skills.rest
viniciuscs84
viniciuscs84COMMUNITY
Explore all skills by this author →
Website𝕏@viniciuscs84GitHub

security-threat-model

Generates repository-grounded threat models with trust boundaries, abuse paths, and prioritized mitigations.

Updated May 22, 2026
Search Tags:#code review#threat modeling#security analysis#appsec#risk prioritization#abuse paths#trust boundaries
One-click install
npx skills add https://github.com/viniciuscs84/sdd-toolkit --skill security-threat-model-viniciuscs84
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: security-threat-model
Source: https://github.com/viniciuscs84/sdd-toolkit/tree/main/skills/security-threat-model
Command: npx skills add https://github.com/viniciuscs84/sdd-toolkit --skill security-threat-model-viniciuscs84

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve? Security reviews often produce generic checklists disconnected from the actual codebase. This Skill produces an AppSec-grade threat model anchored to real repository evidence, with explicit assumptions, prioritized abuse paths, and concrete mitigations. ## Core Features & Use Cases - Evidence-Anchored Analysis: Enumerates trust boundaries, assets, entry points, and attacker capabilities, with every architectural claim tied to a repo path or symbol. - Prioritized Threat Enumeration: Builds multi-step abuse paths with qualitative likelihood and impact reasoning, producing a stable threat table (TM-001, TM-002, ...) with critical/high/medium/low priorities. - Assumption Validation Workflow: Pauses to confirm deployment model, exposure, and data sensitivity with the user before finalizing the report. - Use Case: Point the Skill at a web service repository before a release; it maps endpoints and auth flows, identifies the top abuse paths such as pre-auth RCE or cross-tenant access, and writes a Markdown threat model with a Mermaid diagram and focus paths for manual review. ## Quick Start Ask the AI to threat model this repository and write the resulting Markdown report to a file named after the repo.

Frequently Asked Questions about security-threat-model

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I create a threat model for a codebase?▼

Provide the repository path and any known context such as deployment model and internet exposure. The Skill maps components, trust boundaries, and entry points from repo evidence, then enumerates prioritized abuse paths and writes a Markdown threat model report.

What does a repo-grounded threat model include?▼

It includes a system model with a Mermaid diagram, an asset table with security objectives, an attacker model with capabilities and non-capabilities, a threat table with likelihood and impact ratings, mitigations, and focus paths for manual security review.

When should I not use threat modeling on a repository?▼

Do not trigger it for general architecture summaries, code reviews, or non-security design work. It is intended only when you explicitly need threat enumeration, abuse path analysis, or AppSec threat modeling of a codebase or path.

How are threats prioritized in the threat model?▼

Each threat receives qualitative likelihood and impact ratings (low/medium/high) with short justifications, combined into a critical/high/medium/low priority adjusted for existing controls. The Skill states which assumptions most influence the ranking.

Does the threat model handle missing deployment context?▼

Yes. Before finalizing, the Skill summarizes key assumptions and asks 1-3 targeted questions about environment, exposure, auth, and data sensitivity. If unanswered, it proceeds with explicit assumptions and marks conditional conclusions.

Related Skills

Explore More Software Engineering Skills→
fatihkanfatihkan
7

sc-recon

Detect codebase architecture and technology stack for security analysis.

Community
Advanced
guneysolguneysol

security-threat-model

Generates repository-grounded threat models with trust boundaries, abuse paths, and prioritized mitigations.

Community
Advanced
AutomatedMarketerAutomatedMarketer

security-reviewer

Scan application code, configuration, and dependencies for security vulnerabilities.

Community
Advanced
doctordukedoctorduke

security-scanning-suite

Automate SAST, DAST, dependency, secret, and container security scans.

Community
Advanced