create-threat-model

Analyze a codebase and generate a structured threat model document.

399|31|Updated Mar 11, 2026

Search Tags:#code analysis #security #vulnerability #risk assessment #cybersecurity #threat model

Ready to run

npx skills add https://github.com/tobihagemann/turbo --skill create-threat-model

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: create-threat-model
Source: https://github.com/tobihagemann/turbo/tree/main/skills/create-threat-model
Command: npx skills add https://github.com/tobihagemann/turbo --skill create-threat-model

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

This Skill automates the process of analyzing a codebase to identify potential security risks, assets, trust boundaries, and attack surfaces, producing a structured threat model document.

Core Features & Use Cases

Codebase Analysis: Scans code to identify security-sensitive operations and components.
Threat Modeling: Generates a detailed threat model document outlining assets, trust boundaries, assumptions, mitigations, and attacker stories.
Use Case: Before deploying a new microservice, use this Skill to generate a threat model that helps the security team understand potential vulnerabilities and prioritize remediation efforts.

Quick Start

Use the create-threat-model skill to analyze the current codebase and produce a threat model.

Frequently Asked Questions about create-threat-model

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I generate a threat model for my codebase?▼

A threat model for a codebase identifies security-sensitive operations, trust boundaries, and attack surfaces, then documents potential vulnerabilities and attacker stories to help security teams prioritize remediation efforts before deployment.

What is included in a codebase threat model document?▼

A codebase threat model document includes identified assets, trust boundaries, attack surfaces, existing mitigations, attacker stories, and calibrated severity ratings based on security-relevant code discovered during reconnaissance.

How does automated threat modeling adapt to different project sizes?▼

Automated threat modeling adapts to different project sizes by calibrating the depth of its reconnaissance and security-relevant code discovery, ensuring the four-section threat model matches the specific scope of the analyzed codebase.

Can I use this threat model skill for a new microservice deployment?▼

Yes, you can use this threat model skill for a new microservice deployment to scan the code, identify potential vulnerabilities, and produce a structured document that helps your security team understand risks and prioritize remediation.

Do I need any external dependencies to run a codebase security analysis?▼

You do not need any external dependencies to run this codebase security analysis, as the skill operates independently to perform reconnaissance and generate the threat model without requiring additional packages.