security-threat-model

Name: security-threat-model
Availability: InStock
Author: OpenAI

Generate repository-grounded Markdown threat models with trust boundaries and abuse paths.

24.7k|1.7k|Updated Nov 25, 2025

Search Tags:#code review #security #threat modeling #appsec #vulnerability analysis #abuse paths

Ready to run

npx skills add https://github.com/openai/skills --skill security-threat-model-openai-2

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: security-threat-model
Source: https://github.com/openai/skills/tree/main/skills/.curated/security-threat-model
Command: npx skills add https://github.com/openai/skills --skill security-threat-model-openai-2

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) components.

What problem does it solve?

This Skill automates the creation of detailed, repository-specific threat models, identifying potential security vulnerabilities and abuse paths within a codebase.

Core Features & Use Cases

Repository-Grounded Analysis: Generates threat models directly from codebase content, not generic checklists.
Abuse Path Enumeration: Identifies and prioritizes realistic attack scenarios and their impacts.
Mitigation Recommendations: Suggests concrete security controls and implementation hints.
Use Case: A security engineer can use this Skill to quickly generate a threat model for a new microservice, highlighting critical trust boundaries, potential data exfiltration paths, and recommended input validation strategies.

Quick Start

Use the security-threat-model skill to create a threat model for the current repository.

Frequently Asked Questions about security-threat-model

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I generate a threat model from my codebase?▼

To generate a threat model, trigger the skill by explicitly asking it to threat model a codebase or path, and it will output a concise Markdown document enumerating trust boundaries, assets, and abuse paths.

What is repository-grounded threat modeling and how does it differ from generic checklists?▼

Repository-grounded threat modeling analyzes actual codebase content to identify specific vulnerabilities and abuse paths, producing concrete mitigations rather than relying on generic security checklists or architecture summaries.

Can I use this AppSec tool to enumerate abuse paths for a microservice?▼

Yes, you can use this AppSec tool to enumerate abuse paths for a microservice by explicitly requesting threat modeling for the specific path, which surfaces attacker capabilities and recommended input validation strategies.

How do I get vulnerability analysis and mitigation recommendations for a repository?▼

Vulnerability analysis and mitigation recommendations are produced by explicitly requesting AppSec threat modeling on the repository, yielding a Markdown report with concrete security controls and implementation hints.

When should I not use this approach for security code review?▼

You should not use this approach for general architecture summaries, non-security design work, or standard code review, as it triggers exclusively for AppSec threat modeling and abuse path enumeration.

Does the security-threat-model skill require dependencies to analyze trust boundaries?▼

No dependencies are required to analyze trust boundaries, as the skill operates directly on the repository content you provide to map assets and attacker capabilities into a Markdown threat model.