skills.rest
metric-space-ai
metric-space-aiOFFICIAL
Explore all skills by this author →
WebsiteGitHub

security-threat-model

Identify risks, assets, and entry points for a repository with evidence anchors.

2|Updated Apr 12, 2026
Search Tags:#threat-modeling#appsec#mermaid-diagram#trust-boundaries#risk-prioritization#repository-evidence
One-click install
npx skills add https://github.com/metric-space-ai/ctox --skill security-threat-model-metric-space-ai
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: security-threat-model
Source: https://github.com/metric-space-ai/ctox/tree/main/skills/packs/security/security-threat-model
Command: npx skills add https://github.com/metric-space-ai/ctox --skill security-threat-model-metric-space-ai

SYSTEM DOCUMENTATION & REQUIREMENTS

## What problem does it solve? Repository-grounded threat modeling that anchors architectural claims to concrete repo evidence, enumerating trust boundaries, assets, attacker capabilities, abuse paths, and mitigations to produce a concise, actionable threat model.

## Core Features & Use Cases

  • Repository-grounded threat modeling anchored to concrete code evidence and explicit repo paths
  • Systematic identification of trust boundaries, assets, and entry points with evidence anchors
  • Output aligned with the reference prompt template, including a compact Mermaid diagram and a structured report

### Quick Start Trigger a repository threat model by providing a codebase path and asking the assistant to generate an evidence-based AppSec threat model.

Frequently Asked Questions about security-threat-model

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I generate an AppSec threat model from a repository?▼

AppSec threat modeling for a repository is generated by analyzing the codebase path to identify runtime components, data flows, trust boundaries, and potential abuse paths. The output is a prioritized threat model with explicit evidence anchors and a concise Mermaid diagram.

What is evidence-based threat modeling and how does it work?▼

Evidence-based threat modeling anchors architectural risk claims to concrete repository evidence and explicit file paths. It systematically enumerates trust boundaries, assets, attacker capabilities, and abuse paths to produce an actionable threat model report.

How do I identify trust boundaries and entry points in my codebase?▼

Identifying trust boundaries and entry points involves analyzing repository data flows and runtime components to separate runtime behavior from CI and dev tooling. The Skill maps these entry points and generates a structured report with evidence anchors.

Can I use this threat modeling approach for an existing codebase?▼

Yes, this approach is designed for existing repositories. By providing a codebase path, the tool evaluates runtime components and data flows to produce a threat model that prioritizes risks based on concrete evidence found in the code.

Does the threat model output include a visual diagram?▼

Yes, the threat model output includes a compact Mermaid diagram. This diagram visualizes the identified runtime components, data flows, and trust boundaries alongside the structured text report.

What is the best way to prioritize security risks in a repository?▼

The best way to prioritize security risks is by anchoring them to concrete repository evidence. This approach separates runtime behavior from dev tooling and maps abuse paths to explicit code anchors for a prioritized, actionable threat model.

Related Skills

Explore More Software Engineering Skills→
jeffpeckyjeffpecky

security-threat-model

Generate a Markdown threat model from a codebase or project path.

Community
Advanced
ishiyanishiyan

mermaid-creator

Create and convert Mermaid diagrams from syntax to SVG.

Community
Advanced
ysyecustysyecust
40

springboot-verification

Verify Spring Boot projects with builds, static analysis, tests, and security scans.

Community
Advanced
koki3141koki3141
2

security-threat-model

Generate a repository-grounded threat model with trust boundaries, assets, and mitigations.

Community
Advanced