repository-threat-model

Name: repository-threat-model
Availability: InStock
Author: Pensar

Analyze repository structure and generate a STRIDE threat model report.

1|Updated Mar 12, 2026

Search Tags:#security #stride #code-review #risk-analysis #threat-model #threat-detection

Ready to run

npx skills add https://github.com/pensarai/skills --skill repository-threat-model

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: repository-threat-model
Source: https://github.com/pensarai/skills/tree/main/skills/repository-threat-model
Command: npx skills add https://github.com/pensarai/skills --skill repository-threat-model

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Identify security risks in a codebase and generate a structured threat model report to guide risk mitigation and compliance documentation.

Core Features & Use Cases

Analyze repository structure, assets, and trust boundaries to capture system context.
Enumerate STRIDE threats and generate a THREAT_MODEL.md in .pensar.
Produce actionable mitigations and risk ratings for developers and security engineers.

Quick Start

Run the threat-model skill on your target repository to generate a detailed .pensar/THREAT_MODEL.md.

Frequently Asked Questions about repository-threat-model

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I generate a threat model for a code repository?▼

You can generate a structured threat model by running an automated analysis skill on your target code repository. It identifies security risks and outputs a detailed THREAT_MODEL.md file containing assets, trust boundaries, STRIDE threats, and risk ratings.

What is STRIDE threat analysis and how does it apply to my codebase?▼

STRIDE threat analysis is a framework categorizing security risks into Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, and Elevation of Privilege. Applying it to a codebase enumerates specific attack surfaces and generates actionable mitigations for developers.

Can I use automated threat detection for projects of any size and tech stack?▼

Yes, automated threat detection is applicable to projects of any size and tech stack. It analyzes repository structures, configuration files, and dependencies to capture system context and document security risks regardless of the underlying technology.

How do I document trust boundaries and attack surfaces in a security risk analysis?▼

You document trust boundaries and attack surfaces by analyzing the repository structure to capture system context. A structured threat model explicitly references code structures, configuration files, and dependencies to map these security parameters.

What is the best way to create compliance documentation for codebase security risks?▼

The best way to create compliance documentation for codebase security risks is to generate a structured threat model report. This produces a THREAT_MODEL.md file with risk ratings and mitigations that guides risk mitigation and compliance efforts.