skills.rest
bzellman
bzellmanCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

security-threat-model

Generate repository-grounded threat models with trust boundaries and mitigations.

Updated Apr 7, 2026
Search Tags:#risk-assessment#threat-modeling#appsec#trust-boundaries#security-analysis#repository-evidence
One-click install
npx skills add https://github.com/bzellman/earp-kit --skill security-threat-model-bzellman
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: security-threat-model
Source: https://github.com/bzellman/earp-kit/tree/main/skills/system/security-threat-model
Command: npx skills add https://github.com/bzellman/earp-kit --skill security-threat-model-bzellman

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Repository-grounded threat modeling that anchors architectural claims and threat scenarios to evidence in the codebase, enabling precise risk assessment for AppSec reviews.

Core Features & Use Cases

  • Enumerates trust boundaries, assets, attacker capabilities, and abuse paths directly from the repository.
  • Produces a prioritized threat catalog with concrete mitigations that reference repo evidence.
  • Distinguishes runtime behavior from CI/build tooling and surfaces actionable review paths.

Quick Start

Analyze a codebase to generate a repo-specific threat model by referencing repository evidence and returning an actionable report.

Frequently Asked Questions about security-threat-model

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I generate a threat model anchored to actual codebase evidence?▼

Threat modeling from repository evidence involves enumerating trust boundaries and attacker capabilities directly from the codebase. This approach separates runtime behavior from CI tooling to produce a prioritized threat catalog with concrete mitigations.

How do I identify trust boundaries and attacker capabilities for an application security review?▼

Application security threat modeling distinguishes runtime behavior from CI and build tooling by analyzing repository evidence. This separation ensures the threat catalog focuses on production risks rather than development environment artifacts.

What is the best way to map abuse paths and security controls during threat modeling?▼

To map abuse paths using repository evidence, analyze the codebase to identify security controls and attacker capabilities. This produces an actionable threat catalog with explicit assumptions and concrete mitigations grounded in repo paths.

Does repository-grounded threat modeling separate runtime behavior from CI tooling?▼

Yes, repository-grounded threat modeling explicitly separates runtime behavior from CI and dev tooling. This distinction ensures the threat catalog accurately reflects production security controls rather than build pipeline artifacts.

Can I use repository evidence to produce a prioritized threat catalog with concrete mitigations?▼

Yes, you can produce a prioritized threat catalog by analyzing repository evidence to identify assets and abuse paths. This ensures every mitigation references a specific repo path and states explicit assumptions for accurate AppSec reviews.

Related Skills

Explore More Software Engineering Skills→
syl2042syl2042

security-threat-model

Identify repository-specific security threats and document evidence-backed threat models.

Community
Advanced
oiagorodriguesoiagorodrigues

security-threat-model

Generate a repo-grounded threat model with assets, trust boundaries, and mitigations.

Community
Advanced
shirulotshirulot

security-threat-model

Generate repository-grounded threat models from trust boundaries, assets, and entry points.

Community
Advanced
heyzudeheyzude
4

security-threat-model

Generate repository-grounded threat models enumerating trust boundaries, assets, and abuse paths.

Community
Advanced