Security Bluebook Builder

If the user cannot answer, proceed with safe defaults and mark TODOs.

2) Draft the Blue Book

Load references/bluebook_template.md and fill it with the provided details. Keep it concise, deterministic, and enforceable.

3) Enforce guardrails

• Do not include secrets, tokens, or internal credentials.
• If something is unknown, write "TODO" plus a clear assumption.
• Fail closed: if a capability is required but unavailable, call it out explicitly.
• Keep scope minimal; do not add features or tools beyond what the user asked for.

4) Quality checks

Confirm the Blue Book includes:

• Threat model (assumptions + out-of-scope)
• Data classification + handling rules
• Trust boundaries + controls
• Auth/session policy
• Token handling policy
• Logging/audit policy
• Retention/deletion
• Incident response mini-runbook
• Security gates + go/no-go checklist

Resources

• references/bluebook_template.md

Limitations

• Use this skill only when the task clearly matches the scope described above.
• Do not treat the output as a substitute for environment-specific validation, testing, or expert review.
• Stop and ask for clarification if required inputs, permissions, safety boundaries, or success criteria are missing.