Create or refine a concise, normative security policy (Blue Book) for sensitive applications. Use when users need a threat model, data classification rules, auth/session policy, logging and audit requirements, retention/deletion expectations, incident response, or security gates for apps handling PII/PHI/financial data.
The security-bluebook-builder skill is designed to assist users in creating or refining a normative security policy, commonly referred to as a 'Blue Book', specifically tailored for sensitive applications. This skill addresses the need for organizations to establish a clear and concise security framework when handling sensitive data, such as Personally Identifiable Information (PII), Protected Health Information (PHI), and financial data. By leveraging this skill, users can systematically gather necessary information, draft a coherent policy document, and ensure that their applications comply with relevant security standards and practices.
You can start by providing the necessary context about your application, including data classes, trust boundaries, and authentication methods.
If certain details are missing, the skill will ask up to 6 short questions to gather the necessary context or proceed with safe defaults.
This skill is specifically designed for sensitive applications that handle PII, PHI, or financial data and may not be suitable for less sensitive contexts.
The skill will explicitly call out any unavailable capabilities and will mark them as 'TODO' with a clear assumption.
Yes, the skill uses a predefined template located at `references/bluebook_template.md`, which is filled with the details you provide.
Quick Setup:
.claude/skills/Repository
SHADOWPR0/security-bluebook-builder