red-blue-validator
Iterative adversarial stress-testing through Red/Blue team dynamics. Red Team generates substantive, steel-manned attacks against propositions; Blue Team responds with defenses, mitigations, and hardening. Cycles continue until convergence criteria are met, producing a battle-tested proposition. PROACTIVELY activate for: (1) High-stakes decisions requiring stress-testing, (2) Strategy validation before major commitment, (3) Architecture decision hardening, (4) Proposal defense preparation, (5) Security posture review, (6) Investment due diligence with adversarial lens. Triggers: "red team this", "blue team", "stress test", "attack this plan", "find weaknesses", "adversarial review", "devil's advocate", "what could go wrong", "poke holes in this", "challenge this decision", "war game this"
What this skill does
# Red/Blue Team Validator > "Find weaknesses before reality does." Every proposition—whether a decision, strategy, architecture, or plan—has vulnerabilities. This skill systematically exposes them through iterative adversarial cycles. Red Team attacks with substantive, steel-manned challenges. Blue Team defends with mitigations and hardening. The cycle continues until convergence: a battle-tested proposition with documented defenses. --- ## 1. Purpose ### Core Value Proposition Static analysis misses what adversarial pressure reveals. Red/Blue validation simulates the attacks your proposition will face—from competitors, critics, reality itself—and forces you to build defenses before you need them. The output is not just a risk list, but a hardened proposition that has survived systematic assault. ### Capabilities | # | Capability | Phase | Value | |---|-----------|-------|-------| | 1 | Proposition intake with attack surface mapping | Pre-Round | Define what can be attacked | | 2 | Experience pool loading (domain failure patterns) | Pre-Round | Avoid reinventing known failures | | 3 | Multi-category attack generation | Round N: Red | Surface vulnerabilities systematically | | 4 | Steel-manning attacks to maximum strength | Round N: Red | Ensure attacks are not strawmen | | 5 | Severity scoring (CRITICAL/HIGH/MEDIUM/LOW) | Round N: Red | Prioritize responses | | 6 | Defense generation (REFUTE/MITIGATE/ACCEPT/HARDEN) | Round N: Blue | Address each attack | | 7 | Proposition hardening through iterative refinement | Round N: Blue | Strengthen against attacks | | 8 | Convergence evaluation with explicit criteria | Round N: Eval | Know when to stop | | 9 | RISK-ASSESSMENT synthesis (CONTRACT-08) | Post-Round | Standardized output | | 10 | Hardened proposition generation | Post-Round | Battle-tested version | | 11 | Attack/defense log compilation | Post-Round | Audit trail | | 12 | Go/no-go recommendation | Post-Round | Decision support | --- ## 2. When to Use ### Ideal Use Cases | Scenario | Why Red/Blue Validation Matters | |----------|--------------------------------| | **Pre-commitment decision review** | Simulate objections before committing resources | | **Strategy validation** | War-game competitive responses and market realities | | **Architecture decision hardening** | Stress-test technical choices before implementation | | **Proposal defense preparation** | Anticipate and prepare for stakeholder pushback | | **Investment due diligence** | Adversarial review of financial projections and market assumptions | | **Security posture assessment** | Systematic attack surface enumeration | | **Go/no-go decisions** | High-stakes decisions need adversarial pressure | | **Policy/process validation** | Find edge cases and failure modes | | **Product launch readiness** | Anticipate market, competitive, and operational challenges | | **M&A target evaluation** | Adversarial review of synergy claims | ### Anti-Patterns (When NOT to Use) | Anti-Pattern | Why It's Ineffective | Better Alternative | |--------------|----------------------|-------------------| | **Low-stakes decisions** | Over-engineering for trivial choices | Just decide and iterate | | **Time-critical emergencies** | Fires need extinguishing, not philosophy | Act, then debrief | | **Already committed** | Adversarial review after commitment creates conflict | Use for future decisions | | **Early exploration** | Premature to attack ideas still forming | Use after initial validation | | **Confirmation theater** | Going through motions without genuine adversarial intent | Either commit to true adversarial thinking or skip | | **Reversible decisions** | Two-way doors don't need siege testing | Save intensity for one-way doors | --- ## 3. Parameters | Parameter | Type | Required | Default | Description | |-----------|------|----------|---------|-------------| | `subject_type` | enum | **yes** | — | decision \| strategy \| architecture \| plan \| policy \| investment \| security | | `max_rounds` | integer | no | 3 | Maximum red/blue cycles (1-5) | | `attack_intensity` | enum | no | standard | light \| standard \| aggressive | | `attack_categories` | list | no | auto | Categories to probe (see catalog); auto selects by subject_type | | `convergence_mode` | enum | no | no_new_critical | no_new_critical \| all_addressed \| round_limit | | `include_experience_pool` | boolean | no | true | Load domain-specific failure patterns | | `steel_manning_level` | enum | no | standard | minimal \| standard \| maximum | | `output_mode` | enum | no | full | risk_assessment \| hardened_proposition \| full_log | ### Parameter Effects Matrix | Parameter | Red Phase Effect | Blue Phase Effect | Convergence Effect | |-----------|-----------------|------------------|-------------------| | `attack_intensity: light` | Top 3 attack categories | Quick defenses | max_rounds capped at 2 | | `attack_intensity: standard` | Top 5 attack categories | Full defense protocol | Normal convergence | | `attack_intensity: aggressive` | All applicable categories | Exhaustive defense | Requires no_new_critical | | `steel_manning_level: minimal` | 1-pass attacks | — | Faster rounds | | `steel_manning_level: standard` | 2-pass steel-manning | — | Normal rounds | | `steel_manning_level: maximum` | 3-pass with ideological Turing test | — | Thorough rounds | | `convergence_mode: no_new_critical` | — | — | Stop when 0 new CRITICAL/HIGH | | `convergence_mode: all_addressed` | — | Must address all | Stop when no ACCEPT responses | | `convergence_mode: round_limit` | — | — | Stop at max_rounds | ### Auto-Selected Attack Categories by Subject Type | Subject Type | Default Attack Categories | |--------------|--------------------------| | `decision` | ASSUMPTIONS, ALTERNATIVES, REVERSIBILITY, CONSEQUENCES, TIMING | | `strategy` | COMPETITIVE, MARKET, EXECUTION, DEPENDENCIES, TIMELINE | | `architecture` | SCALABILITY, SECURITY, DEPENDENCIES, OPERATIONAL, EDGE_CASES | | `plan` | FEASIBILITY, RESOURCES, TIMELINE, DEPENDENCIES, RISKS | | `policy` | EDGE_CASES, ENFORCEMENT, UNINTENDED_CONSEQUENCES, POLITICAL | | `investment` | ECONOMIC, MARKET, EXECUTION, COMPETITIVE, ASSUMPTIONS | | `security` | ATTACK_SURFACE, VULNERABILITIES, DEPENDENCIES, OPERATIONAL | --- ## 4. Checkpoints This skill uses interactive checkpoints (see `references/checkpoints.yaml`) to resolve ambiguity: - **subject_type_classification** — When proposition type is ambiguous - **attack_intensity_selection** — When attack intensity not specified - **convergence_mode_selection** — When convergence criteria not specified - **premature_convergence_check** — When convergence met but warning signs present - **infinite_loop_risk** — When defenses generate more attacks than they resolve - **output_mode_selection** — When output format not specified --- ## 5. Iterative Workflow ### Workflow Overview ``` ┌─────────────────────────────────────────────────────────────────────────────┐ │ RED/BLUE TEAM VALIDATOR │ ├─────────────────────────────────────────────────────────────────────────────┤ │ │ │ ╔══════════════════════════════════════════════════════════════════════╗ │ │ ║ PRE-ROUND SETUP ║ │ │ ║ ┌─────────────┐ ┌─────────────┐ ┌─────────────┐ ║ │ │ ║ │ Proposition │ │ Attack │ │ Experience │ ║ │ │ ║ │ Intake │─▶│ Surface │─▶│ Pool │ ║ │ │ ║ │ │ │ Mapping │ │ Loading │ ║ │ │ ║ └─────────────┘ └─────────────┘ └─────────────┘ ║ │ │ ╚══════════════════════════════════════════════════════════════════════╝ │ │ │ │ │ ▼
Related in Security
mac-ops
IncludedComprehensive macOS workstation operations — diagnose kernel panics, identify failing drives, audit launchd startup items, decode wake reasons, triage TCC permission denials, manage APFS snapshots, recover from no-boot. Use for: Mac is slow, slow bootup, won't boot, kernel panic, kernel_task hot, mds_stores CPU, photoanalysisd, cloudd, login loop, gray screen, sleep wake failure, drive failing, IO errors, APFS snapshots eating space, Time Machine local snapshots, Spotlight indexing, launchd, LaunchAgent, LaunchDaemon, login items, TCC permissions, Full Disk Access, Screen Recording denied, Gatekeeper, quarantine, com.apple.quarantine, app is damaged, helper tool, /Library/PrivilegedHelperTools, pmset, wake reasons, dark wake, sysdiagnose, panic.ips, DiagnosticReports, configuration profile, MDM profile, remote diagnostics over SSH.
a11y-audit
IncludedRun accessibility audits on web projects combining automated scanning (axe-core, Lighthouse) with WCAG 2.1 AA compliance mapping, manual check guidance, and structured reporting. Output is configurable: markdown report only, markdown plus machine-readable JSON, or markdown plus issue tracker integration. Use this skill whenever the user mentions "accessibility audit", "a11y audit", "WCAG audit", "accessibility check", "compliance scan", or asks to check a web project for accessibility issues. Also trigger when the user wants to verify WCAG conformance or map findings to a specific standard (CAN-ASC-6.2, EN 301 549, ADA/AODA).
erpclaw
IncludedAI-native ERP system with self-extending OS. Full accounting, invoicing, inventory, purchasing, tax, billing, HR, payroll, advanced accounting (ASC 606/842, intercompany, consolidation), and financial reporting. 413 actions across 14 domains, 43 expansion modules. Constitutional guardrails, adversarial audit, schema migration. Double-entry GL, immutable audit trail, US GAAP.
assess
IncludedAssesses and rates quality 0-10 across multiple dimensions (correctness, maintainability, security, performance, testability, simplicity) with pros/cons analysis. Compares against project conventions and prior decisions from memory. Produces structured evaluation reports with actionable improvement suggestions. Use when evaluating code, designs, architectures, or comparing alternative approaches.
spring-boot-security-jwt
IncludedProvides JWT authentication and authorization patterns for Spring Boot 3.5.x covering token generation with JJWT, Bearer/cookie authentication, database/OAuth2 integration, and RBAC/permission-based access control using Spring Security 6.x. Use when implementing authentication or authorization in Spring Boot applications.
code-hardcode-audit
IncludedDetect hardcoded values, magic numbers, and leaked secrets. TRIGGERS - hardcode audit, magic numbers, PLR2004, secret scanning.