Execute qualquer Skill no Manus
com um clique

Execute qualquer Skill no Manus com um clique

blueteam

Estrelas3

Forks1

Atualizado23 de junho de 2026 às 04:04

Run a blue team defensive security assessment on the app: OWASP ASVS Level 2, CAS compliance, threat modeling, kill chains, deterministic scanning, and HTML report generation.

Instalação

Instalar com Codex ou Claude Copie este prompt, cole no Codex, Claude ou outro assistente e deixe que ele revise a página da skill e instale para você.

Executar no Manus

Fonte

GovAlta

GovAlta/COMMON-HARNESS

Abrir repositório GitHub Ver repositórios do creator

Download

Executar no Manus

Ocupações relacionadasSOC

Baseado na classificação ocupacional SOC

Analistas de segurança da informaçãoInformática e Matemática·SOC 15-1212

SKILL.md

readonly

name	blueteam
description	Run a blue team defensive security assessment on the app: OWASP ASVS Level 2, CAS compliance, threat modeling, kill chains, deterministic scanning, and HTML report generation.

Blue Team Security Assessment

Run the full defensive security assessment pipeline against ./app/.

Usage

/blueteam                          # Assess ./app/ with full pipeline
/blueteam --target /path/to/app    # Assess a different target
/blueteam --step 5                 # Resume from step 5 (ASVS assessment)

Prerequisites

cd .claude/security/blueteam && npm install

Pipeline

Execute these steps in order. Read .claude/security/blueteam/CLAUDE.md for the full protocol.

Step	Skill	File
1	Load preflight	`.claude/security/blueteam/shared/skills/preflight.md`
2	Application map	`.claude/security/blueteam/skills/01-application-map.md`
3	Security classification	`.claude/security/blueteam/skills/02-security-classification.md`
4	Security architecture (optional)	`.claude/security/blueteam/skills/03-security-architecture.md`
5	Threat model	`.claude/security/blueteam/skills/04-threat-model.md`
6	ASVS Level 2 assessment	`.claude/security/blueteam/skills/05-asvs-level2-assessment.md`
7	CAS compliance	`.claude/security/blueteam/skills/06-cas-compliance.md`
8	Kill chain aggregation	`.claude/security/blueteam/skills/07-kill-chain-aggregator.md`
9	Deterministic tool scans (MANDATORY)	`.claude/security/blueteam/skills/08-tool-scanning.md`
10	Security unit tests	`.claude/security/blueteam/skills/09-security-unit-tests.md`
11	DR resilience	`.claude/security/blueteam/skills/10-dr-resilience.md`
12	Code fix generation (optional)	`.claude/security/blueteam/skills/11-code-fix-generation.md`
13	Requirements map	`.claude/security/blueteam/skills/13-requirements-map.md`
14	Overview report (FINAL)	`.claude/security/blueteam/skills/12-security-overview-report.md`

For each step:

Read the skill .md file for instructions
Perform the AI-driven analysis
Write structured findings to the target's .ai/data/ and .ai/reports/ directories

Mandatory Deterministic Scans (Step 9)

AI analysis alone is NEVER sufficient. Run these scripts:

cd .claude/security/blueteam

# Run all security scans
node scripts/security-pipeline.js --repo-root /path/to/target --all

# Generate HTML reports
node scripts/generate_report_html.js --repo-root /path/to/target
node scripts/generate_overview_html.js --repo-root /path/to/target
node scripts/generate_requirements_report.js --repo-root /path/to/target
node scripts/generate_code_changes_report.js --repo-root /path/to/target

# Validate
node scripts/validate_reports.js --repo-root /path/to/target

Safety Rules

Do not read .env files or production secrets
Use [REDACTED-*] placeholders for credential values
Do not modify application source code during assessment
All HTML reports must be script-generated, never hand-crafted

Mais deste repositório

mesmo repositório

build

GovAlta/COMMON-HARNESS

Scaffold and build an app from the harness's template. Copies template/public into ./app/, optionally strips unused code, and follows the build guides. Sole sanctioned scaffold path — never build by hand.

2026-06-233

greenteam

GovAlta/COMMON-HARNESS

Run a green team deterministic code review against a target codebase, multi-round static and dynamic analysis (Round 1: npm audit, secrets, dangerous patterns, dependencies, licences, circular imports, formatting, govulncheck, OpenAPI lint, gitignore, env defaults, migrations, compiled binaries, API baseURL audit, Go toolchain; Round 2: type checking, ESLint, vitest coverage, go test coverage, integration test enumeration, test-bypass audit, CI pipeline audit, console-log scan, refinement re-framing). Mirrors the blueteam / redteam pipeline shape. Modeled on real human-led code reviews. Usage: /greenteam [--target /path/to/repo] [--round 1|2|all]

2026-06-233

phase1-requirements

GovAlta/COMMON-HARNESS

Phase 1 of the build lifecycle. Read every input under ./phases/phase1-requirements/inputs/, classify and analyze each document, and produce a structured FR/NFR/module-decomposition deliverable at ./phases/phase1-requirements/output/requirements.md. Usage: /phase1-requirements [--module moduleName]

2026-06-233

phase2-planning

GovAlta/COMMON-HARNESS

Phase 2 of the build lifecycle. Read the requirements deliverable from ./phases/phase1-requirements/output/requirements.md, then produce a highly structured plan: roadmap, task breakdown, dependency graph, estimates, critical path, resource plan, and risks. Hard-blocks if requirements.md is missing. Usage: /phase2-planning [--module moduleName]

2026-06-233

phase3-architecture

GovAlta/COMMON-HARNESS

Phase 3 of the build lifecycle. Read requirements.md and plan.md from prior phase outputs, then produce a structured architecture deliverable: system context, components, data model, API contract, auth flow, deployment topology, tech stack (aligned with template/), ADRs, NFR-to-component mapping, and a STRIDE-lite threat model. Hard-blocks if either prior artifact is missing. Usage: /phase3-architecture [--module moduleName]

2026-06-233

phase4-prototyping

GovAlta/COMMON-HARNESS

Phase 4 of the build lifecycle. Build a thin end-to-end tracer-bullet slice that validates the architecture's headline assumptions BEFORE committing the full plan to them. Hard-blocks if architecture.md is missing. Produces a working prototype + prototype-report.md (validations confirmed, assumptions falsified, performance baseline, architecture revisions proposed). Usage: /phase4-prototyping [--module moduleName]

2026-06-233

Blue Team Security Assessment

Run the full defensive security assessment pipeline against ./app/.

Usage

/blueteam # Assess ./app/ with full pipeline /blueteam --target /path/to/app # Assess a different target /blueteam --step 5 # Resume from step 5 (ASVS assessment)

Prerequisites

cd .claude/security/blueteam && npm install

Pipeline

Execute these steps in order. Read .claude/security/blueteam/CLAUDE.md for the full protocol.

Step

Skill

File

Load preflight

.claude/security/blueteam/shared/skills/preflight.md

Application map

.claude/security/blueteam/skills/01-application-map.md

Security classification

.claude/security/blueteam/skills/02-security-classification.md

Security architecture (optional)

.claude/security/blueteam/skills/03-security-architecture.md

Threat model

.claude/security/blueteam/skills/04-threat-model.md

ASVS Level 2 assessment

.claude/security/blueteam/skills/05-asvs-level2-assessment.md

CAS compliance

.claude/security/blueteam/skills/06-cas-compliance.md

Kill chain aggregation

.claude/security/blueteam/skills/07-kill-chain-aggregator.md

Deterministic tool scans (MANDATORY)

.claude/security/blueteam/skills/08-tool-scanning.md

Security unit tests

.claude/security/blueteam/skills/09-security-unit-tests.md

DR resilience

.claude/security/blueteam/skills/10-dr-resilience.md

Code fix generation (optional)

.claude/security/blueteam/skills/11-code-fix-generation.md

Requirements map

.claude/security/blueteam/skills/13-requirements-map.md

Overview report (FINAL)

.claude/security/blueteam/skills/12-security-overview-report.md

For each step:

Read the skill .md file for instructions

Perform the AI-driven analysis

Write structured findings to the target's .ai/data/ and .ai/reports/ directories

Mandatory Deterministic Scans (Step 9)

AI analysis alone is NEVER sufficient. Run these scripts:

cd .claude/security/blueteam # Run all security scans node scripts/security-pipeline.js --repo-root /path/to/target --all # Generate HTML reports node scripts/generate_report_html.js --repo-root /path/to/target node scripts/generate_overview_html.js --repo-root /path/to/target node scripts/generate_requirements_report.js --repo-root /path/to/target node scripts/generate_code_changes_report.js --repo-root /path/to/target # Validate node scripts/validate_reports.js --repo-root /path/to/target

Safety Rules

Do not read .env files or production secrets

Use [REDACTED-*] placeholders for credential values

Do not modify application source code during assessment

All HTML reports must be script-generated, never hand-crafted