security-bluebook-builder
Generates a structured security policy document for sensitive applications based on your specific requirements.
Install
mkdir -p .claude/skills/security-bluebook-builder && curl -L -o skill.zip "https://agentskills.codes/api/skills/download/5273" && unzip -o skill.zip -d .claude/skills/security-bluebook-builder && rm skill.zipInstalls to .claude/skills/security-bluebook-builder
Activation
This is the description your AI agent reads to decide when to run this skill — the better it matches your request, the more reliably it fires.
Build a minimal but real security policy for sensitive apps. The output is a single, coherent Blue Book document using MUST/SHOULD/CAN language, with explicit assumptions, scope, and security gates.Key capabilities
- →Classifies data sensitivity
- →Maps trust boundaries
- →Defines authentication flows
- →Standardizes storage and retention policies
How it works
Applies a template-filling mechanism guided by a 6-question input gathering process.
Inputs & outputs
When to use security-bluebook-builder
- →Define application trust boundaries
- →Establish data retention and deletion policies
- →Create security gates for development workflows
- →Formalize assumptions for sensitive data handling
About this skill
Security Bluebook Builder
When to Use
- You need a concise but enforceable security policy for an app handling sensitive data.
- You want a single Blue Book document with explicit assumptions, controls, and go/no-go gates.
- The user needs policy guidance grounded in scope, threat model, and operational security defaults rather than generic advice.
Overview
Build a minimal but real security policy for sensitive apps. The output is a single, coherent Blue Book document using MUST/SHOULD/CAN language, with explicit assumptions, scope, and security gates.
Workflow
1) Gather inputs (ask only if missing)
Collect just enough context to fill the template. If the user has not provided details, ask up to 6 short questions:
- What data classes are handled (PII, PHI, financial, tokens, content)?
- What are the trust boundaries (client/server/third parties)?
- How do users authenticate (OAuth, email/password, SSO, device sessions)?
- What storage is used (DB, object storage, logs, analytics)?
- What connectors or third parties are used?
- Retention and deletion expectations (default + user-initiated)?
If the user cannot answer, proceed with safe defaults and mark TODOs.
2) Draft the Blue Book
Load references/bluebook_template.md and fill it with the provided details. Keep it concise, deterministic, and enforceable.
3) Enforce guardrails
- Do not include secrets, tokens, or internal credentials.
- If something is unknown, write "TODO" plus a clear assumption.
- Fail closed: if a capability is required but unavailable, call it out explicitly.
- Keep scope minimal; do not add features or tools beyond what the user asked for.
4) Quality checks
Confirm the Blue Book includes:
- Threat model (assumptions + out-of-scope)
- Data classification + handling rules
- Trust boundaries + controls
- Auth/session policy
- Token handling policy
- Logging/audit policy
- Retention/deletion
- Incident response mini-runbook
- Security gates + go/no-go checklist
Resources
references/bluebook_template.md
Limitations
- Use this skill only when the task clearly matches the scope described above.
- Do not treat the output as a substitute for environment-specific validation, testing, or expert review.
- Stop and ask for clarification if required inputs, permissions, safety boundaries, or success criteria are missing.
When not to use it
- →General software architecture design
- →Generating network infrastructure security
- →Legal compliance outside of software policy
Prerequisites
Limitations
- →Requires human input for context
- →Defaults are placeholders when information is missing
How it compares
It mandates the use of specific, enforceable language (MUST/SHOULD) in a pre-formatted structure rather than generating prose advice.
Compared to similar skills
security-bluebook-builder side by side with the closest alternatives in the catalog.
| Skill | Installs | Updated | Safety | Difficulty |
|---|---|---|---|---|
| security-bluebook-builder (this skill) | 1 | 4mo | No flags | Intermediate |
| security-requirement-extraction | 7 | 2mo | No flags | Intermediate |
| audit-support | 4 | 5mo | No flags | Advanced |
| awesome-game-security-overview | 4 | 3mo | Review | Beginner |
Try saying
Example prompts that trigger this skill in your AI assistant.
More by sickn33
View all by sickn33 →You might also like
security-requirement-extraction
wshobson
Derive security requirements from threat models and business context. Use when translating threats into actionable requirements, creating security user stories, or building security test cases.
audit-support
anthropics
Support SOX 404 compliance with control testing methodology, sample selection, and documentation standards. Use when generating testing workpapers, selecting audit samples, classifying control deficiencies, or preparing for internal or external audits.
awesome-game-security-overview
gmh5225
Guide for understanding and contributing to the awesome-game-security curated resource list. Use this skill when adding new resources, organizing categories, understanding project structure, or maintaining the README.md format consistency.
security-compliance-compliance-check
sickn33
You are a compliance expert specializing in regulatory requirements for software systems including GDPR, HIPAA, SOC2, PCI-DSS, and other industry standards. Perform compliance audits and provide implementation guidance.
audit-prep-assistant
trailofbits
Prepares codebases for security review using Trail of Bits' checklist. Helps set review goals, runs static analysis tools, increases test coverage, removes dead code, ensures accessibility, and generates documentation (flowcharts, user stories, inline comments).
ra-qm-skills
alirezarezvani
12 production-ready regulatory affairs and quality management skills for HealthTech/MedTech: ISO 13485 QMS, MDR 2017/745, FDA 510(k)/PMA, ISO 27001 ISMS, GDPR/DSGVO compliance, risk management (ISO 14971), CAPA, document control, and internal auditing. Python tools included (all stdlib-only). Works with Claude Code, Codex CLI, and OpenClaw.