Athena STIG Assessor (Community Edition)

Manually assessing systems against DISA Security Technical Implementation Guides (STIGs) is a tedious, error-prone process. This skill helps you navigate .ckl and .cklb files, ensuring every finding is backed by evidence and every "Not Applicable" status is legally defensible. It automates the administrative overhead of checklist management while keeping you in control of the security determinations.

What it does

• Checklist Triage analyzes .ckl files to identify high-risk CAT I and CAT II findings that lack documentation.
• Verification Guidance translates complex STIG Check Content into concrete, step-by-step technical commands or policy review actions.
• Evidence Recording drafts structured Finding Details that include the verification method, quoted evidence, and a clear comparison of required versus actual states.
• Automated Mapping applies SCAP XCCDF results to checklists to settle automated rules instantly.
• Defensibility Audits reviews existing finding details to flag missing hostnames, dates, or weak justifications that might fail an official inspection.

How it works

1. Health Check runs an initial scan to ensure the local ckl-mcp server is active and accessible.
2. Load & Triage imports the target checklist and generates a work queue sorted by severity and verification type.
3. Assess & Document provides the specific commands for a rule, waits for your output, and generates a formatted finding draft for approval.
4. Update & Save commits approved changes to the checklist memory and exports the final .ckl or Excel report.

Frameworks & tools

This skill requires the free, open-source ckl-mcp server to interact with local files.

• Download the binary for Windows, Linux, or macOS: https://github.com/AthenaCyberDefense/ckl-mcp/releases
• Designed for DISA STIG compliance workflows using .ckl, .cklb, and SCAP XCCDF formats.

Why this beats prompting it yourself

Generic prompts often invent evidence or hallucinate "Not Applicable" justifications that fail audits. This skill enforces strict logic: it refuses to mark a rule "Not a Finding" without quoted evidence and ensures N/A reasons are derived strictly from the rule's applicability text.

Use cases

• Performing a baseline technical assessment on a new RHEL or Windows server.
• Reviewing a junior assessor's checklist for documentation gaps before a CCRI.
• Converting raw command-line output into audit-ready finding details.
• Rapidly triaging a massive checklist to find CAT I rules requiring manual verification.

Known limitations

Does not make risk acceptance decisions or sign off on assessments. Cannot modify production system configurations without explicit user instruction. Requires the ckl-mcp server to be installed.

Privacy & trust guarantee

• Zero telemetry: The underlying ckl-mcp engine contains no telemetry, analytics, or tracking code.
• Local data boundary: Your checklist contents and infrastructure configurations remain strictly on your local machine and within your agent's configured LLM provider.
• Advisory tool: Generates advisory findings to assist engineers and does not replace formal Security Control Assessor (SCA) or Authorizing Official (AO) evaluation.