skills.rest
gooftroop
gooftroopCOMMUNITY
Explore all skills by this author →
GitHub

security-threat-model

Generate repository-grounded threat models with enumerated trust boundaries and mitigations.

Updated Mar 6, 2026
Search Tags:#code analysis#security#threat modeling#risk assessment#vulnerability management#appsec
One-click install
npx skills add https://github.com/gooftroop/Armoury --skill security-threat-model-gooftroop
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: security-threat-model
Source: https://github.com/gooftroop/Armoury/tree/main/.opencode/skills/security-threat-model
Command: npx skills add https://github.com/gooftroop/Armoury --skill security-threat-model-gooftroop

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

This Skill automates the generation of detailed, repository-specific threat models, helping to identify and mitigate security vulnerabilities before they can be exploited.

Core Features & Use Cases

  • Automated Threat Enumeration: Identifies trust boundaries, assets, attacker capabilities, and abuse paths within a codebase.
  • Evidence-Grounded Analysis: Anchors all architectural claims and threat assessments to specific evidence found within the repository.
  • Use Case: A development team can use this Skill to generate a threat model for a new microservice, ensuring security is considered from the outset and providing actionable recommendations for developers.

Quick Start

Use the security-threat-model skill to generate a threat model for the current repository.

Frequently Asked Questions about security-threat-model

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I generate a threat model from my source code repository?▼

Threat modeling for AppSec involves identifying trust boundaries, assets, and abuse paths within a codebase. It proactively assesses attacker capabilities and prioritizes realistic vulnerabilities with concrete impacts before deployment.

How does automated code analysis identify security vulnerabilities in a microservice?▼

Automated code analysis identifies vulnerabilities by anchoring architectural claims to explicit evidence within the repository. It enumerates trust boundaries and attacker capabilities to produce an AppSec-grade assessment of concrete impacts and mitigations.

Can I perform risk assessment on my codebase without manual architecture review?▼

Yes, you can perform risk assessment without manual review by using a Skill that automates threat enumeration. It analyzes the repository to identify assets and abuse paths, providing actionable, evidence-grounded mitigation recommendations directly.

What is the best way to ensure threat modeling matches my actual codebase architecture?▼

The best way to ensure threat modeling matches your architecture is to require explicit evidence from the repository. This Skill anchors all architectural claims and threat assessments to specific codebase evidence for accurate AppSec analysis.

Does automated vulnerability management require explicit codebase references to work?▼

Yes, effective automated vulnerability management requires explicit codebase references to ensure accuracy. This Skill focuses on actionable AppSec-grade analysis by anchoring all threat assessments and mitigations to specific evidence found within the repository.

Related Skills

Explore More Software Engineering Skills→
Renzo-TognellaRenzo-Tognella

security-threat-model

Enumerate trust boundaries, assets, and attacker capabilities from repository content.

Community
Advanced
luokai25luokai25

security-threat-model

Create repository-grounded threat models with prioritized abuse paths.

Community
Advanced
summarybotngsummarybotng
2

security-testing

Scan code, dependencies, and configurations for OWASP Top 10 vulnerabilities.

Official
Advanced
soq123soq123

threat_modeling

Identify assets, trust boundaries, and STRIDE threats into threat_model.md.

Community
Advanced