security-threat-model

Generate repository-grounded threat models by analyzing codebase structure and abuse paths.

Updated Aug 23, 2026

Search Tags:#code analysis #security #threat modeling #risk assessment #appsec #abuse paths

Ready to run

npx skills add https://github.com/ThePhoenixAgency/Phoenix-Agents-Marketplace --skill security-threat-model-thephoenixagency

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: security-threat-model
Source: https://github.com/ThePhoenixAgency/Phoenix-Agents-Marketplace/tree/main/plugins/dev-pipeline/skills/security-threat-model
Command: npx skills add https://github.com/ThePhoenixAgency/Phoenix-Agents-Marketplace --skill security-threat-model-thephoenixagency

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) components.

What problem does it solve?

This Skill automates the generation of repository-grounded threat models, identifying critical security risks, abuse paths, and actionable mitigations to proactively secure your codebase.

Core Features & Use Cases

Repository-Grounded Threat Modeling: Generates detailed threat models based on the actual codebase, not generic checklists.
Abuse Path Enumeration: Identifies realistic attacker goals and multi-step abuse paths.
Prioritized Risk Assessment: Assesses threats based on likelihood and impact, providing clear prioritization.
Actionable Mitigations: Recommends specific security controls and focus areas for manual review.
Use Case: A security engineer needs to assess the risk posture of a new microservice. This Skill analyzes the service's codebase, identifies potential vulnerabilities like data exfiltration or authentication bypass, and provides a prioritized list of security recommendations.

Quick Start

Use the security-threat-model skill to generate a threat model for the current repository, focusing on the 'plugins/dev-pipeline/skills/security-threat-model' directory.

Frequently Asked Questions about security-threat-model

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I generate a threat model from my codebase?▼

Threat modeling identifies critical security risks and abuse paths by analyzing your codebase structure, trust boundaries, and attacker capabilities. It requires explicit context on intended usage, deployment, and data sensitivity to calibrate risk assessment and provide actionable security mitigations.

How do I enumerate abuse paths for risk assessment in AppSec?▼

Abuse path enumeration identifies realistic attacker goals and multi-step exploitation routes within the codebase. The threat model prioritizes these abuse paths based on likelihood and impact to provide clear, actionable security mitigations and manual review focus areas.

Does automated threat modeling work for microservice security analysis?▼

Yes, repository-grounded threat modeling works for microservice security analysis by evaluating the service's actual codebase. It identifies vulnerabilities like data exfiltration or authentication bypass and outputs a prioritized list of actionable security controls and review focus areas.

What context do I need to provide for an accurate codebase security analysis?▼

For accurate codebase security analysis, you must provide explicit context on intended usage, deployment environment, and data sensitivity. This context calibrates the risk assessment to ensure the generated threat model delivers actionable security insights tailored to your specific application.

What is the best way to prioritize security mitigations for identified threats?▼

The best way to prioritize security mitigations is to assess identified abuse paths based on their likelihood and impact. This risk assessment approach provides clear prioritization and recommends specific security controls and focus areas for manual codebase review.