How do I install the Foolhardy45 Portfolio Security Bluebook Builder skill?

Run npx skillmds@latest add tomevault-io/foolhardy45-portfolio-security-bluebook-builder in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is Foolhardy45 Portfolio Security Bluebook Builder safe to use?

This skill has not completed SkillMD's automated safety review yet. Independent scanners report: SkillSpector: PASS, Skill Scanner: PASS. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Foolhardy45 Portfolio Security Bluebook Builder?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Foolhardy45 Portfolio Security Bluebook Builder free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published Foolhardy45 Portfolio Security Bluebook Builder?

tomevault-io (@tomevault-io) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Foolhardy45 Portfolio Security Bluebook Builder by tomevault-io

Name: Foolhardy45 Portfolio Security Bluebook Builder
Author: tomevault-io

File contents

name: security-bluebook-builder description: "Build a minimal but real security policy for sensitive apps. The output is a single, coherent Blue Book document using MUST/SHOULD/CAN language, with explicit assumptions, scope, and security gates." risk: unknown source: community

Security Bluebook Builder

Overview

Build a minimal but real security policy for sensitive apps. The output is a single, coherent Blue Book document using MUST/SHOULD/CAN language, with explicit assumptions, scope, and security gates.

Workflow

1) Gather inputs (ask only if missing)

Collect just enough context to fill the template. If the user has not provided details, ask up to 6 short questions:

What data classes are handled (PII, PHI, financial, tokens, content)?
What are the trust boundaries (client/server/third parties)?
How do users authenticate (OAuth, email/password, SSO, device sessions)?
What storage is used (DB, object storage, logs, analytics)?
What connectors or third parties are used?
Retention and deletion expectations (default + user-initiated)?

If the user cannot answer, proceed with safe defaults and mark TODOs.

2) Draft the Blue Book

Load references/bluebook_template.md and fill it with the provided details. Keep it concise, deterministic, and enforceable.

3) Enforce guardrails

Do not include secrets, tokens, or internal credentials.
If something is unknown, write "TODO" plus a clear assumption.
Fail closed: if a capability is required but unavailable, call it out explicitly.
Keep scope minimal; do not add features or tools beyond what the user asked for.

4) Quality checks

Confirm the Blue Book includes:

Threat model (assumptions + out-of-scope)
Data classification + handling rules
Trust boundaries + controls
Auth/session policy
Token handling policy
Logging/audit policy
Retention/deletion
Incident response mini-runbook
Security gates + go/no-go checklist

Resources

references/bluebook_template.md

Source: foolhardy45/portfolio — distributed by TomeVault.

---name: foolhardy45-portfolio-security-bluebook-builderdescription: ---------name: security-bluebook-builderdescription: "Build a minimal but real security policy for sensitive apps. The output is a single, coherent Blue Book document using MUST/SHOULD/CAN language, with explicit assumptions, scope, and security gates."risk: unknownsource: community---# Security Bluebook Builder## OverviewBuild a minimal but real security policy for sensitive apps. The output is a single, coherent Blue Book document using MUST/SHOULD/CAN language, with explicit assumptions, scope, and security gates.## Workflow### 1) Gather inputs (ask only if missing)Collect just enough context to fill the template. If the user has not provided details, ask up to 6 short questions:- What data classes are handled (PII, PHI, financial, tokens, content)?- What are the trust boundaries (client/server/third parties)?- How do users authenticate (OAuth, email/password, SSO, device sessions)?- What storage is used (DB, object storage, logs, analytics)?- What connectors or third parties are used?- Retention and deletion expectations (default + user-initiated)?If the user cannot answer, proceed with safe defaults and mark TODOs.### 2) Draft the Blue BookLoad `references/bluebook_template.md` and fill it with the provided details. Keep it concise, deterministic, and enforceable.### 3) Enforce guardrails- Do not include secrets, tokens, or internal credentials.- If something is unknown, write "TODO" plus a clear assumption.- Fail closed: if a capability is required but unavailable, call it out explicitly.- Keep scope minimal; do not add features or tools beyond what the user asked for.### 4) Quality checksConfirm the Blue Book includes:- Threat model (assumptions + out-of-scope)- Data classification + handling rules- Trust boundaries + controls- Auth/session policy- Token handling policy- Logging/audit policy- Retention/deletion- Incident response mini-runbook- Security gates + go/no-go checklist## Resources- `references/bluebook_template.md`---> Source: [foolhardy45/portfolio](https://github.com/foolhardy45/portfolio) — distributed by [TomeVault](https://tomevault.io).

Frequently asked questions

Foolhardy45 Portfolio Security Bluebook Builder