CtrlK
BlogDocsLog inGet started
Tessl Logo
SkillPublic

cmmc

Expert CMMC 2.0 (Cybersecurity Maturity Model Certification) advisor for US defense contractors and subcontractors in the Defense Industrial Base (DIB). Use this skill whenever a user asks about CMMC 2.0, CMMC Level 1, Level 2, or Level 3, DoD cybersecurity compliance, NIST SP 800-171, CUI (Controlled Unclassified Information) protection, System Security Plan (SSP), Plan of Action & Milestones (POA&M), C3PAO assessments, DIBCAC audits, self-assessment, SPRS score, or any requirement under DFARS 252.204-7012 or 7021. Also trigger for: "CMMC gap analysis", "CMMC readiness", "FCI protection", "CUI scoping", "CMMC practices", "DoD contract cybersecurity", "defense supply chain security", "prime contractor flow-down requirements", the July 2026 CMMC Phase 2 suspension, or the CMMC Reform Task Force.

Quality

89%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide
SecuritybySnyk

Passed

No findings from the security scan

SKILL.md
Quality
Evals
Security

Quality

Content

82%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A dense, highly actionable compliance manual: exact thresholds, named practices, decision tables, and a genuinely instructive worked example, with clean one-level-deep reference wiring. The main costs are token duplication between the body and the reference files and the absence of explicit validation checkpoints in the delivery workflows.

Suggestions

Move the Key Regulatory References table, the 14-domain practice-count table, and the C3PAO phase/evidence details into the reference files (the same content already exists in cmmc-levels.md and cmmc-assessment.md), keeping only one-line inline pointers — this cuts body tokens and eliminates divergence risk between body and references.

Add explicit validation checkpoints to the delivery workflows, e.g., 'Before delivering a gap table, confirm every NOT MET row names its evidence artifact and that the recomputed SPRS deduction total matches the stated score.'

Consolidate the July 2026 suspension status — currently stated in the program-status banner, the answer-completeness rules, and level-determination step 4 — into a single canonical section referenced from the other spots.

DimensionReasoningScore

Conciseness

The body is dense with program-specific facts Claude cannot be assumed to know (SPRS 5/3/1 weighted deductions, the −203 floor, the 180-day closeout, the critical-practice list, the July 2026 suspension) and contains no basic-concept padding. It falls short of 5 because the Key Regulatory References table, the 14-domain practice-count table, the C3PAO phases, and the evidence-type lists duplicate content in the reference files, and the suspension status is repeated in three places.

4 / 5

Actionability

Fully concrete guidance for an instruction-only skill: exact output table formats with column headers per task type, exact thresholds (score ≥ 88, 1-point-only POA&M items, 180-day closeout, 72-hour DIBNET reporting), named 5-point and critical practices, the SPRS submission URL, and a worked example ('Eight 1-point misses = score 102 → conditional certification with a 180-day clock') that models the arithmetic.

5 / 5

Workflow Clarity

The level-determination, gap-assessment, scoping, and self-assessment workflows are clearly sequenced with decision tables, an explicit dependency ('Determine the required CMMC level before doing anything else'), and concrete gates (the two-part ≥88 AND 1-point-only conditional-certification gate). It is not a 5 because workflows lack explicit validation checkpoints on their own work products (e.g., verifying every gap-table row names its evidence before delivery).

4 / 5

Progressive Disclosure

All three referenced files (references/cmmc-practices.md, references/cmmc-levels.md, references/cmmc-assessment.md) exist, are one level deep with no further chaining, and are well signaled both inline ('Consult references/...') and in a per-task 'Reference Files' section. It is not a 5 because the body inlines a fair amount of reference-duplicated detail (regulatory references table, domain-count table, C3PAO phases, evidence types) rather than remaining a lean overview.

4 / 5

Total

17

/

20

Passed

Description

90%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

Exceptional trigger-term coverage and doubly explicit use-when guidance define a clear, conflict-free niche in the defense-compliance space. The only weakness is that the capability statement is a persona ('advisor') with no concrete function verbs, leaving the specific activities (gap assessment, SSP drafting, SPRS calculation) to be inferred from the trigger list.

DimensionReasoningScore

Specificity

The domain is named exhaustively — 'Expert CMMC 2.0 (Cybersecurity Maturity Model Certification) advisor for US defense contractors and subcontractors in the Defense Industrial Base (DIB)' plus concrete artifacts (SSP, POA&M, SPRS score, C3PAO assessments, DIBCAC audits) — but the only capability verb is the generic 'advisor'. Not a 2 because coverage far exceeds the minimal 'Processes PDF files' anchor; not a 4 because no concrete action verbs ('drafts', 'calculates', 'assesses') are explicitly stated.

3 / 5

Completeness

Explicitly answers what ('Expert CMMC 2.0 ... advisor for US defense contractors and subcontractors in the DIB') and when, twice over: 'Use this skill whenever a user asks about ...' and 'Also trigger for: ...' with concrete trigger phrases, exceeding the anchor-5 example's when-clause.

5 / 5

Trigger Term Quality

Comprehensive natural-language terms with full names, acronyms, and synonyms — 'CMMC gap analysis', 'CMMC readiness', 'FCI protection', 'CUI scoping', 'SPRS score', 'DFARS 252.204-7012 or 7021', 'the July 2026 CMMC Phase 2 suspension', 'CMMC Reform Task Force' — exactly what a DIB compliance user would say, including program-specific events no other skill would claim.

5 / 5

Distinctiveness Conflict Risk

A clear niche (CMMC/DoD cybersecurity compliance for defense contractors) anchored by unique clause numbers and named program events; no other skill would plausibly claim these triggers, so conflict risk is minimal.

5 / 5

Total

18

/

20

Passed

Validation

100%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 16 / 16 Passed

Validation for skill structure

No warnings or errors.

Repository

Sushegaad/Claude-Skills-Governance-Risk-and-Compliance

Path

plugins/cmmc/skills/cmmc/SKILL.md

Reviewed

Table of Contents

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.