security-threat-model

Name: security-threat-model
Availability: InStock
Author: Haohao

Generate repository-grounded AppSec threat models with trust boundaries, assets, and abuse paths.

779|80|Updated Jun 20, 2025

Search Tags:#threat modeling #appsec #mitigations #risk prioritization #abuse paths #trust boundaries #codebase security

Ready to run

npx skills add https://github.com/Haohao-end/openagent --skill security-threat-model-haohao-end

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: security-threat-model
Source: https://github.com/Haohao-end/openagent/tree/main/api/internal/core/skills/catalog/security-threat-model
Command: npx skills add https://github.com/Haohao-end/openagent --skill security-threat-model-haohao-end

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

It helps teams turn a specific codebase into an actionable AppSec threat model by grounding threats, abuse paths, and mitigations in concrete repository evidence rather than generic checklists.

Core Features & Use Cases

Repository-grounded scope: Extracts primary components, data stores, integrations, and entrypoints from the repo and clearly separates runtime from CI/build/dev/test items.
Trust boundaries & assets mapping: Enumerates trust boundaries, high-value assets, and realistic entry surfaces (e.g., endpoints, uploads, parsers, job triggers) tied to specific architecture evidence.
Abuse-path threat enumeration: Produces a prioritized set of threats expressed as attacker goals and abuse paths, including qualitative likelihood/impact and mitigation recommendations.

Quick Start

Ask the skill to threat model the openagent repository and produce a prioritized, evidence-anchored Markdown threat model with concrete abuse paths and mitigations.

Frequently Asked Questions about security-threat-model

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I generate an AppSec threat model from a codebase?▼

To generate an AppSec threat model from a codebase, you can use a tool that extracts repository components, data stores, and entrypoints to enumerate trust boundaries and prioritize abuse paths. This produces a concise Markdown report grounded in concrete code evidence.

What is threat modeling in application security?▼

Threat modeling in application security is the process of enumerating trust boundaries, high-value assets, and attacker capabilities to identify abuse paths. It prioritizes threats by likelihood and impact to recommend concrete mitigations for codebase security.

How do I map trust boundaries and assets for a security design review?▼

You map trust boundaries and assets by analyzing a codebase to extract high-value data stores, integrations, and realistic entry surfaces like endpoints and parsers. This ensures the security design preparation is tied to specific architecture evidence.

Can I prioritize security risks using abuse paths instead of generic checklists?▼

Yes, you can prioritize security risks by enumerating abuse paths and attacker goals instead of using generic checklists. This approach keeps assumptions explicit and grounds the risk prioritization in concrete repository evidence.

Does threat modeling a repository require separating runtime from CI or build items?▼

Yes, threat modeling a repository requires separating runtime components from CI, build, and dev test items. This scoping ensures that abuse paths and mitigations focus on realistic entry surfaces tied to specific architecture evidence.