security-threat-model

Build repository-grounded threat models with trust boundaries and abuse paths.

4|Updated Mar 13, 2026

Search Tags:#threat modeling #security review #appsec #mitigations #abuse paths #trust boundaries

Ready to run

npx skills add https://github.com/euxx/claude-skills-for-copilot --skill security-threat-model-euxx

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: security-threat-model
Source: https://github.com/euxx/claude-skills-for-copilot/tree/main/skills/security-threat-model
Command: npx skills add https://github.com/euxx/claude-skills-for-copilot --skill security-threat-model-euxx

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This Skill helps you turn a repository or scoped path into a practical security threat model by identifying trust boundaries, attacker capabilities, abuse paths, and mitigations.

Core Features & Use Cases

Repository-grounded analysis: Anchors risks to evidence in the codebase instead of generic checklists.
AppSec-focused prioritization: Ranks threats by likelihood, impact, and existing controls so the most important issues are obvious.
Actionable deliverable: Produces a concise Markdown report with assets, entry points, abuse paths, a Mermaid diagram, and security recommendations.
Use case: Review a new service, CI pipeline, or sensitive feature before release to understand how an attacker could reach and abuse it.

Quick Start

Ask the security-threat-model skill to threat model the repository path or codebase you want reviewed.

Frequently Asked Questions about security-threat-model

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I build a threat model from my source code repository?▼

To build a threat model from your repository, this Skill anchors the analysis to evidence in your codebase, identifying assets, trust boundaries, and abuse paths. It produces a concise Markdown report with security recommendations and a Mermaid diagram.

When do I need to perform an AppSec threat model before a release?▼

You need an AppSec threat model when reviewing a new service, CI pipeline, deployment surface, or sensitive feature before release. It identifies how an attacker could reach and abuse the architecture changes by analyzing data flows and residual risk.

How do I identify trust boundaries and abuse paths in my application architecture?▼

Identifying trust boundaries and abuse paths involves evidence-backed analysis of data flows and attacker capabilities. This Skill scans your scoped codebase path to map entry points and rank threats by likelihood, impact, and existing mitigations.

Can I generate a threat model report with a Mermaid diagram for my CI pipeline?▼

Yes, you can generate a threat model report for your CI pipeline. The Skill outputs an actionable Markdown deliverable that includes a Mermaid diagram, assets, entry points, and prioritized security recommendations for deployment surfaces.

Does this threat modeling approach use generic security checklists or codebase evidence?▼

This threat modeling approach uses repository-grounded evidence rather than generic security checklists. It anchors identified risks directly to the codebase or scoped path, ensuring the analysis reflects the actual implementation of assets and data flows.

What is the best way to prioritize security threats found during an architecture review?▼

The best way to prioritize security threats is by ranking them according to likelihood, impact, and existing controls. This Skill evaluates attacker capabilities and residual risk to make the most important AppSec issues obvious in the final report.