security-threat-model

Generate repository-grounded threat models enumerating trust boundaries, assets, and abuse paths.

Updated Feb 20, 2026

Search Tags:#code analysis #security #threat modeling #risk assessment #appsec #abuse paths

Ready to run

npx skills add https://github.com/garethdaine/agent --skill security-threat-model-garethdaine

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: security-threat-model
Source: https://github.com/garethdaine/agent/tree/main/.cursor/skills/security-threat-model
Command: npx skills add https://github.com/garethdaine/agent --skill security-threat-model-garethdaine

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) components.

What problem does it solve?

This Skill automates the creation of detailed, repository-specific threat models, helping security engineers identify and prioritize potential vulnerabilities and abuse paths.

Core Features & Use Cases

Automated Threat Modeling: Generates AppSec-grade threat models based on codebase analysis.
Abuse Path Enumeration: Identifies and prioritizes realistic attacker goals and exploit paths.
Use Case: A security engineer needs to assess the risk of a new microservice. They can use this Skill to quickly generate a threat model that highlights critical trust boundaries, assets, and potential attack vectors, guiding their manual review.

Quick Start

Use the security-threat-model skill to generate a threat model for the current repository.

Frequently Asked Questions about security-threat-model

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I generate a threat model from my codebase?▼

A repository-grounded threat model enumerates trust boundaries, assets, attacker capabilities, abuse paths, and mitigations. It provides security engineers with a structured assessment of potential vulnerabilities and prioritized exploit paths specific to the analyzed codebase.

How do I enumerate abuse paths during application security risk assessment?▼

This Skill requires an explicit request for codebase threat modeling, abuse path enumeration, or AppSec analysis. It avoids general architecture summaries and non-security design tasks, ensuring the output focuses strictly on security risks and abuse path identification.

How do I identify trust boundaries and assets for a new microservice?▼

No external dependencies are required to generate repository-grounded threat models. The Skill operates using included scripts and references to analyze the codebase directly, requiring only an explicit request for AppSec threat modeling or abuse path enumeration.

What is repo-grounded threat modeling and how does it work?▼

Repo-grounded threat modeling automates the creation of AppSec-grade threat models based on direct codebase analysis. It works by enumerating trust boundaries, assets, attacker capabilities, and mitigations to identify and prioritize potential vulnerabilities.

Does this threat modeling approach work without external security dependencies?▼

Yes, this threat modeling approach works without external dependencies, utilizing built-in scripts and references. It generates AppSec-grade threat models directly from the repository codebase without requiring additional security tools or packages.

When should I use automated codebase threat modeling instead of manual architecture review?▼

Automated codebase threat modeling should be used to quickly assess risks like those in new microservices before manual review. It generates a baseline model highlighting critical trust boundaries, assets, and attack vectors, guiding and accelerating the security engineer's manual analysis.