threat-model Skill
Build a threat model for a target codebase. Three modes: "interview" walks an application owner through the four-question framework and produces a threat model from their answers; "bootstrap" derives a threat model from the code plus past vulnerabilities (CVEs, git history, pentest reports) when no owner is available; Published by anthropics in defending-code-reference-harness.
What is threat-model Skill?
Build a threat model for a target codebase. Three modes: "interview" walks an application owner through the four-question framework and produces a threat model from their answers; "bootstrap" derives a threat model from the code plus past vulnerabilities (CVEs, git history, pentest reports) when no owner is available; Published by anthropics in defending-code-reference-harness. This profile combines repository metadata with install, compatibility, and usage signals so developers can quickly decide whether it fits their agent workflow before opening the source repository.
Automated repository signals based on public metadata such as recency, license, installation evidence, and adoption. These are not a security audit or endorsement.
Key capabilities
- Includes SKILL.md support
- Reusable instructions support
- Testing
- Security review
- Data analysis
- Design and media
- Testing use cases
Technical details
- Install or run with Copy skill directory
When to use threat-model Skill
- Use it for testing.
- Use it for security review.
- Use it for data analysis.
- Use it for design and media.
Built with
Editorial notes
Source
- Creator: anthropics
- Repository: anthropics/defending-code-reference-harness
- Skill file: .claude/skills/threat-model/SKILL.md
What it does
Build a threat model for a target codebase. Three modes: "interview" walks an application owner through the four-question framework and produces a threat model from their answers; "bootstrap" derives a threat model from the code plus past vulnerabilities (CVEs, git history, pentest reports) when no owner is available;
Skill instructions
threat-model A threat model answers "what could go wrong with this system, who would do it, and what should we do about it?" independently of whether any specific bug has been found yet. It is the map; vulnerability discovery is the metal detector. A good threat model tells the pipeline where to look and tells triage which findings matter. Litmus test: If patching one line of code makes an entry disappear, it was a vulnerability, not a threat. A threat ("attacker achieves RCE via untrusted media parsing") still stands after every known bug is fixed; a vulnerability ("drwav.h:412 doesn't bounds-check chunksize") does not. This skill produces threats. Vulnerabilities appear only as evidence that raises a threat's likelihood score. Invocation: /threat-model [bootstrap-then-interview|bootstrap|interview] <target-dir [flags] --- Step 0 — Safety preamble (always runs first) This skill performs static analysis only. It reads source, git history, and any vulnerability reports the user supplies
Explore related resources
Frequently asked questions
What is threat-model?
threat-model is a open-source AI agent skill with Copy skill directory. Build a threat model for a target codebase. Three modes: "interview" walks an application owner through the four-question framework and produces a threat model from their answers; "bootstrap" derives a.
Who is threat-model best for?
threat-model is best for reusing agent instructions, scripts, and references, testing workflows, security review workflows, data analysis workflows.
How do I install threat-model?
Install or run threat-model using Copy skill directory. Check threat-model for the latest setup command.
Is threat-model actively maintained?
threat-model may need a closer maintenance check before production use.
Auto-fetched from GitHub.
