What problem does it solve? Security decisions are often made by copying checklists, buying controls nobody justified, or trusting scanners that were never run. This Skill forces every security control to be derived from a named asset, a reachable actor, and a trust boundary, so each finding names an impact, the cheapest control that closes it, and that control's cost. ## Core Features & Use Cases - Boundary-first threat interview (greenfield): Walks 15 gates across identity and access, data protection, secrets, and supply chain, closing gates explicitly with reopening signals rather than padding the report. - Security review of existing systems (refactoring): Inspects authentication middleware, authorization placement, tenant isolation, secret handling, and CI release paths, then recommends exactly one highest-leverage move. - Evidence binding instead of scanning: Never enumerates CVEs, hunts secrets by eye, or simulates taint analysis — it binds each claim to a scanner the repository already runs (gitleaks, semgrep, osv-scanner) and says plainly when no binding exists. - Agent permission overlay: When the system contains an LLM agent, six additional gates cover tool permission scoping, blast radius, human approval, prompt injection, credential scope, and audit trails. - Use Case: Ask "is this design safe to expose to the internet?" and receive a threat model with assets, actors, boundaries, findings with costs, closed gates, and one primary recommendation — persisted as a decision file. ## Quick Start Ask the agent to threat model your service or review the security of your architecture, for example by saying "threat model this service before we expose it to the internet".
