security-bluebook-builder
Create or refine a concise, normative security policy ("Blue Book") for sensitive applications. Use when users need a threat model, data classification rules, auth/session policy, logging and audit requirements, retention/deletion expectations, incident response, or security...
Best use case
security-bluebook-builder is best used when you need a repeatable AI agent workflow instead of a one-off prompt.
Create or refine a concise, normative security policy ("Blue Book") for sensitive applications. Use when users need a threat model, data classification rules, auth/session policy, logging and audit requirements, retention/deletion expectations, incident response, or security...
Teams using security-bluebook-builder should expect a more consistent output, faster repeated execution, less prompt rewriting.
When to use this skill
- You want a reusable workflow that can be run more than once with consistent structure.
When not to use this skill
- You only need a quick one-off answer and do not need a reusable workflow.
- You cannot install or maintain the underlying files, dependencies, or repository context.
Installation
Claude Code / Cursor / Codex
Manual Installation
- Download SKILL.md from GitHub
- Place it in
.claude/skills/security-bluebook-builder/SKILL.mdinside your project - Restart your AI agent — it will auto-discover the skill
How security-bluebook-builder Compares
| Feature / Agent | security-bluebook-builder | Standard Approach |
|---|---|---|
| Platform Support | Not specified | Limited / Varies |
| Context Awareness | High | Baseline |
| Installation Complexity | Unknown | N/A |
Frequently Asked Questions
What does this skill do?
Create or refine a concise, normative security policy ("Blue Book") for sensitive applications. Use when users need a threat model, data classification rules, auth/session policy, logging and audit requirements, retention/deletion expectations, incident response, or security...
Where can I find the source code?
You can find the source code on GitHub using the link provided at the top of the page.
SKILL.md Source
# Security Bluebook Builder ## Overview Build a minimal but real security policy for sensitive apps. The output is a single, coherent Blue Book document using MUST/SHOULD/CAN language, with explicit assumptions, scope, and security gates. ## Workflow ### 1) Gather inputs (ask only if missing) Collect just enough context to fill the template. If the user has not provided details, ask up to 6 short questions: - What data classes are handled (PII, PHI, financial, tokens, content)? - What are the trust boundaries (client/server/third parties)? - How do users authenticate (OAuth, email/password, SSO, device sessions)? - What storage is used (DB, object storage, logs, analytics)? - What connectors or third parties are used? - Retention and deletion expectations (default + user-initiated)? If the user cannot answer, proceed with safe defaults and mark TODOs. ### 2) Draft the Blue Book Load `references/bluebook_template.md` and fill it with the provided details. Keep it concise, deterministic, and enforceable. ### 3) Enforce guardrails - Do not include secrets, tokens, or internal credentials. - If something is unknown, write "TODO" plus a clear assumption. - Fail closed: if a capability is required but unavailable, call it out explicitly. - Keep scope minimal; do not add features or tools beyond what the user asked for. ### 4) Quality checks Confirm the Blue Book includes: - Threat model (assumptions + out-of-scope) - Data classification + handling rules - Trust boundaries + controls - Auth/session policy - Token handling policy - Logging/audit policy - Retention/deletion - Incident response mini-runbook - Security gates + go/no-go checklist ## Resources - `references/bluebook_template.md`
Related Skills
web-security-testing
Web application security testing workflow for OWASP Top 10 vulnerabilities including injection, XSS, authentication flaws, and access control issues.
web-artifacts-builder
Suite of tools for creating elaborate, multi-component claude.ai HTML artifacts using modern frontend web technologies (React, Tailwind CSS, shadcn/ui). Use for complex artifacts requiring state ma...
viral-generator-builder
Expert in building shareable generator tools that go viral - name generators, quiz makers, avatar creators, personality tests, and calculator tools. Covers the psychology of sharing, viral mechanic...
telegram-bot-builder
Expert in building Telegram bots that solve real problems - from simple automation to complex AI-powered bots. Covers bot architecture, the Telegram Bot API, user experience, monetization strategie...
solidity-security
Master smart contract security best practices to prevent common vulnerabilities and implement secure Solidity patterns. Use when writing smart contracts, auditing existing contracts, or implementin...
slack-bot-builder
Build Slack apps using the Bolt framework across Python, JavaScript, and Java. Covers Block Kit for rich UIs, interactive components, slash commands, event handling, OAuth installation flows, and W...
seo-authority-builder
Analyzes content for E-E-A-T signals and suggests improvements to build authority and trust. Identifies missing credibility elements. Use PROACTIVELY for YMYL topics.
aws-security-audit
Comprehensive AWS security posture assessment using AWS CLI and security best practices
security-scanning-security-sast
Static Application Security Testing (SAST) for code vulnerability analysis across multiple languages and frameworks
security-scanning-security-hardening
Coordinate multi-layer security scanning and hardening across application, infrastructure, and compliance controls.
security-scanning-security-dependencies
You are a security expert specializing in dependency vulnerability analysis, SBOM generation, and supply chain security. Scan project dependencies across ecosystems to identify vulnerabilities, ass...
security-requirement-extraction
Derive security requirements from threat models and business context. Use when translating threats into actionable requirements, creating security user stories, or building security test cases.