security-threat-model

Identify and model repository security threats with evidence-grounded findings.

59|14|Updated Mar 10, 2026

Search Tags:#threat modeling #AppSec #security assessment #risk prioritization #repo evidence

Ready to run

npx skills add https://github.com/guilhermemarketing/esc-skills --skill security-threat-model-guilhermemarketing

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: security-threat-model
Source: https://github.com/guilhermemarketing/esc-skills/tree/main/skills/security-threat-model
Command: npx skills add https://github.com/guilhermemarketing/esc-skills --skill security-threat-model-guilhermemarketing

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Threat modeling for code repositories anchored to concrete evidence helps security engineers identify and prioritize risks specific to a project, reducing blind spots created by generic checklists.

Core Features & Use Cases

Repository-grounded analysis: anchors every architectural claim to evidence in the repo (paths, files, or artifacts).
Runtime vs CI/tooling separation: clearly distinguishes production behavior from build and development tooling.
Actionable threat reports: prioritizes threats with explicit likelihood, impact, and concrete mitigations tied to components and boundaries.

Quick Start

Collect repository evidence and produce a structured threat model grounded in the repository.

Frequently Asked Questions about security-threat-model

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I create a threat model anchored to concrete repository evidence?▼

Repo-grounded threat modeling anchors every architectural claim to specific paths, files, or artifacts in your codebase. It identifies entry points, trust boundaries, assets, and data flows to reduce blind spots from generic checklists.

How does threat modeling separate runtime components from CI and dev tooling?▼

Threat modeling for codebases distinguishes production behavior from build and development tooling. This separation ensures security assessments accurately map potential adversarial paths across both runtime components and CI environments.

Can I prioritize security threats using likelihood and impact justifications?▼

Security threat prioritization evaluates each finding with explicit likelihood and impact justifications. This approach provides actionable threat reports with concrete mitigations tied to specific components and trust boundaries.

What is the best way to assess AppSec risks in a code repository?▼

The best way to assess AppSec risks is through repository-grounded analysis that maps potential adversarial paths. This method covers runtime components and CI tooling while providing prioritized threats with explicit mitigations.

Do I need a threat model that covers entry points and trust boundaries for my codebase?▼

You need a threat model covering entry points and trust boundaries to identify project-specific risks. Grounding the analysis in repository evidence ensures findings accurately reflect your actual data flows and architectural assumptions.