skills.rest
Estom
EstomCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

security-threat-model

Generate repository-grounded threat models with evidence anchors and mermaid diagrams.

Updated Mar 17, 2026
Search Tags:#security#threat modeling#appsec#repository analysis#attack surface#mitigations#abuse path
One-click install
npx skills add https://github.com/Estom/aiflex --skill security-threat-model-estom
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: security-threat-model
Source: https://github.com/Estom/aiflex/tree/main/skills-repo/openai-skills/security-threat-model
Command: npx skills add https://github.com/Estom/aiflex --skill security-threat-model-estom

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

This Skill helps security engineers produce focused, evidence-anchored threat models for a repository or a specific project path so reviewers get actionable abuse paths and prioritized mitigations rather than generic checklists.

Core Features & Use Cases

  • Repository-grounded analysis: enumerates trust boundaries, assets, entry points, attacker capabilities, and concrete abuse paths tied to repo evidence.
  • Prioritization & mitigation: provides qualitative likelihood/impact reasoning and concrete, location-specific mitigations and detection ideas.
  • Interactive validation: surfaces key assumptions and asks targeted questions before finalizing the report to avoid mis-scoping.
  • Use Case: security reviewer asks for a threat model of a codebase or subpath and receives a concise Markdown report with evidence anchors and a mermaid diagram.

Quick Start

Use the security-threat-model skill to produce an evidence-anchored threat model for the repository or a specified subpath, asking the user to confirm deployment and exposure assumptions first.

Frequently Asked Questions about security-threat-model

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I generate a threat model for my codebase?▼

Threat modeling a codebase involves enumerating trust boundaries, assets, attacker capabilities, and abuse paths tied to repository evidence, producing a concise Markdown report with a mermaid diagram and prioritized mitigations.

What is repository-grounded threat modeling?▼

Repository-grounded threat modeling analyzes codebases or specified in-repo paths to map attack surfaces and abuse paths, using evidence anchors referencing repository paths rather than generic checklists to provide actionable, location-specific mitigations.

Can I scope an AppSec threat model to a specific subpath in my repository?▼

Yes, you can apply AppSec threat modeling to specified in-repo paths, allowing focused analysis of a subpath where the skill surfaces deployment assumptions and asks targeted questions before finalizing the report to avoid mis-scoping.

How do I prioritize mitigations during an application security review?▼

To prioritize mitigations during an application security review, the skill provides qualitative likelihood and impact reasoning for identified abuse paths, delivering concrete, location-specific detection ideas and mitigations tied to repository evidence.

What format does the threat model report output use?▼

The threat model report outputs a concise Markdown format featuring a mermaid diagram that visualizes trust boundaries and abuse paths, alongside prioritized, evidence-anchored mitigations for security reviews.

Related Skills

Explore More Software Engineering Skills→
thanhquan3010thanhquan3010

security-threat-model

Generate repository-grounded threat models with trust boundaries, assets, and mitigations.

Community
Advanced
tech-leads-clubtech-leads-club
5.0k

security-threat-model

Generate a repo-grounded AppSec threat model with assets, trust boundaries, and mitigations.

Official
Advanced
P4rziP4rzi

security-threat-model

Generate repository-grounded threat models with trust boundaries, assets, and mitigations.

Community
Advanced
SaturateSaturate

security-deep-dive

Analyze software security to identify vulnerabilities and attack surfaces.

Community
Advanced