oscal skills guardrails.stub

---

id: oscal-skills-guardrails name: OSCAL Skills Guardrails repo_path: ~/Documents/sw30labs/repos/oscal-skills-guardrails remote_url: https://github.com/sw30labs/oscal-skills-guardrails.git primary_language: Python framework: LangGraph DeepAgents ingested: 2026-07-04 last_commit_date: 2026-07-04 category: oscal-compliance stacks: [oscal, agentic, langgraph, mcp, compliance, cli]

OSCAL Skills Guardrails

Purpose

OSCAL as the policy brain for Agent Skills. Shifts the guardrail target from tools (its ancestor oscal-agent-guardrails) to Agent Skills — SKILL.md directories. Every skill is vetted by two independent evidence streams before admission — a static scanner (skillspector-trial) that catches the shape of an attack, and a local LLM rubric judge that catches its meaning — then admitted, interrupted for approval, or blocked against a risk appetite declared once as a NIST OSCAL profile. Every decision is emitted back out as OSCAL assessment-results.

Architecture

Admission-control pipeline compiled from one OSCAL profile (SG-1…SG-9 control catalog, mapped to NIST SP 800-53):

1. SkillRegistry — parses SKILL.md, computes a SHA-256 content digest, scans.
2. CompositeSkillScanner — merges static (Skillspector) + semantic (rubric judge R1–R7) findings into one severity stream.
3. GuardrailPolicy — compiled from the OSCAL profile via oscal_loader; gates on max_scan_severity, min_score, min_grade, require_rubric, required metadata, and per-skill effects.
4. DeepAgents factory — filters skills/tools per policy, materializes filesystem permissions, re-verifies digests (TOCTOU guard), and installs runtime tool-call middleware.
5. OscalAssessmentSink — serializes every decision as OSCAL assessment-results observations + findings.

Fail-closed throughout: unknown skill → not loaded; scanner crash or missing score → deny; digest drift → SkillIntegrityError.

Dependencies

• pyyaml (core; stdlib-only elsewhere)
• deepagents, langchain-mcp-adapters (optional [deepagents] extra)
• mcp (optional [mcp] — scanner-as-MCP server)
• langchain (optional [judge] — LangChain judge adapter)
• Node ≥18 for the Skillspector CLI wrapper (scripts/scan_skill.mjs)

CI/CD

GitHub Actions skill-gate.yml — the reference implementation of CI-gated skill governance. Two required checks on every PR: admit (adjudicate the catalog against the OSCAL profile, upload assessment-results.json as the compliance artifact) and verify (recompute digests against the committed skills.lock.json). Both wired as branch-protection required checks. Demo PR #1 adds a deliberately malicious meeting-notes skill — scores 100/A on the static scan, denied on meaning — and is left permanently red as a living exhibit.

Local judge

Rubric judge runs against a local oMLX server (OpenAI-compatible, Apple Silicon), default model Qwen3.6-27B-bf16 — skills never leave the machine. Pluggable adapters: omlx_judge, openai_chat_judge, command_judge, langchain_judge.

Tags

python langgraph oscal nist security compliance mcp llm local-inference cli

Cross-references

• oscal-agent-guardrails
• skillspector-trial
• oscal-zero-trust-lens
• oscal-agent-lab