skills.rest
surfingalien
surfingalienCOMMUNITY
Explore all skills by this author →
GitHub

security-threat-model

Generates repository-grounded threat models with trust boundaries, abuse paths, and prioritized mitigations.

1|Updated May 6, 2026
Search Tags:#code review#threat modeling#security analysis#stride#appsec#risk prioritization#abuse paths
One-click install
npx skills add https://github.com/surfingalien/FinSurfing --skill security-threat-model-surfingalien
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: security-threat-model
Source: https://github.com/surfingalien/FinSurfing/tree/main/.claude/skills/security-threat-model
Command: npx skills add https://github.com/surfingalien/FinSurfing --skill security-threat-model-surfingalien

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve? Security teams often produce generic checklist-style threat models that lack concrete attack vectors tied to actual code. This Skill produces AppSec-grade threat models anchored to evidence in a specific repository, with explicit assumptions, realistic attacker profiles, and prioritized risks. ## Core Features & Use Cases - Repo-Grounded Analysis: Enumerates trust boundaries, assets, entry points, and attacker capabilities with evidence anchors to actual code paths. - Structured Methodology: Covers STRIDE and PASTA approaches plus AI/ML, supply chain, and cloud-native threat categories. - Prioritized Output: Produces a Markdown threat model with likelihood/impact reasoning, a Mermaid diagram, mitigation recommendations, and focus paths for manual review. - Use Case: Point the Skill at a web service repository before a major release to get a threat model identifying pre-auth RCE risks, auth bypass paths, and concrete mitigations tied to specific files. ## Quick Start Ask the assistant to threat model this repository and produce a prioritized Markdown report with abuse paths and mitigations.

Frequently Asked Questions about security-threat-model

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I create a threat model for a codebase?▼

Provide the repository path and any known context like deployment model and internet exposure. The Skill maps components, trust boundaries, and entry points from code evidence, then enumerates abuse paths with likelihood and impact ratings before writing a Markdown report.

What threat modeling methodologies does this support?▼

It covers STRIDE and PASTA methodologies plus attacker-goal-based analysis. It also includes guidance for AI/ML systems, supply chain threats, and cloud-native deployment risks like container escape and SSRF to metadata services.

Does the threat model include mitigations and prioritization?▼

Yes. Each threat gets qualitative likelihood and impact ratings with justifications, an overall priority from critical to low, existing controls with evidence, and concrete recommended mitigations tied to specific code locations.

Can it threat model AI and LLM-based systems?▼

Yes. It includes dedicated AI threat categories such as prompt injection, indirect prompt injection via external data, training data poisoning, model exfiltration, embedding inversion, and RAG manipulation, plus a checklist for LLM deployments.

What output format does the threat model use?▼

It writes a Markdown file named after the repository containing an executive summary, system model with a Mermaid diagram, asset and attacker model sections, a threat table with stable IDs, abuse paths, and focus paths for manual security review.

Related Skills

Explore More Software Engineering Skills→
balic-AI-ML-R-D-Resourcesbalic-AI-ML-R-D-Resources

security-ask-questions-if-underspecified

Identify and prompt for clarifications when security requirements or threat models are underspecified.

Official
Intermediate
dreadnodedreadnode
11

attack-path-triage

Prioritize BloodHound Enterprise attack-path findings by severity and blast radius.

Official
Intermediate
florianbuetowflorianbuetow
12

pasta-vulns

Scan code and dependencies for vulnerabilities mapped to CWEs.

Community
Advanced
xijunwwxijunww
1

recon

Automate penetration testing reconnaissance to discover assets and attack surfaces.

Community
Advanced