security-threat-model

To generate a threat model for a repository, this Skill analyzes the codebase content to enumerate trust boundaries, assets, attacker capabilities, and abuse paths. It produces AppSec-grade threat models grounded directly in your repository's specific code structure.

Repository-grounded threat modeling focuses on identifying security vulnerabilities and realistic attacker abuse paths within a specific codebase. Unlike general code review or architecture summaries, it strictly enumerates trust boundaries, assets, and mitigations based on the actual repository content.

Yes, you can use this Skill to assess risk and enumerate abuse paths for a new microservice. It identifies attacker capabilities and concrete impacts, suggesting specific security controls and focus areas for manual review before deployment.

You need AppSec threat modeling when preparing to release a service or feature and must proactively identify security risks. It helps map the attack surface by detailing trust boundaries, assets, and abuse paths directly from your source code.

Yes, the threat modeling approach provides specific mitigation recommendations. After identifying potential security vulnerabilities and prioritizing realistic attacker goals, it suggests targeted security controls and highlights areas requiring manual review.

Automated threat modeling is limited to generating repository-specific threat models, abuse paths, and mitigations. It is explicitly triggered for AppSec threat modeling and avoids providing general architecture summaries or conducting standard code reviews.