Ejecuta cualquier Skill en Manus
con un clic

Ejecuta cualquier Skill en Manus con un clic

blueteam

Estrellas3

Forks1

Actualizado23 de junio de 2026 a las 04:04

Run a blue team defensive security assessment on the app: OWASP ASVS Level 2, CAS compliance, threat modeling, kill chains, deterministic scanning, and HTML report generation.

Instalación

Instalar con Codex o Claude Copia este prompt, pégalo en Codex, Claude u otro asistente, y deja que revise la página de la skill y la instale por ti.

Ejecutar en Manus

Fuente

GovAlta

GovAlta/COMMON-HARNESS

Abrir repositorio de GitHub Ver repositorios del creador

Descarga

Ejecutar en Manus

Ocupaciones relacionadasSOC

Basado en la clasificación ocupacional SOC

Analistas de seguridad de la informaciónOcupaciones informáticas y matemáticas·SOC 15-1212

SKILL.md

readonly

name	blueteam
description	Run a blue team defensive security assessment on the app: OWASP ASVS Level 2, CAS compliance, threat modeling, kill chains, deterministic scanning, and HTML report generation.

Blue Team Security Assessment

Run the full defensive security assessment pipeline against ./app/.

Usage

/blueteam                          # Assess ./app/ with full pipeline
/blueteam --target /path/to/app    # Assess a different target
/blueteam --step 5                 # Resume from step 5 (ASVS assessment)

Prerequisites

cd .claude/security/blueteam && npm install

Pipeline

Execute these steps in order. Read .claude/security/blueteam/CLAUDE.md for the full protocol.

Step	Skill	File
1	Load preflight	`.claude/security/blueteam/shared/skills/preflight.md`
2	Application map	`.claude/security/blueteam/skills/01-application-map.md`
3	Security classification	`.claude/security/blueteam/skills/02-security-classification.md`
4	Security architecture (optional)	`.claude/security/blueteam/skills/03-security-architecture.md`
5	Threat model	`.claude/security/blueteam/skills/04-threat-model.md`
6	ASVS Level 2 assessment	`.claude/security/blueteam/skills/05-asvs-level2-assessment.md`
7	CAS compliance	`.claude/security/blueteam/skills/06-cas-compliance.md`
8	Kill chain aggregation	`.claude/security/blueteam/skills/07-kill-chain-aggregator.md`
9	Deterministic tool scans (MANDATORY)	`.claude/security/blueteam/skills/08-tool-scanning.md`
10	Security unit tests	`.claude/security/blueteam/skills/09-security-unit-tests.md`
11	DR resilience	`.claude/security/blueteam/skills/10-dr-resilience.md`
12	Code fix generation (optional)	`.claude/security/blueteam/skills/11-code-fix-generation.md`
13	Requirements map	`.claude/security/blueteam/skills/13-requirements-map.md`
14	Overview report (FINAL)	`.claude/security/blueteam/skills/12-security-overview-report.md`

For each step:

Read the skill .md file for instructions
Perform the AI-driven analysis
Write structured findings to the target's .ai/data/ and .ai/reports/ directories

Mandatory Deterministic Scans (Step 9)

AI analysis alone is NEVER sufficient. Run these scripts:

cd .claude/security/blueteam

# Run all security scans
node scripts/security-pipeline.js --repo-root /path/to/target --all

# Generate HTML reports
node scripts/generate_report_html.js --repo-root /path/to/target
node scripts/generate_overview_html.js --repo-root /path/to/target
node scripts/generate_requirements_report.js --repo-root /path/to/target
node scripts/generate_code_changes_report.js --repo-root /path/to/target

# Validate
node scripts/validate_reports.js --repo-root /path/to/target

Safety Rules

Do not read .env files or production secrets
Use [REDACTED-*] placeholders for credential values
Do not modify application source code during assessment
All HTML reports must be script-generated, never hand-crafted

Más de este repositorio

mismo repositorio

build

GovAlta/COMMON-HARNESS

Scaffold and build an app from the harness's template. Copies template/public into ./app/, optionally strips unused code, and follows the build guides. Sole sanctioned scaffold path — never build by hand.

2026-06-233

greenteam

GovAlta/COMMON-HARNESS

Run a green team deterministic code review against a target codebase, multi-round static and dynamic analysis (Round 1: npm audit, secrets, dangerous patterns, dependencies, licences, circular imports, formatting, govulncheck, OpenAPI lint, gitignore, env defaults, migrations, compiled binaries, API baseURL audit, Go toolchain; Round 2: type checking, ESLint, vitest coverage, go test coverage, integration test enumeration, test-bypass audit, CI pipeline audit, console-log scan, refinement re-framing). Mirrors the blueteam / redteam pipeline shape. Modeled on real human-led code reviews. Usage: /greenteam [--target /path/to/repo] [--round 1|2|all]

2026-06-233

phase1-requirements

GovAlta/COMMON-HARNESS

Phase 1 of the build lifecycle. Read every input under ./phases/phase1-requirements/inputs/, classify and analyze each document, and produce a structured FR/NFR/module-decomposition deliverable at ./phases/phase1-requirements/output/requirements.md. Usage: /phase1-requirements [--module moduleName]

2026-06-233

phase2-planning

GovAlta/COMMON-HARNESS

Phase 2 of the build lifecycle. Read the requirements deliverable from ./phases/phase1-requirements/output/requirements.md, then produce a highly structured plan: roadmap, task breakdown, dependency graph, estimates, critical path, resource plan, and risks. Hard-blocks if requirements.md is missing. Usage: /phase2-planning [--module moduleName]

2026-06-233

phase3-architecture

GovAlta/COMMON-HARNESS

Phase 3 of the build lifecycle. Read requirements.md and plan.md from prior phase outputs, then produce a structured architecture deliverable: system context, components, data model, API contract, auth flow, deployment topology, tech stack (aligned with template/), ADRs, NFR-to-component mapping, and a STRIDE-lite threat model. Hard-blocks if either prior artifact is missing. Usage: /phase3-architecture [--module moduleName]

2026-06-233

phase4-prototyping

GovAlta/COMMON-HARNESS

Phase 4 of the build lifecycle. Build a thin end-to-end tracer-bullet slice that validates the architecture's headline assumptions BEFORE committing the full plan to them. Hard-blocks if architecture.md is missing. Produces a working prototype + prototype-report.md (validations confirmed, assumptions falsified, performance baseline, architecture revisions proposed). Usage: /phase4-prototyping [--module moduleName]

2026-06-233

Blue Team Security Assessment

Run the full defensive security assessment pipeline against ./app/.

Usage

/blueteam # Assess ./app/ with full pipeline /blueteam --target /path/to/app # Assess a different target /blueteam --step 5 # Resume from step 5 (ASVS assessment)

Prerequisites

cd .claude/security/blueteam && npm install

Pipeline

Execute these steps in order. Read .claude/security/blueteam/CLAUDE.md for the full protocol.

Step

Skill

File

Load preflight

.claude/security/blueteam/shared/skills/preflight.md

Application map

.claude/security/blueteam/skills/01-application-map.md

Security classification

.claude/security/blueteam/skills/02-security-classification.md

Security architecture (optional)

.claude/security/blueteam/skills/03-security-architecture.md

Threat model

.claude/security/blueteam/skills/04-threat-model.md

ASVS Level 2 assessment

.claude/security/blueteam/skills/05-asvs-level2-assessment.md

CAS compliance

.claude/security/blueteam/skills/06-cas-compliance.md

Kill chain aggregation

.claude/security/blueteam/skills/07-kill-chain-aggregator.md

Deterministic tool scans (MANDATORY)

.claude/security/blueteam/skills/08-tool-scanning.md

Security unit tests

.claude/security/blueteam/skills/09-security-unit-tests.md

DR resilience

.claude/security/blueteam/skills/10-dr-resilience.md

Code fix generation (optional)

.claude/security/blueteam/skills/11-code-fix-generation.md

Requirements map

.claude/security/blueteam/skills/13-requirements-map.md

Overview report (FINAL)

.claude/security/blueteam/skills/12-security-overview-report.md

For each step:

Read the skill .md file for instructions

Perform the AI-driven analysis

Write structured findings to the target's .ai/data/ and .ai/reports/ directories

Mandatory Deterministic Scans (Step 9)

AI analysis alone is NEVER sufficient. Run these scripts:

cd .claude/security/blueteam # Run all security scans node scripts/security-pipeline.js --repo-root /path/to/target --all # Generate HTML reports node scripts/generate_report_html.js --repo-root /path/to/target node scripts/generate_overview_html.js --repo-root /path/to/target node scripts/generate_requirements_report.js --repo-root /path/to/target node scripts/generate_code_changes_report.js --repo-root /path/to/target # Validate node scripts/validate_reports.js --repo-root /path/to/target

Safety Rules

Do not read .env files or production secrets

Use [REDACTED-*] placeholders for credential values

Do not modify application source code during assessment

All HTML reports must be script-generated, never hand-crafted