ranbot-ai/security-bluebook-builder
skills/security-bluebook-builder/SKILL.md
Create or refine a concise, normative security policy ("Blue Book") for sensitive applications. Use when users need a threat model, data classification rules, auth/session policy, logging and audit re
$ install --global
skillsauthnpx skillsauth add ranbot-ai/awesome-skills security-bluebook-builderInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
Security Scan Results
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
3
Scanners Passed
9
Scanners in report
Clean
TrivyContainer and dependency vulnerability scanner
95%
Clean
SemgrepStatic code analysis for vulnerabilities
95%
Clean
mcp-scan (Snyk)Model Context Protocol security validation
95%
Skipped
Snyk (dep)Open source security scanning
50%
Skipped
Socket.devSupply chain security analysis
50%
Skipped
VirusTotalMulti-engine malware detection
50%
Skipped
CrowdStrikeAdvanced threat intelligence
50%
Skipped
OSV-ScannerOpen Source Vulnerability database check
50%
Skipped
OWASP Dep-Check
50%
Last scanned: May 2, 2026, 6:03 AM295.6s1 file scanned
SKILL.md
- name:
- security-bluebook-builder
- description:
- Create or refine a concise, normative security policy ("Blue Book") for sensitive applications. Use when users need a threat model, data classification rules, auth/session policy, logging and audit re
- category:
- Security & Systems
- source:
- antigravity
- tags:
- [ai, workflow, template, document, security, rag]
- url:
- https://github.com/sickn33/antigravity-awesome-skills/tree/main/skills/security-bluebook-builder
Security Bluebook Builder
Overview
Build a minimal but real security policy for sensitive apps. The output is a single, coherent Blue Book document using MUST/SHOULD/CAN language, with explicit assumptions, scope, and security gates.
Workflow
1) Gather inputs (ask only if missing)
Collect just enough context to fill the template. If the user has not provided details, ask up to 6 short questions:
- What data classes are handled (PII, PHI, financial, tokens, content)?
- What are the trust boundaries (client/server/third parties)?
- How do users authenticate (OAuth, email/password, SSO, device sessions)?
- What storage is used (DB, object storage, logs, analytics)?
- What connectors or third parties are used?
- Retention and deletion expectations (default + user-initiated)?
If the user cannot answer, proceed with safe defaults and mark TODOs.
2) Draft the Blue Book
Load references/bluebook_template.md and fill it with the provided details. Keep it concise, deterministic, and enforceable.
3) Enforce guardrails
- Do not include secrets, tokens, or internal credentials.
- If something is unknown, write "TODO" plus a clear assumption.
- Fail closed: if a capability is required but unavailable, call it out explicitly.
- Keep scope minimal; do not add features or tools beyond what the user asked for.
4) Quality checks
Confirm the Blue Book includes:
- Threat model (assumptions + out-of-scope)
- Data classification + handling rules
- Trust boundaries + controls
- Auth/session policy
- Token handling policy
- Logging/audit policy
- Retention/deletion
- Incident response mini-runbook
- Security gates + go/no-go checklist
Resources
references/bluebook_template.md
Related Skills
ranbot-ai/ditto
tools
VerifiedTrustedCommunity
Use when a user asks to mine or update a private, evidence-backed work profile from local Claude Code, Codex, Copilot CLI, or OpenCode sessions.
5SKILL.mdUpdated Jul 18, 2026
ranbot-ai/diagnose-android-overheating
data-ai
VerifiedTrustedCommunity
Use when diagnosing Android overheating, idle heat, thermal throttling, charging or radio heat, or abnormal battery drain with read-only ADB evidence and approval gates.
5SKILL.mdUpdated Jul 18, 2026
ranbot-ai/competitor-ad-intelligence
research
VerifiedTrustedCommunity
Research public competitor ads, analyze creative patterns and landing pages, and produce an evidence-labeled strategic teardown.
5SKILL.mdUpdated Jul 18, 2026
ranbot-ai/anywrite
tools
VerifiedTrustedCommunity
Compiled CLI covering all 52 endpoints of the Anytype local API — objects, properties, tags, search, chat, files — one binary, no MCP server needed.
5SKILL.mdUpdated Jul 18, 2026