skills.rest
air-gapped
air-gappedOFFICIAL
Explore all skills by this author →
GitHub

threat-model

Identify codebase threats via the four-question framework and output THREAT_MODEL.md.

5|1|Updated Apr 19, 2026
Search Tags:#security#vulnerability#STRIDE#risk-assessment#code-review#threat-model#threat-analysis
One-click install
npx skills add https://github.com/air-gapped/skills --skill threat-model-air-gapped
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: threat-model
Source: https://github.com/air-gapped/skills/tree/main/.claude/skills/threat-model
Command: npx skills add https://github.com/air-gapped/skills --skill threat-model-air-gapped

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) components.

What problem does it solve?

Builds a formal threat model for a target codebase using a structured framework and outputs a THREAT_MODEL.md that enables security reviews, prioritization, and mitigation planning.

Core Features & Use Cases

  • Supports three modes: interview (owner-guided threat discovery), bootstrap (static analysis from code + past vulnerabilities), and bootstrap-then-interview (draft refined with owner input).
  • Produces THREAT_MODEL.md conforming to a shared schema including system context, assets, entry points & trust boundaries, threats, open questions, provenance, and recommended mitigations.
  • Enables risk scoring and STRIDE-based gap-fill to surface and prioritize threats across diverse stacks and deployment environments.

Quick Start

Run /threat-model bootstrap <target-dir> to generate a draft THREAT_MODEL.md from the codebase and vulnerability history.

Frequently Asked Questions about threat-model

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I create a threat model for an existing codebase?▼

You can generate a threat model by running a static analysis on the target directory and its vulnerability history to produce a structured THREAT_MODEL.md documenting system context, assets, and threats.

What is the STRIDE methodology for threat analysis?▼

STRIDE is a framework used to categorize and identify security threats during threat modeling, enabling structured gap-filling and risk scoring to prioritize vulnerabilities across diverse stacks and deployment environments.

Can I perform a security risk assessment without executing the target code?▼

Yes, threat modeling requires static analysis only by reading code, commit history, and public advisories without executing the target system, ensuring safe risk assessment and vulnerability discovery.

Does threat modeling work for inherited systems across different programming languages?▼

Threat modeling applies to both new and inherited systems across multiple languages, mapping threats and proposing mitigations using a structured four-question framework and shared schema.

What is the best way to involve system owners in threat discovery?▼

The interview mode guides system owners through threat discovery, or you can use bootstrap-then-interview to refine a statically generated draft threat model with direct owner input.

What limitations exist with static analysis during threat modeling?▼

Threat modeling relies entirely on static analysis of code, history, and public advisories without dynamic execution, meaning runtime vulnerabilities or environment-specific exploits may not be fully captured.

Related Skills

Explore More Software Engineering Skills→
philo-grovesphilo-groves
12

maxtac-source-patch-history-loop

Correlate source commit history with CVEs, advisories, and hardening diffs.

Community
Advanced
tense-itense-i
1

threat-mitigation-mapping

Map security threats to corresponding controls using Python dataclasses and enums.

Community
Advanced
usermaumusermaum

security-pipeline

Detect security vulnerabilities in code changes using CWE and STRIDE methodologies.

Community
Advanced
Division6066Division6066

stride-analysis-patterns

Identify STRIDE threats and patterns for structured threat modeling sessions.

Community
Advanced