skills.rest
danielmiessler
danielmiesslerCOMMUNITY
Explore all skills by this author →
Website𝕏@danielmiesslerGitHub

ThreatModel

Maps sensitive data across assets, simulates compromise scenarios, and maintains a scored risk register via CLI.

18.8k|2.4k|Updated Sep 8, 2025
Search Tags:#CLI#Security#blast radius#Threat Modeling#risk register#data classification#compromise scenario
One-click install
npx skills add https://github.com/danielmiessler/LifeOS --skill threatmodel
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: ThreatModel
Source: https://github.com/danielmiessler/LifeOS/tree/main/LifeOS/install/skills/ThreatModel
Command: npx skills add https://github.com/danielmiessler/LifeOS --skill threatmodel

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) components.

What problem does it solve?

Security risks in a personal or team estate are usually undocumented, unscored, and forgotten. This Skill gives you a structured way to find where sensitive data lives, reason through what happens if an asset gets compromised, and keep the resulting risks in a persistent register that actually gets reviewed.

Core Features & Use Cases

  • Sensitive Data Mapping: Census your asset graph and classify which assets hold credentials, PII, financial, or customer data, with unclassified assets listed explicitly rather than assumed safe.
  • Compromise Scenarios: Answer "what if X got hacked" with blast-radius analysis from the Atlas asset graph, exposure of reachable credentials and data stores, detection signals, and response plans.
  • Deterministic Risk Register: A Bun/TypeScript CLI scores risks as likelihood × impact (Low through Critical), tracks owners, mitigations, and review dates, and exports a generated Markdown view.
  • Use Case: Ask "what happens if our analytics worker gets popped?" and receive a scenario doc with blast radius, exposed data classes, detection gaps, and scored risks landed in the register for review.

Quick Start

Ask the assistant to threat model your estate or run a compromise scenario on a specific asset, for example: "What happens if our analytics worker gets hacked?"

Frequently Asked Questions about ThreatModel

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I create a threat model for my infrastructure?▼

Use the ThreatModelTarget workflow by naming a target such as an app, service, or the whole estate. It maps trust boundaries, enumerates threats with STRIDE, evaluates existing controls, and lands prioritized risks in the register with likelihood and impact scores.

How do I find which assets hold sensitive data?▼

Run the SensitiveDataMap workflow, which censuses the asset graph and tags each data-bearing asset with classes like credentials, pii, financial, or customer-data. Assets that cannot be classified are listed explicitly as unclassified rather than assumed clean.

How is risk scoring calculated in the risk register?▼

Risk score equals likelihood (1-5) multiplied by impact (1-5), producing Low (1-4), Medium (5-9), High (10-14), or Critical (15-25). Impact is anchored to exposed data classes and blast radius, while likelihood reflects exposure such as public URLs and credential hygiene.

Does this skill work without the Atlas asset graph?▼

Yes, but with reduced coverage. Without Atlas, workflows fall back to user-enumerated assets plus repo and config inspection, and the output explicitly states that coverage is user-enumerated rather than graph-complete.

Can this skill run penetration tests or exploit vulnerabilities?▼

No. The skill is strictly read-only and defensive; it models compromises and plans responses but never executes exploits, scans, or destructive actions. Offensive testing requires a separate offensive-security skill.

Where does the risk register store its data?▼

The register stores data in a private directory at ~/.claude/LIFEOS/USER/SECURITY/THREATMODEL/, overridable via THREATMODEL_DATA_DIR. The CLI structurally refuses any data directory inside a skills path, and the JSON store is the system of record while the Markdown file is a generated view.

Related Skills

Explore More Software Engineering Skills→
DrinkBooozDrinkBoooz

investor-materials

Create investor-facing pitch decks, memos, and financial models aligned to a single source of truth.

Community
Advanced
withmartian-sandbox-darksidewithmartian-sandbox-darkside

risk-management

Aggregate project risk registers and produce scored portfolio risk assessments with RAID log updates.

Official
Advanced
EntroVyxEntroVyx
3

exploit-chaining-engine

Analyze and prioritize security findings for exploit chain potential.

Community
Advanced
starlink-awakenstarlink-awaken

WorldThreatModelHarness

Evaluate ideas against 11 time horizons from 6 months to 50 years.

Community
Advanced