/validate
Validate an OSCAL document (catalog, profile, SSP, SAP, SAR, POA&M, component definition, assessment results) against the official JSON schemas.
$ npx -y skills add GRCEngClub/claude-grc-engineering --agent claude-codeHow it fires
How this command gets triggered: by you, by Claude, or both.
- Fires itselfClaude auto-loads it when your prompt matches the work.
- You can call itInvoke it directly when you want it.
- Slash command
/validate
Context preview
What this command does when you run it.
Validate an OSCAL document (catalog, profile, SSP, SAP, SAR, POA&M, component definition, assessment results) against the official JSON schemas.
Command definition
validate.mdname: OSCAL Validate
description: Validate an OSCAL document (catalog, profile, SSP, SAP, SAR, POA&M, component definition, assessment results) against the official JSON schemas.
/oscal:validate
Validates an OSCAL document against the NIST JSON schemas bundled with `oscal-cli`. Supports JSON, XML, and YAML input (XML/YAML are auto-converted internally for validation).
How to run
bash plugins/oscal/scripts/validate.sh <file> [--quiet] [--json]
Arguments
- `<file>` — path to the OSCAL document to validate.
- `--quiet` — only emit on failure.
- `--json` — structured JSON output `{ok: bool, errors: [...], schema_version: "1.1.3"}` for CI pipelines.
What it validates
- JSON schema conformance (structural + type)
- Required fields present
- Enum values valid
- UUID format for all identifiers
- OSCAL version declared and supported
Exit codes
- `0` — valid
- `6` — schema violation(s); details on stderr (or stdout JSON with `--json`)
- `2` — file not found / unreadable
- `5` — `oscal` binary not installed (run `/oscal:setup`)
Example
/oscal:validate gap-assessment-20260413/gap-report.oscal-ar
This checks that `/grc-engineer:gap-assessment`'s OSCAL Assessment Results output is well-formed before handing it to downstream tooling (Compliance Trestle, eMASS, FedRAMP 20X).
Non-goals
- **Semantic validation** (e.g., does this SSP actually align with its referenced catalog?). Use `oscal-cli resolve` (coming in a future release) or Compliance Trestle for that.
- **FedRAMP-specific constraint checking**. For that, combine this with the `fedramp-ssp` plugin and the `fedramp-docs` MCP for spec lookups.
Read more
name: OSCAL Validate description: Validate an OSCAL document (catalog, profile, SSP, SAP, SAR, POA&M, component definition, assessment results) against the official JSON schemas.
/oscal:validate
Validates an OSCAL document against the NIST JSON schemas bundled with `oscal-cli`. Supports JSON, XML, and YAML input (XML/YAML are auto-converted internally for validation).
How to run
bash plugins/oscal/scripts/validate.sh <file> [--quiet] [--json]
Arguments
- `<file>` — path to the OSCAL document to validate.
- `--quiet` — only emit on failure.
- `--json` — structured JSON output `{ok: bool, errors: [...], schema_version: "1.1.3"}` for CI pipelines.
What it validates
- JSON schema conformance (structural + type)
- Required fields present
- Enum values valid
- UUID format for all identifiers
- OSCAL version declared and supported
Exit codes
- `0` — valid
- `6` — schema violation(s); details on stderr (or stdout JSON with `--json`)
- `2` — file not found / unreadable
- `5` — `oscal` binary not installed (run `/oscal:setup`)
Example
/oscal:validate gap-assessment-20260413/gap-report.oscal-ar
This checks that `/grc-engineer:gap-assessment`'s OSCAL Assessment Results output is well-formed before handing it to downstream tooling (Compliance Trestle, eMASS, FedRAMP 20X).
Non-goals
- **Semantic validation** (e.g., does this SSP actually align with its referenced catalog?). Use `oscal-cli resolve` (coming in a future release) or Compliance Trestle for that.
- **FedRAMP-specific constraint checking**. For that, combine this with the `fedramp-ssp` plugin and the `fedramp-docs` MCP for spec lookups.
Open-source GRC Engineering resource for Claude. claude-grc-engineering turns technical evidence from cloud, SaaS, code, and security tools into framework-aligned findings, gap reports, remediation guidance, evidence packages, and OSCAL workflows.
Repo: GRCEngClub/claude-grc-engineering
Other commands on trust-center.
- /research
Start or resume an academic research project — idea through literature, methodology, writing, feedback, and publishing
Open command - /collect
Query AWS for compliance-relevant configuration across IAM, S3, CloudTrail, EBS, and emit findings conforming to the v1 contract.
Open command - /setup
Install the frdocx-to-froscal-ssp Python pipeline and verify its dependencies. Idempotent.
Open command - /status
Check the deployment status of the trust center.
Open command - /scan
Run testssl.sh against one or more HTTPS endpoints and emit v1 Findings mapped to SOC 2, NIST 800-53, PCI DSS 4.0.1, ISO 27001, and SCF controls.
Open command - /compliance-posture
Serve a localhost compliance posture dashboard from monitor-continuous JSON
Open command