security-threat-model

Generate repository-grounded threat models with trust boundaries and prioritized mitigations.

3|Updated Apr 18, 2026

Search Tags:#threat modeling #appsec #repository analysis #mitigations #attack paths

Ready to run

npx skills add https://github.com/garochee33/DSH --skill security-threat-model-garochee33

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: security-threat-model
Source: https://github.com/garochee33/DSH/tree/main/agents/skills/security-threat-model
Command: npx skills add https://github.com/garochee33/DSH --skill security-threat-model-garochee33

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This Skill helps you turn a codebase into a clear, repository-grounded threat model so you can identify realistic security risks before deployment, review trust boundaries, and prioritize mitigations with evidence.

Core Features & Use Cases

Repository-specific analysis: Anchors threats to actual components, entry points, and data flows found in the repository.
Attack path enumeration: Identifies assets, trust boundaries, attacker capabilities, abuse paths, and likely impacts.
Actionable mitigation planning: Produces concise, prioritized security recommendations tied to concrete repo locations.
Use case: A developer asks for a threat model of a new service before launch to understand exposure, abuse scenarios, and missing controls.

Quick Start

Ask for a threat model of the specified repository or path, and include any details about deployment, authentication, and data sensitivity that affect the security assumptions.

Frequently Asked Questions about security-threat-model

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I generate a threat model for my codebase before launch?▼

To generate a threat model for your codebase, provide the repository path and relevant deployment details. The analysis identifies trust boundaries, attacker capabilities, and abuse paths to produce prioritized mitigations anchored to specific repo locations.

What is repository-grounded threat modeling and how does it work?▼

Repository-grounded threat modeling anchors security risks to actual components, entry points, and data flows found in the code. It evaluates assets and trust boundaries to enumerate realistic attack paths and prioritize evidence-based mitigations for services or libraries.

Can I use this for AppSec reviews on CLIs and background workers?▼

Yes, you can use this for AppSec reviews on CLIs, background workers, and services. It requires evidence-based identification of entry points and trust boundaries to enumerate abuse paths and deliver prioritized security mitigations for those specific components.

What's the best way to identify trust boundaries and attack paths in a repository?▼

The best way to identify trust boundaries and attack paths is to analyze the repository's actual data flows and entry points. This evidence-based approach maps attacker capabilities against identified assets to expose realistic abuse scenarios and missing controls.

Do I need to provide deployment details to get accurate abuse path enumeration?▼

Yes, you need to provide deployment details, authentication methods, and data sensitivity context. Including these security assumptions ensures the threat model accurately reflects your environment and produces relevant, prioritized mitigations for the identified attack paths.