# Export Oscal

> Export NIST OSCAL (Open Security Controls Assessment Language) JSON from compliance

- Skill: `majiayu000/export-oscal` (Agent Skill, multi-file: 2 files)
- Install (CLI): `npx skillmds@latest add majiayu000/export-oscal`
- Raw SKILL.md: https://api.skillmd.com/api/skills/majiayu000/export-oscal/raw
- Safety review: pending (external: skill-scanner PASS, skillspector PASS)
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- Author: majiayu000 (https://skillmd.com/u/majiayu000)
- Updated: 2026-09-09
- Page: https://skillmd.com/skills/majiayu000/export-oscal

---


---
name: export-oscal
description: NIST OSCAL JSON export of compliance evidence from ArangoDB graph
triggers:
  - "export oscal"
  - "oscal export"
  - "compliance export"
allowed-tools:
  - Bash
provides:
  - export-oscal
composes: [, task-monitor]
---

# Export OSCAL

Export NIST OSCAL (Open Security Controls Assessment Language) JSON from compliance
evidence stored in the ArangoDB graph. Supports NIST 800-171 and CMMC Level 2
frameworks.

## Usage

### Export compliance evidence

```bash
./run.sh export --framework NIST-800-171
./run.sh export --framework CMMC-L2
```

### Dry run (no ArangoDB required)

```bash
./run.sh export --framework NIST-800-171 --dry-run
```

Generates a valid OSCAL assessment-results structure with example data. Useful for
testing downstream consumers without a running database.

### Validate an OSCAL file

```bash
./run.sh validate <file.json>
```

Checks that the JSON file contains required OSCAL assessment-results fields:
`uuid`, `metadata`, and `results`.

## Output

All output goes to stdout as formatted JSON. Redirect to a file as needed:

```bash
./run.sh export --framework NIST-800-171 > oscal-export.json
```

## OSCAL Structure

The exported JSON follows the OSCAL assessment-results model:

- `uuid` -- unique identifier for this export
- `metadata.title` -- framework name and export context
- `metadata.last-modified` -- ISO 8601 timestamp
- `metadata.version` -- export version
- `metadata.oscal-version` -- OSCAL specification version
- `results[]` -- array of assessment results, each mapping a control to evidence
  - `uuid` -- unique result identifier
  - `title` -- control identifier and name
  - `start` -- assessment timestamp
  - `findings[]` -- evidence entries from QRA and lessons collections

## Data Sources

Queries three ArangoDB collections in the `sparta` database:

| Collection | Purpose |
|------------|---------|
| `sparta_controls` | Control definitions and status |
| `sparta_qra` | QRA (Question-Response-Action) evidence entries |
| `lessons` | Lessons learned linked to controls |