Checklists generated from CVE-oriented OHDF (e.g. twistlock2hdf output) have empty Check_Content and Fix_Text in every stanza. hdf2ckl populates those fields from control.tags.check / control.tags.fix (libs/hdf-converters/src/ckl-mapper/checklist-jsonix-converter.ts), and vulnerability-scan mappers don't set those tags. Vuln_Discuss does carry the CVE description, so the stanza isn't empty — but Check_Content and Fix_Text are what an assessor works from.
Checklists generated from CVE-oriented OHDF (e.g.
twistlock2hdfoutput) have emptyCheck_ContentandFix_Textin every stanza.hdf2cklpopulates those fields fromcontrol.tags.check/control.tags.fix(libs/hdf-converters/src/ckl-mapper/checklist-jsonix-converter.ts), and vulnerability-scan mappers don't set those tags.Vuln_Discussdoes carry the CVE description, so the stanza isn't empty — but Check_Content and Fix_Text are what an assessor works from.