security-threat-model

Name: security-threat-model
Availability: InStock
Author: jeffpecky

Generate a Markdown threat model from a codebase or project path.

Updated May 30, 2026

Search Tags:#code security #appsec #repository analysis #security threat modeling #threat enumeration

Ready to run

npx skills add https://github.com/jeffpecky/vortex --skill security-threat-model-jeffpecky

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: security-threat-model
Source: https://github.com/jeffpecky/vortex/tree/main/src/skills/bundled/security-threat-model
Command: npx skills add https://github.com/jeffpecky/vortex --skill security-threat-model-jeffpecky

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) components.

What problem does it solve?

This Skill automates the creation of detailed threat models for codebases, providing a precise and evidence-backed security analysis to identify potential vulnerabilities and their impact.

Core Features & Use Cases

Repository-Grounded Threat Modeling: Generates specific threat models based on the repository content and architecture.
Evidence-Backed Analysis: Ensures every architectural claim is backed by evidence within the repository.
Use Case: For a codebase with sensitive data, use this Skill to automatically identify trust boundaries, assets, attacker capabilities, abuse paths, and mitigations, then generate a concise Markdown threat model.

Quick Start

Run the security-threat-model skill on the project path to generate a threat model.

Frequently Asked Questions about security-threat-model

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I automate threat modeling for my repository?▼

Automate threat modeling by running the skill on your project path, which analyzes the repository to identify trust boundaries, assets, attacker capabilities, abuse paths, and mitigations, then outputs a Markdown threat model document.

What is evidence-backed security threat modeling for codebases?▼

Evidence-backed security threat modeling grounds every architectural claim and identified vulnerability in your actual repository content, ensuring precise analysis of trust boundaries and abuse paths rather than relying on generic assumptions.

Does security threat modeling work with any codebase structure?▼

Security threat modeling works with any codebase structure as long as you provide access to the repository and its source code, allowing the analysis to map specific trust boundaries and assets accurately.

How do I generate a threat model document from source code?▼

Generate a threat model document by pointing the skill at your project path, which processes the source code to enumerate assets, attacker capabilities, and mitigations, producing a concise Markdown file.

What's the best way to identify trust boundaries in a codebase?▼

The best way to identify trust boundaries is to use repository-grounded threat modeling, which automatically maps architectural trust zones and assets based on actual source code evidence.

Why does my threat model lack specific abuse paths for my application?▼

Your threat model may lack specific abuse paths if the analysis is not repository-grounded, whereas evidence-backed repository analysis automatically enumerates precise attacker capabilities and abuse paths from your source code.