threat-model Skill
Use when Codex is already in the threat-modeling phase of a security scan, the user explicitly invokes $threat-model, or the user explicitly asks to create, update, or persist a repository threat model. Do not use as the primary trigger for full PR, commit, branch, patch, or repository scans. Published by openai in plugins.
Decision snapshot
Is this a fit?
Security review, Includes SKILL.md, Reusable instructions
Compatibility not yet detected.
Permission behavior not yet detected.
Copy skill directory
22 days ago
No specific cautions were detected. Review the source and requested permissions before installing.
What is threat-model Skill?
Use when Codex is already in the threat-modeling phase of a security scan, the user explicitly invokes $threat-model, or the user explicitly asks to create, update, or persist a repository threat model. Do not use as the primary trigger for full PR, commit, branch, patch, or repository scans. Published by openai in plugins. This profile combines repository metadata with install, compatibility, and usage signals so developers can quickly decide whether it fits their agent workflow before opening the source repository.
Automated repository signals based on public metadata such as recency, license, installation evidence, and adoption. These are not a security audit or endorsement. See how SkillIndex evaluates profiles.
Key capabilities
- Includes SKILL.md support
- Reusable instructions support
- Security review
- Security review use cases
Declared skill metadata
- Source file: plugins/codex-security/skills/threat-model/SKILL.md
These fields retain source and confidence evidence from the indexed SKILL.md.
Compatibility and setup
- Install or run with Copy skill directory
When to use threat-model Skill
- Use it for security review.
Built with
Editorial notes
Source
- Creator: openai
- Repository: openai/plugins
- Skill file: plugins/codex-security/skills/threat-model/SKILL.md
What it does
Use when Codex is already in the threat-modeling phase of a security scan, the user explicitly invokes $threat-model, or the user explicitly asks to create, update, or persist a repository threat model. Do not use as the primary trigger for full PR, commit, branch, patch, or repository scans.
Skill instructions
Security Threat Model Before choosing paths or saving retained output, read ../../references/artifact-storage.md and follow its storage policy. Create or reuse the repository-scoped threat model defined in ../../references/scan-artifacts.md. Honor explicit user-provided input and output paths. If an explicitly required input is missing, ask for it instead of substituting a generated model. A generated model describes the repository's actual architecture, attacker capabilities, trust boundaries, and security-relevant failure modes. Standard scans and Deep Scan workers build their threat models within their ordinary Standard scan workflow; neither invokes this separate phase skill. Workflow 1. Resolve targetid, the current version (revision for an immutable Git tree, snapshot digest otherwise), the shared repository model, and any required per-scan output using ../../references/scan-artifacts.md. Honor host instructions that bypass the shared cache. For a scan with a supplied model, none
Verified compatibility and discovery
Frequently asked questions
What is threat-model?
threat-model is a open-source AI agent skill with Copy skill directory. Use when Codex is already in the threat-modeling phase of a security scan, the user explicitly invokes $threat-model, or the user explicitly asks to create, update, or persist a repository threat model.
Who is threat-model best for?
threat-model is best for reusing agent instructions, scripts, and references, security review workflows.
How do I install threat-model?
Install or run threat-model using Copy skill directory. Check threat-model for the latest setup command.
Is threat-model actively maintained?
threat-model may need a closer maintenance check before production use.
Project health auto-fetched from the source repository.
Maintain this resource?
Review this source-backed profile, send a correction with evidence, or link to it from your documentation. Claims verify your relationship to the project; profile facts still require source evidence and editorial review.
