security-threat-model Skill
Repository-grounded threat modeling that enumerates trust boundaries, assets, attacker capabilities, abuse paths, and mitigations, and writes a concise Markdown threat model. Trigger only when the user explicitly asks to threat model a codebase or path, enumerate threats/abuse paths, or perform AppSec threat modeling. Published by openai in skills.
What is security-threat-model Skill?
Repository-grounded threat modeling that enumerates trust boundaries, assets, attacker capabilities, abuse paths, and mitigations, and writes a concise Markdown threat model. Trigger only when the user explicitly asks to threat model a codebase or path, enumerate threats/abuse paths, or perform AppSec threat modeling. Published by openai in skills. This profile combines repository metadata with install, compatibility, and usage signals so developers can quickly decide whether it fits their agent workflow before opening the source repository.
Automated repository signals based on public metadata such as recency, license, installation evidence, and adoption. These are not a security audit or endorsement.
Key capabilities
- Includes SKILL.md support
- Reusable instructions support
- Security review
- Deployment
- Documentation
- Data analysis
- Security review use cases
Technical details
- Install or run with Copy skill directory
When to use security-threat-model Skill
- Use it for security review.
- Use it for deployment.
- Use it for documentation.
- Use it for data analysis.
Built with
Editorial notes
Source
- Creator: openai
- Repository: openai/skills
- Skill file: skills/.curated/security-threat-model/SKILL.md
What it does
Repository-grounded threat modeling that enumerates trust boundaries, assets, attacker capabilities, abuse paths, and mitigations, and writes a concise Markdown threat model. Trigger only when the user explicitly asks to threat model a codebase or path, enumerate threats/abuse paths, or perform AppSec threat modeling.
Skill instructions
Threat Model Source Code Repo Deliver an actionable AppSec-grade threat model that is specific to the repository or a project path, not a generic checklist. Anchor every architectural claim to evidence in the repo and keep assumptions explicit. Prioritizing realistic attacker goals and concrete impacts over generic checklists. Quick start 1) Collect (or infer) inputs: - Repo root path and any in-scope paths. - Intended usage, deployment model, internet exposure, and auth expectations (if known). - Any existing repository summary or architecture spec. - Use prompts in references/prompt-template.md to generate a repository summary. - Follow the required output contract in references/prompt-template.md. Use it verbatim when possible. Workflow 1) Scope and extract the system model - Identify primary components, data stores, and external integrations from the repo summary. - Identify how the system runs (server, CLI, library, worker) and its entrypoints. - Separate runtime behavior from CI/
Explore related resources
Frequently asked questions
What is security-threat-model?
security-threat-model is a open-source AI agent skill with Copy skill directory. Repository-grounded threat modeling that enumerates trust boundaries, assets, attacker capabilities, abuse paths, and mitigations, and writes a concise Markdown threat model.
Who is security-threat-model best for?
security-threat-model is best for reusing agent instructions, scripts, and references, security review workflows, deployment workflows, documentation workflows.
How do I install security-threat-model?
Install or run security-threat-model using Copy skill directory. Check security-threat-model for the latest setup command.
Is security-threat-model actively maintained?
security-threat-model may need a closer maintenance check before production use.
Auto-fetched from GitHub.
