Blue team

Skill senda-labs/DQIII8/.claude/skills/blue-team

Defensive security — reads red-team findings and systematically patches every vulnerability. Hardens code, adds input validation, fixes permissions, and verifies each fix. Works from the latest red-team report.From its SKILL.md

Install

npx -y skills add senda-labs/DQIII8 --skill blue-team

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

One thing to look at

11 stars11 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

SKILL.md

3.2 KB, as published. Nobody here has run it

/blue-team — Defensive Security Hardening

Read the latest red-team report and systematically fix every finding.

Usage

/blue-team                          # Fix all findings from latest report
/blue-team $ARGUMENTS               # Fix specific finding (e.g. RT-001)

Pipeline

Step 1: Load latest red-team report

ls -t tasks/audit/red-team-*.md | head -1

Read and parse all findings.

Step 2: Prioritize fixes

Order: CRITICAL → HIGH → MEDIUM → LOW

Within same severity: kill chain findings first (they have multiplied impact).

Step 3: For each finding, apply fix pattern

Finding type	Fix pattern
SQL injection	Replace f-strings with parameterized queries (`?`)
Command injection	Use `shlex.quote()` on user input, whitelist commands
Path traversal	Use `pathlib.resolve()` + check prefix matches allowed dir
XSS	Escape HTML output with `html.escape()` or template engine
Auth bypass	Add auth decorator/middleware to unprotected routes
Hardcoded secrets	Move to `.env`, use `os.environ.get()`
Debug exposure	Remove `print(error)`, use `logging` with appropriate level
File permissions	`chmod 600` on `.env`, `.db`, `.pem`, `.key` files
Missing validation	Add type checks, range checks, sanitization
Dependency vuln	`pip install --upgrade {package}`
Vibe-coding pattern	Rewrite the specific pattern with secure alternative

Step 4: Verify each fix

After applying a fix:

Run the original proof-of-concept from the red-team report
It should now FAIL (vulnerability patched)
Run tests to ensure the fix didn't break functionality
Document: "Finding RT-XXX: PATCHED, verified, tests pass"

python3 -m pytest tests/ -q

Step 5: Generate blue-team report

Generate: tasks/audit/blue-team-{date}.md

# Blue Team Report — {date}
Source: {red-team report filename}

## Fixes Applied
| ID | Finding | Severity | Fix | Verified | Tests |
|----|---------|----------|-----|----------|-------|
| RT-001 | SQL injection in db.py | CRITICAL | Parameterized queries | ✅ | ✅ |
| RT-002 | .env readable | HIGH | chmod 600 | ✅ | N/A |

## Kill Chains Broken
### Kill Chain 1: {name}
- Step broken at: {step N}
- Fix applied: {description}
- Chain now terminates at: {safe state}

## Remaining Risks
{Any findings that could not be fully fixed, with justification}

## Security Score
Before: {red-team score}/100
After: {blue-team score}/100
Improvement: +{delta} points

Rules

ALWAYS run tests after each fix: python3 -m pytest tests/ -q
NEVER introduce new vulnerabilities while fixing old ones
If a fix requires breaking API compatibility, flag it for user review
Document the reasoning for each fix, not just the change