skills.rest
dicarsmtz
dicarsmtzCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

security-threat-model

Generates repository-grounded threat models with trust boundaries, abuse paths, and prioritized mitigations.

1|Updated May 8, 2026
Search Tags:#mermaid#threat modeling#security analysis#appsec#risk prioritization#abuse paths#trust boundaries
One-click install
npx skills add https://github.com/dicarsmtz/product-engineering-kit --skill security-threat-model-dicarsmtz
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: security-threat-model
Source: https://github.com/dicarsmtz/product-engineering-kit/tree/main/plugins/product-engineering/skills/security-threat-model
Command: npx skills add https://github.com/dicarsmtz/product-engineering-kit --skill security-threat-model-dicarsmtz

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve? Security teams need threat models that reflect the actual codebase rather than generic checklists, but manually mapping trust boundaries, entry points, and abuse paths across a repository is slow and error-prone. ## Core Features & Use Cases - Repo-Grounded Analysis: Enumerates components, trust boundaries, assets, entry points, and attacker capabilities with evidence anchors to repository paths. - Prioritized Threat Enumeration: Produces abuse paths with qualitative likelihood and impact ratings, existing controls, gaps, and concrete mitigations. - Structured Output Contract: Writes a Markdown threat model with a Mermaid diagram, threat table, criticality calibration, and focus paths for manual review. - Use Case: Point the Skill at a service repository before a launch review to get an AppSec-grade threat model with prioritized risks and review focus paths. ## Quick Start Ask the assistant to create a threat model for this repository or a specific in-scope path, then answer its context questions about deployment and exposure.

Frequently Asked Questions about security-threat-model

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I create a threat model for my codebase?▼

Ask the assistant to threat model the repository or a specific path. It collects scope and deployment context, maps components and trust boundaries from repo evidence, validates assumptions with you, then writes a Markdown threat model file.

What does a repo-grounded threat model include?▼

The output includes an executive summary, system model with a Mermaid diagram, asset and attacker models, entry point tables, abuse paths, a prioritized threat table with mitigations, and focus paths for manual security review.

When should I not use this threat modeling skill?▼

Do not trigger it for general architecture summaries, code reviews, or non-security design work. It is scoped to explicit threat modeling, abuse path enumeration, and AppSec analysis requests only.

How are threats prioritized in the threat model?▼

Each threat receives qualitative likelihood and impact ratings with short justifications, combined into a critical/high/medium/low priority adjusted for existing controls. The report states which assumptions most influence the ranking.

Does the threat model require user input before finalizing?▼

Yes. Before producing the final report, it summarizes key assumptions and asks one to three targeted questions about deployment model, exposure, and data sensitivity, then waits for your feedback or proceeds with explicit assumptions.

Related Skills

Explore More Software Engineering Skills→
shirulotshirulot

security-threat-model

Generate repository-grounded threat models from trust boundaries, assets, and entry points.

Community
Advanced
guneysolguneysol

security-threat-model

Generates repository-grounded threat models with trust boundaries, abuse paths, and prioritized mitigations.

Community
Advanced
AlexanderMattTurnerAlexanderMattTurner
64

vuln-research

Find, reproduce, and report security vulnerabilities against a stated threat model.

Official
Advanced
NickCrewNickCrew
29

threat-modeling-techniques

Identify and analyze security threats using STRIDE, attack trees, and risk assessment.

Community
Advanced