skills.rest
bingran-you
bingran-youCOMMUNITY
Explore all skills by this author →
Website𝕏@bingran_bryGitHub

security-threat-model

Generate repository-grounded threat models with risk ranking and mitigations.

3|Updated Jan 14, 2022
Search Tags:#risk-assessment#threat-modeling#appsec#trust-boundaries#security-controls#repo-evidence
One-click install
npx skills add https://github.com/bingran-you/bingran-you --skill security-threat-model-bingran-you
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: security-threat-model
Source: https://github.com/bingran-you/bingran-you/tree/main/repo-skills/security-threat-model
Command: npx skills add https://github.com/bingran-you/bingran-you --skill security-threat-model-bingran-you

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

This Skill helps AppSec engineers produce repo-specific threat models anchored to concrete evidence, enabling focused risk assessment and actionable mitigations.

Core Features & Use Cases

  • Guides systematic threat modeling from scope to mitigations, all anchored to repository evidence.
  • Enumerates system components, trust boundaries, assets, attacker capabilities, and abuse paths with explicit justifications.
  • Produces a prioritized risk report, including mitigations and detection ideas, suitable for integration into security reviews and development lifecycles.

Quick Start

Generate a repo-grounded threat model for this codebase using repository evidence and the provided prompt template.

Frequently Asked Questions about security-threat-model

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
What is repo-driven threat modeling for application security?▼

Repo-driven threat modeling anchors architectural security analysis directly to repository evidence. It enumerates system components, trust boundaries, and attacker capabilities to produce a risk assessment grounded in concrete codebase artifacts.

How do I generate a threat model anchored to repository evidence?▼

To generate an evidence-anchored threat model, process the repository to enumerate assets and abuse paths. The system evaluates runtime and CI contexts, outputting a prioritized risk report with justifications and mitigations.

Can I use this threat modeling approach for CI pipeline risk assessment?▼

Yes, this threat modeling approach explicitly supports CI contexts. It assesses attacker capabilities and trust boundaries across both runtime and CI pipeline configurations to identify applicable security controls.

Does this threat modeling process require specific security tools or dependencies?▼

No external dependencies are required to perform this threat modeling. It relies on analyzing repository evidence directly to map trust boundaries, rank risks, and formulate mitigation plans.

What is the best way to map trust boundaries and security controls in a codebase?▼

The best way to map trust boundaries is by systematically enumerating system components and attacker capabilities from repository evidence. This yields explicit justifications for security controls and abuse paths.

How does evidence-grounded threat modeling differ from generic risk assessment?▼

Evidence-grounded threat modeling differs from generic risk assessment by anchoring architectural claims to specific repository evidence. It produces focused, actionable mitigations rather than abstract security assumptions.

Related Skills

Explore More Software Engineering Skills→
JeromyJSmithJeromyJSmith
3

source-command-gf-setup

Initialize Graphify code graph analysis for the LATTICE repository.

Community
Basic
ArogyaReddyArogyaReddy

threat-mitigation-mapping

Map identified threats to corresponding security controls for prioritized risk mitigation.

Community
Advanced
koki3141koki3141
2

security-threat-model

Generate a repository-grounded threat model with trust boundaries, assets, and mitigations.

Community
Advanced
UlanxxUlanxx

canary

Monitor live URLs for console errors, performance regressions, and page failures.

Community
Advanced