メニュー
Run a blue team defensive security assessment on the app: OWASP ASVS Level 2, CAS compliance, threat modeling, kill chains, deterministic scanning, and HTML report generation.
Codex または Claude でインストール この Prompt をコピーして Codex、Claude、または他のアシスタントに貼り付けると、Skill ページを確認してインストールできます。
SOC 職業分類に基づく
Scaffold and build an app from the harness's template. Copies template/public into ./app/, optionally strips unused code, and follows the build guides. Sole sanctioned scaffold path — never build by hand.
Run a green team deterministic code review against a target codebase, multi-round static and dynamic analysis (Round 1: npm audit, secrets, dangerous patterns, dependencies, licences, circular imports, formatting, govulncheck, OpenAPI lint, gitignore, env defaults, migrations, compiled binaries, API baseURL audit, Go toolchain; Round 2: type checking, ESLint, vitest coverage, go test coverage, integration test enumeration, test-bypass audit, CI pipeline audit, console-log scan, refinement re-framing). Mirrors the blueteam / redteam pipeline shape. Modeled on real human-led code reviews. Usage: /greenteam [--target /path/to/repo] [--round 1|2|all]
Phase 1 of the build lifecycle. Read every input under ./phases/phase1-requirements/inputs/, classify and analyze each document, and produce a structured FR/NFR/module-decomposition deliverable at ./phases/phase1-requirements/output/requirements.md. Usage: /phase1-requirements [--module moduleName]
Phase 2 of the build lifecycle. Read the requirements deliverable from ./phases/phase1-requirements/output/requirements.md, then produce a highly structured plan: roadmap, task breakdown, dependency graph, estimates, critical path, resource plan, and risks. Hard-blocks if requirements.md is missing. Usage: /phase2-planning [--module moduleName]
Phase 3 of the build lifecycle. Read requirements.md and plan.md from prior phase outputs, then produce a structured architecture deliverable: system context, components, data model, API contract, auth flow, deployment topology, tech stack (aligned with template/), ADRs, NFR-to-component mapping, and a STRIDE-lite threat model. Hard-blocks if either prior artifact is missing. Usage: /phase3-architecture [--module moduleName]
Phase 4 of the build lifecycle. Build a thin end-to-end tracer-bullet slice that validates the architecture's headline assumptions BEFORE committing the full plan to them. Hard-blocks if architecture.md is missing. Produces a working prototype + prototype-report.md (validations confirmed, assumptions falsified, performance baseline, architecture revisions proposed). Usage: /phase4-prototyping [--module moduleName]
Run the full defensive security assessment pipeline against ./app/.
/blueteam # Assess ./app/ with full pipeline
/blueteam --target /path/to/app # Assess a different target
/blueteam --step 5 # Resume from step 5 (ASVS assessment)
cd .claude/security/blueteam && npm install
Execute these steps in order. Read .claude/security/blueteam/CLAUDE.md for the full protocol.
| Step | Skill | File |
|---|---|---|
| 1 | Load preflight | .claude/security/blueteam/shared/skills/preflight.md |
| 2 | Application map | .claude/security/blueteam/skills/01-application-map.md |
| 3 | Security classification | .claude/security/blueteam/skills/02-security-classification.md |
| 4 | Security architecture (optional) | .claude/security/blueteam/skills/03-security-architecture.md |
| 5 | Threat model | .claude/security/blueteam/skills/04-threat-model.md |
| 6 | ASVS Level 2 assessment | .claude/security/blueteam/skills/05-asvs-level2-assessment.md |
| 7 | CAS compliance | .claude/security/blueteam/skills/06-cas-compliance.md |
| 8 | Kill chain aggregation | .claude/security/blueteam/skills/07-kill-chain-aggregator.md |
| 9 | Deterministic tool scans (MANDATORY) | .claude/security/blueteam/skills/08-tool-scanning.md |
| 10 | Security unit tests | .claude/security/blueteam/skills/09-security-unit-tests.md |
| 11 | DR resilience | .claude/security/blueteam/skills/10-dr-resilience.md |
| 12 | Code fix generation (optional) | .claude/security/blueteam/skills/11-code-fix-generation.md |
| 13 | Requirements map | .claude/security/blueteam/skills/13-requirements-map.md |
| 14 | Overview report (FINAL) | .claude/security/blueteam/skills/12-security-overview-report.md |
.ai/data/ and .ai/reports/ directoriesAI analysis alone is NEVER sufficient. Run these scripts:
cd .claude/security/blueteam
# Run all security scans
node scripts/security-pipeline.js --repo-root /path/to/target --all
# Generate HTML reports
node scripts/generate_report_html.js --repo-root /path/to/target
node scripts/generate_overview_html.js --repo-root /path/to/target
node scripts/generate_requirements_report.js --repo-root /path/to/target
node scripts/generate_code_changes_report.js --repo-root /path/to/target
# Validate
node scripts/validate_reports.js --repo-root /path/to/target
.env files or production secrets[REDACTED-*] placeholders for credential values