security-threat-model

Generate repository-grounded threat models with trust boundaries, assets, and mitigations.

Updated Mar 14, 2026
One-click install
npx skills add https://github.com/thanhquan3010/hospital-management-system-v3 --skill security-threat-model-thanhquan3010
Or copy as Structured Prompt for Agent
Please help me install this Agent Skill.
Skill: security-threat-model
Source: https://github.com/thanhquan3010/hospital-management-system-v3/tree/main/.agents/skills/security-threat-model
Command: npx skills add https://github.com/thanhquan3010/hospital-management-system-v3 --skill security-threat-model-thanhquan3010

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) components.

What problem does it solve?

This Skill automates the process of generating a security threat model for a codebase, identifying potential vulnerabilities, and suggesting mitigations to improve application security.

Core Features & Use Cases

  • Repo-Grounded Threat Modeling: Creates threat models specifically tailored to the codebase's architecture and functionality, not generic checklists.
  • Abuse Path Enumeration: Identifies and prioritizes potential attack paths and abuse cases.
  • Mitigation Recommendations: Suggests concrete security controls and fixes based on identified risks.
  • Use Case: A security engineer can use this Skill to quickly assess the security posture of a new microservice by providing the repository path, receiving a detailed threat model, and getting actionable recommendations for hardening.

Quick Start

Use the security-threat-model skill to generate a threat model for the repository located at '/path/to/your/codebase'.

Frequently Asked Questions about security-threat-model

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I generate a threat model for my codebase?

A threat model identifies potential vulnerabilities by mapping trust boundaries, assets, and abuse paths within your application architecture. It moves beyond generic checklists by grounding the security risk assessment directly in your actual codebase's functionality.

How do I identify abuse paths and attacker capabilities in my application?

You can identify abuse paths by requesting an abuse path enumeration, which maps attacker capabilities against your codebase's trust boundaries. This process prioritizes potential attack vectors and suggests concrete mitigation recommendations to harden application security.

Can I use this for general code review and architecture summaries?

No, this is specifically designed for AppSec design work and threat modeling, not general architecture summaries or code reviews. It focuses strictly on generating repository-grounded security risk assessments and enumerating potential attack paths.

What is the best way to assess application security risks for a new microservice?

The best way to assess application security risks is to generate a tailored threat model by providing the microservice's repository path. This enumerates trust boundaries and attacker capabilities to deliver actionable mitigation recommendations for hardening.

Do I need any specific dependencies to perform repository-grounded threat modeling?

No specific dependencies are required to perform repository-grounded threat modeling. You simply need to provide the repository path to start automating the identification of vulnerabilities and the generation of security mitigations.