skills.rest
Peterson-Benhame
Peterson-BenhameCOMMUNITY
Explore all skills by this author →
GitHub

security-threat-model

Generates repository-grounded threat models enumerating trust boundaries, assets, abuse paths, and mitigations.

Updated Sep 15, 2026
Search Tags:#threat modeling#security analysis#appsec#codebase audit#risk prioritization#abuse paths#trust boundaries
One-click install
npx skills add https://github.com/Peterson-Benhame/agent-skills --skill security-threat-model-peterson-benhame
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: security-threat-model
Source: https://github.com/Peterson-Benhame/agent-skills/tree/main/packages/skills-catalog/skills/%28security%29/security-threat-model
Command: npx skills add https://github.com/Peterson-Benhame/agent-skills --skill security-threat-model-peterson-benhame

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve? Security teams often produce generic threat model checklists disconnected from the actual codebase. This Skill produces an AppSec-grade threat model anchored to real evidence in your repository, with explicit assumptions, prioritized risks, and concrete mitigations. ## Core Features & Use Cases - Evidence-Anchored Analysis: Maps components, trust boundaries, entry points, and data flows directly to repo paths and symbols, never inventing architecture. - Structured Threat Enumeration: Generates abuse paths tied to attacker goals, with likelihood, impact, and priority ratings plus existing controls and gaps. - Interactive Validation: Pauses to confirm scope assumptions with targeted questions before producing the final Markdown report with a Mermaid diagram. - Use Case: Point it at a microservice repository before a launch review to get a prioritized threat table, focus paths for manual security review, and recommended mitigations tied to specific code locations. ## Quick Start Ask the agent to threat model this repository and write the resulting Markdown report to a file.

Frequently Asked Questions about security-threat-model

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I threat model a codebase with an AI agent?▼

Provide the repository root path and any known context like deployment model and internet exposure. The skill maps components, trust boundaries, and entry points from actual code evidence, then produces a prioritized threat model report in Markdown.

What does a threat model report from this skill include?▼

The report includes an executive summary, system model with a Mermaid diagram, asset and attacker models, entry point tables, abuse paths, a prioritized threat table with mitigations, and focus paths for manual security review.

When should I not use this threat modeling skill?▼

Do not use it for general architecture summaries, code reviews, or security best-practice checklists. It is specifically for AppSec threat modeling of a repository or path, not non-security design work.

Does the threat model rely on generic vulnerability checklists?▼

No. Every architectural claim must be backed by an evidence anchor referencing a repo path, symbol, or config key. Missing information is stated as explicit assumptions with open questions rather than invented details.

Why does the skill ask questions before writing the final report?▼

It validates assumptions about deployment model, internet exposure, authentication, and data sensitivity that materially affect risk ranking. If you cannot answer, it proceeds with explicit assumptions and marks conclusions as conditional.

Related Skills

Explore More Software Engineering Skills→
fatihkanfatihkan
7

sc-recon

Detect codebase architecture and technology stack for security analysis.

Community
Advanced
zangxin75zangxin75

security-reviewer

Conduct security audits and code vulnerability reviews with SAST scans.

Community
Advanced
florianbuetowflorianbuetow
12

pasta-vulns

Scan code and dependencies for vulnerabilities mapped to CWEs.

Community
Advanced
GuicedEEGuicedEE
5

security-compliance

Document security controls and compliance evidence for regulatory frameworks.

Official
Intermediate