# Red Blue Review

> Examine concrete attack and failure paths, then design prevention, detection, containment and recovery. Use for red team, blue team, threat models, attack paths or defense plans. General engineering review belongs to morpheus; component failure inventories belong to failure-analysis.

- Skill: `cassioroos/red-blue-review` (Agent Skill)
- Install (CLI): `npx skillmds@latest add cassioroos/red-blue-review`
- Raw SKILL.md: https://api.skillmd.com/api/skills/cassioroos/red-blue-review/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Web & Frontend
- Author: CassioRoos (https://skillmd.com/u/cassioroos)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/cassioroos/red-blue-review

---


# Red/Blue Review

Use opposing lenses to find what breaks and what defends it. Do not list generic risks. Produce concrete attack paths, failure paths, and mitigations.

## Inputs To Gather

- The artifact: code, diff, design, ADR, spec, migration, runbook, or launch plan.
- The asset at risk: money, data integrity, availability, privacy, developer time, customer trust.
- The threat or failure model: malicious actor, operator error, dependency failure, scale, bad data, ambiguous requirements.
- The deployment context: environments, permissions, observability, rollback path.

## Red Team

Act like the system will be misused, overloaded, misconfigured, or attacked.

Check:

- Trust boundaries and privilege escalation.
- Input validation and malformed data.
- Authentication, authorization, and tenant isolation.
- Secrets handling and accidental leakage.
- Retry storms, duplicate effects, race conditions, and idempotency gaps.
- Silent data corruption and partial writes.
- Missing timeouts, circuit breakers, and backpressure.
- Operational mistakes: bad deploy, bad config, bad rollback, stale docs.

## Blue Team

Defend with practical controls, not wishful thinking.

For each credible issue:

- Prevention: code/design change that stops it.
- Detection: logs, metrics, traces, alerts, invariants, tests.
- Containment: rate limits, circuit breakers, feature flags, kill switches.
- Recovery: rollback, replay, reconciliation, data repair.
- Ownership: who notices and who acts.

## Output

```markdown
## Red Team Findings

### Critical
- Attack/failure path:
  Evidence:
  Impact:
  Why current controls fail:

### High
- Attack/failure path:
  Evidence:
  Impact:
  Why current controls fail:

## Blue Team Plan

- Control:
  Covers:
  Implementation:
  Validation:

## Launch Gate

- Ship:
- Block:
- Spike:
```

## Rule

If there is no evidence for a control, say "control not demonstrated." A design promise is not a control.