threat-model Skill
Use when Codex is already in the threat-modeling phase of a security scan, the user explicitly invokes $threat-model, or the user explicitly asks to create, update, or persist a repository threat model. Do not use as the primary trigger for full PR, commit, branch, patch, or repository scans. Published by openai in plugins.
What is threat-model Skill?
Use when Codex is already in the threat-modeling phase of a security scan, the user explicitly invokes $threat-model, or the user explicitly asks to create, update, or persist a repository threat model. Do not use as the primary trigger for full PR, commit, branch, patch, or repository scans. Published by openai in plugins. This profile combines repository metadata with install, compatibility, and usage signals so developers can quickly decide whether it fits their agent workflow before opening the source repository.
Automated repository signals based on public metadata such as recency, license, installation evidence, and adoption. These are not a security audit or endorsement.
Key capabilities
- Includes SKILL.md support
- Reusable instructions support
- Security review
- Security review use cases
Technical details
- Install or run with Copy skill directory
When to use threat-model Skill
- Use it for security review.
Built with
Editorial notes
Source
- Creator: openai
- Repository: openai/plugins
- Skill file: plugins/codex-security/skills/threat-model/SKILL.md
What it does
Use when Codex is already in the threat-modeling phase of a security scan, the user explicitly invokes $threat-model, or the user explicitly asks to create, update, or persist a repository threat model. Do not use as the primary trigger for full PR, commit, branch, patch, or repository scans.
Skill instructions
Security Threat Model Objective Establish the repository-scoped threat model at the path defined in ../../references/scan-artifacts.md. Reuse a cached model only when its final Repository and Version lines match the current target. AGENTS.md or resolved SECURITY.md guidance can be that authoritative source when it is sufficiently specific about the repository's product surfaces, trust boundaries, attacker-controlled inputs, assumptions, or security scan guidance to serve as the threat model. If no threat model is provided, generate a repository-scoped threat model to be used in future bug discovery. The threat model should holistically cover the entire repository and should make it obvious: - what assets or privileges matter - what trust boundaries exist - what inputs are attacker-controlled - what invariants the code must preserve - what repository-wide failure modes would matter most Artifact Resolution The path references in this skill are the default locations for this phase. If th
Explore related resources
Frequently asked questions
What is threat-model?
threat-model is a open-source AI agent skill with Copy skill directory. Use when Codex is already in the threat-modeling phase of a security scan, the user explicitly invokes $threat-model, or the user explicitly asks to create, update, or persist a repository threat model.
Who is threat-model best for?
threat-model is best for reusing agent instructions, scripts, and references, security review workflows.
How do I install threat-model?
Install or run threat-model using Copy skill directory. Check threat-model for the latest setup command.
Is threat-model actively maintained?
threat-model may need a closer maintenance check before production use.
Auto-fetched from GitHub.
