security-threat-model

To generate a threat model, you provide a repository root path and any in-scope paths to the skill. It analyzes trust boundaries, assets, and attacker capabilities to produce a Markdown report with prioritized threats and mitigations.

Repository-grounded threat modeling ensures every architectural claim is backed by evidence in the codebase. It identifies specific abuse paths and attacker goals rather than relying on generic theoretical security frameworks.

No, repository access is required for evidence collection and context. The tool needs to analyze the actual codebase to map trust boundaries, identify assets, and generate a grounded threat model.

The generated threat model provides risk prioritization guidance based on explicit likelihood and impact reasoning. It identifies attacker goals and abuse paths to help you focus on the most critical vulnerabilities first.

Yes, you can specify in-scope paths alongside the repository root. The tool uses these paths to collect evidence and generate an AppSec-grade threat model tailored to your specific project structure.