security-threat-model

Generate a repo-grounded threat model by triggering the assessment process on a repository root or sub-path. The skill enumerates assets, trust boundaries, and abuse paths, producing a structured security report with prioritized risks.

Repo-grounded threat modeling anchors architectural claims and risk assessments to concrete evidence in the codebase. Unlike generic reviews, it enforces an output contract with explicit assumptions, evidence anchors, and focused recommendations for manual review.

Yes, you can target specific code paths for evaluation. The skill accepts a scoped directory or sub-path as input, enumerates attacker capabilities and mitigations within that boundary, and highlights residual risks for manual review.

Document trust boundaries and attacker capabilities by running the threat model process. It identifies assets, maps abuse paths across trust boundaries, and outputs a threat matrix with prioritized risks and mitigations anchored to repository evidence.

The security report includes explicit assumptions and open questions derived from the codebase analysis. It enforces an output contract that pairs prioritized risks with evidence anchors, ensuring transparency about constraints and residual risks.

Avoid automated threat modeling when the repository lacks sufficient code or configuration evidence to anchor architectural claims. The skill requires concrete repo paths to enumerate assets, trust boundaries, and mitigations accurately.