assessment objective 3.1.1[c]Map this Rev 2 control to Rev 3Plan evidence for this CMMC assessment objective