Security Response — Red Team / Purple Team (Planning + Coverage Mapping)

Execution mode: SKILL-direct, DEFENSIVE-ONLY. This is a response-family planning skill. It reads existing evidence and writes ONE machine-readable fact-source — the ATT&CK coverage matrix — via appsec-sdk attack.coverage <tag>. It is not a pentest, not an attack runner, not a red-team C2. Active adversary validation is a separate, manual, ROE-gated path it never touches.

⛔ 0. HARD BOUNDARY (read this first — it is the whole point of the skill)

This skill is PLANNING + COVERAGE MAPPING ONLY. It maps which adversary techniques are relevant to the project, and for each one records whether a control and a detection already exist — sourced from evidence that other defensive skills already produced. It then plans what blue-team detection / control work should close the gaps.