Jeden Skill in Manus ausführen
mit einem Klick

Jeden Skill in Manus mit einem Klick ausführen

blueteam

Sterne3

Forks1

Aktualisiert23. Juni 2026 um 04:04

Run a blue team defensive security assessment on the app: OWASP ASVS Level 2, CAS compliance, threat modeling, kill chains, deterministic scanning, and HTML report generation.

Installation

Mit Codex oder Claude installieren Kopieren Sie diesen Prompt, fügen Sie ihn in Codex, Claude oder einen anderen Assistant ein und lassen Sie die Skill-Seite prüfen und installieren.

In Manus ausführen

Quelle

GovAlta

GovAlta/COMMON-HARNESS

GitHub-Repository öffnen Creator-Repositorys ansehen

Download

In Manus ausführen

Verwandte BerufeSOC

Basierend auf der SOC-Berufsklassifikation

InformationssicherheitsanalystenInformatik- und Mathematikberufe·SOC 15-1212

SKILL.md

readonly

name	blueteam
description	Run a blue team defensive security assessment on the app: OWASP ASVS Level 2, CAS compliance, threat modeling, kill chains, deterministic scanning, and HTML report generation.

Blue Team Security Assessment

Run the full defensive security assessment pipeline against ./app/.

Usage

/blueteam                          # Assess ./app/ with full pipeline
/blueteam --target /path/to/app    # Assess a different target
/blueteam --step 5                 # Resume from step 5 (ASVS assessment)

Prerequisites

cd .claude/security/blueteam && npm install

Pipeline

Execute these steps in order. Read .claude/security/blueteam/CLAUDE.md for the full protocol.

Step	Skill	File
1	Load preflight	`.claude/security/blueteam/shared/skills/preflight.md`
2	Application map	`.claude/security/blueteam/skills/01-application-map.md`
3	Security classification	`.claude/security/blueteam/skills/02-security-classification.md`
4	Security architecture (optional)	`.claude/security/blueteam/skills/03-security-architecture.md`
5	Threat model	`.claude/security/blueteam/skills/04-threat-model.md`
6	ASVS Level 2 assessment	`.claude/security/blueteam/skills/05-asvs-level2-assessment.md`
7	CAS compliance	`.claude/security/blueteam/skills/06-cas-compliance.md`
8	Kill chain aggregation	`.claude/security/blueteam/skills/07-kill-chain-aggregator.md`
9	Deterministic tool scans (MANDATORY)	`.claude/security/blueteam/skills/08-tool-scanning.md`
10	Security unit tests	`.claude/security/blueteam/skills/09-security-unit-tests.md`
11	DR resilience	`.claude/security/blueteam/skills/10-dr-resilience.md`
12	Code fix generation (optional)	`.claude/security/blueteam/skills/11-code-fix-generation.md`
13	Requirements map	`.claude/security/blueteam/skills/13-requirements-map.md`
14	Overview report (FINAL)	`.claude/security/blueteam/skills/12-security-overview-report.md`

For each step:

Read the skill .md file for instructions
Perform the AI-driven analysis
Write structured findings to the target's .ai/data/ and .ai/reports/ directories

Mandatory Deterministic Scans (Step 9)

AI analysis alone is NEVER sufficient. Run these scripts:

cd .claude/security/blueteam

# Run all security scans
node scripts/security-pipeline.js --repo-root /path/to/target --all

# Generate HTML reports
node scripts/generate_report_html.js --repo-root /path/to/target
node scripts/generate_overview_html.js --repo-root /path/to/target
node scripts/generate_requirements_report.js --repo-root /path/to/target
node scripts/generate_code_changes_report.js --repo-root /path/to/target

# Validate
node scripts/validate_reports.js --repo-root /path/to/target

Safety Rules

Do not read .env files or production secrets
Use [REDACTED-*] placeholders for credential values
Do not modify application source code during assessment
All HTML reports must be script-generated, never hand-crafted

Mehr aus diesem Repository

gleiches Repository

build

GovAlta/COMMON-HARNESS

Scaffold and build an app from the harness's template. Copies template/public into ./app/, optionally strips unused code, and follows the build guides. Sole sanctioned scaffold path — never build by hand.

2026-06-233

greenteam

GovAlta/COMMON-HARNESS

Run a green team deterministic code review against a target codebase, multi-round static and dynamic analysis (Round 1: npm audit, secrets, dangerous patterns, dependencies, licences, circular imports, formatting, govulncheck, OpenAPI lint, gitignore, env defaults, migrations, compiled binaries, API baseURL audit, Go toolchain; Round 2: type checking, ESLint, vitest coverage, go test coverage, integration test enumeration, test-bypass audit, CI pipeline audit, console-log scan, refinement re-framing). Mirrors the blueteam / redteam pipeline shape. Modeled on real human-led code reviews. Usage: /greenteam [--target /path/to/repo] [--round 1|2|all]

2026-06-233

phase1-requirements

GovAlta/COMMON-HARNESS

Phase 1 of the build lifecycle. Read every input under ./phases/phase1-requirements/inputs/, classify and analyze each document, and produce a structured FR/NFR/module-decomposition deliverable at ./phases/phase1-requirements/output/requirements.md. Usage: /phase1-requirements [--module moduleName]

2026-06-233

phase2-planning

GovAlta/COMMON-HARNESS

Phase 2 of the build lifecycle. Read the requirements deliverable from ./phases/phase1-requirements/output/requirements.md, then produce a highly structured plan: roadmap, task breakdown, dependency graph, estimates, critical path, resource plan, and risks. Hard-blocks if requirements.md is missing. Usage: /phase2-planning [--module moduleName]

2026-06-233

phase3-architecture

GovAlta/COMMON-HARNESS

Phase 3 of the build lifecycle. Read requirements.md and plan.md from prior phase outputs, then produce a structured architecture deliverable: system context, components, data model, API contract, auth flow, deployment topology, tech stack (aligned with template/), ADRs, NFR-to-component mapping, and a STRIDE-lite threat model. Hard-blocks if either prior artifact is missing. Usage: /phase3-architecture [--module moduleName]

2026-06-233

phase4-prototyping

GovAlta/COMMON-HARNESS

Phase 4 of the build lifecycle. Build a thin end-to-end tracer-bullet slice that validates the architecture's headline assumptions BEFORE committing the full plan to them. Hard-blocks if architecture.md is missing. Produces a working prototype + prototype-report.md (validations confirmed, assumptions falsified, performance baseline, architecture revisions proposed). Usage: /phase4-prototyping [--module moduleName]

2026-06-233

Blue Team Security Assessment

Run the full defensive security assessment pipeline against ./app/.

Usage

/blueteam # Assess ./app/ with full pipeline /blueteam --target /path/to/app # Assess a different target /blueteam --step 5 # Resume from step 5 (ASVS assessment)

Prerequisites

cd .claude/security/blueteam && npm install

Pipeline

Execute these steps in order. Read .claude/security/blueteam/CLAUDE.md for the full protocol.

Step

Skill

File

Load preflight

.claude/security/blueteam/shared/skills/preflight.md

Application map

.claude/security/blueteam/skills/01-application-map.md

Security classification

.claude/security/blueteam/skills/02-security-classification.md

Security architecture (optional)

.claude/security/blueteam/skills/03-security-architecture.md

Threat model

.claude/security/blueteam/skills/04-threat-model.md

ASVS Level 2 assessment

.claude/security/blueteam/skills/05-asvs-level2-assessment.md

CAS compliance

.claude/security/blueteam/skills/06-cas-compliance.md

Kill chain aggregation

.claude/security/blueteam/skills/07-kill-chain-aggregator.md

Deterministic tool scans (MANDATORY)

.claude/security/blueteam/skills/08-tool-scanning.md

Security unit tests

.claude/security/blueteam/skills/09-security-unit-tests.md

DR resilience

.claude/security/blueteam/skills/10-dr-resilience.md

Code fix generation (optional)

.claude/security/blueteam/skills/11-code-fix-generation.md

Requirements map

.claude/security/blueteam/skills/13-requirements-map.md

Overview report (FINAL)

.claude/security/blueteam/skills/12-security-overview-report.md

For each step:

Read the skill .md file for instructions

Perform the AI-driven analysis

Write structured findings to the target's .ai/data/ and .ai/reports/ directories

Mandatory Deterministic Scans (Step 9)

AI analysis alone is NEVER sufficient. Run these scripts:

cd .claude/security/blueteam # Run all security scans node scripts/security-pipeline.js --repo-root /path/to/target --all # Generate HTML reports node scripts/generate_report_html.js --repo-root /path/to/target node scripts/generate_overview_html.js --repo-root /path/to/target node scripts/generate_requirements_report.js --repo-root /path/to/target node scripts/generate_code_changes_report.js --repo-root /path/to/target # Validate node scripts/validate_reports.js --repo-root /path/to/target

Safety Rules

Do not read .env files or production secrets

Use [REDACTED-*] placeholders for credential values

Do not modify application source code during assessment

All HTML reports must be script-generated, never hand-crafted