Agent Skills

Skills are predefined task templates that guide the agent through specific compliance workflows.

Available Skills

Skill	Description
`gap-analysis`	Assess codebase against framework controls, identify gaps, and prioritize remediation
`narrative-generation`	Generate auditor-ready implementation narratives for controls
`evidence-collection`	Collect and map evidence from codebase to controls
`security-review`	Review codebase for security controls and compliance posture
`stig-scan`	Run STIG compliance scans against a system
`cci-assessment`	Assess CCI compliance for a specific control

Using Skills

# Gap analysis
pretorin agent run --skill gap-analysis "Analyze my system compliance gaps"

# Narrative generation
pretorin agent run --skill narrative-generation "Generate narratives for all AC controls"

# Evidence collection
pretorin agent run --skill evidence-collection "Collect evidence for AC-02 in this repo"

# Security review
pretorin agent run --skill security-review "Review this codebase for AC-02 coverage"

# STIG scan
pretorin agent run --skill stig-scan "Check STIG applicability for my system"

# CCI assessment
pretorin agent run --skill cci-assessment "Assess CCI compliance for AC-02"

List Skills

pretorin agent skills

Skill Details

Gap Analysis

Systematically assesses a codebase against a framework’s controls. The agent:

Scopes the assessment to relevant control families
Prioritizes families with code evidence (Access Control, Audit, IA, SC, CM)
Searches the codebase for evidence matching AI guidance expectations
Assigns implementation status per control
Produces a report with findings and priority remediation items

See Gap Analysis Workflow for the detailed methodology.

Narrative Generation

Generates control implementation narratives that meet auditor-readiness requirements:

No markdown headings
At least two rich markdown elements (code blocks, tables, lists, links)
At least one structural element (code block, table, or list)
TODO placeholders for missing information
Only documents observable facts (no hallucination)

Evidence Collection

Searches the codebase for evidence that maps to specific controls:

Identifies relevant files and code patterns
Creates evidence items with auditor-ready descriptions
Links evidence to controls via the platform
Flags gaps where evidence is missing

Security Review

Reviews the codebase against specific controls:

Analyzes code for control coverage
Identifies implementation strengths and weaknesses
Documents findings with file paths and line numbers
Pushes monitoring events for critical or high-severity findings
Produces remediation recommendations

STIG Scan

Runs STIG compliance scans against a system:

Checks which STIGs apply to the system (applicability)
Gets the test manifest (rules to evaluate)
Reports available scanners and rule coverage
Summarizes the scan plan and gaps in automated coverage

CCI Assessment

Assesses CCI-level compliance for a specific control:

Gets control context and implementation status
Lists CCIs for the target control
Checks CCI-level test results (pass/fail/not tested)
Identifies CCIs with no test coverage
Presents results as a traceability chain: Control -> CCIs -> SRGs -> STIG rules