model-update
From the author
Refresh a published security model from the project's decision history (tracker dispositions, advisories, canned responses). Proposes new known-non-finding entries (§1.15) and a model-gap list, regression-checked against past valid reports. Read-only on the tracker.
Install
npx skills add apache/magpie --skill model-update -a claude-code
Installs to .claude/skills/model-update/ · Each command fetches the skill straight from GitHub with the open skills CLI.
Byte-identical to the scanned commit, with the repository’s licence and a SOURCE.txt.
Want your agent to suggest skills while you type? See how to use skills from your IDE.
Safety checks on SKILL.md
- Contains hidden text (invisible characters, long comments or encoded blobs)Medium
Why 75
aiqbench computes the trust score from public signals. It is not a security audit, so read a skill before you install it.
Similar skills
Closest to this one by what they do and when they are used.
- security-modelgetsentry/skillsDefine, review, or update SECURITY_MODEL.md files that tell security review tools a repository's threat model, trust boundaries, invariants, reportable finding classes, and exclusions. Use when asked to "write a security model", "threat model this repo for scanners", "define security review scope", "what counts as a vulnerability here", "update SECURITY_MODEL.md", "why did the scanner flag or miss this", or to check whether existing security guidance still matches the code. Not for running a security review or editing the SECURITY.md disclosure policy.OfficialSecurity★ 1.1K
- security-threat-modelopenai/skillsRepository-grounded threat modeling that enumerates trust boundaries, assets, attacker capabilities, abuse paths, and mitigations, and writes a concise Markdown threat model. Trigger only when the user explicitly asks to threat model a codebase or path, enumerate threats/abuse paths, or perform AppSec threat modeling. Do not trigger for general architecture summaries, code review, or non-security design work.OfficialSecurity★ 28.3K
- threat-model-backtestalpha-omega-security/threat-modelBacktest phase 3.6 of threat-model production against historical findings before sign-off. USE WHEN a draft model must prove it can uniquely route real reports. Builds a stratified producer-side corpus across components and contract dimensions, clusters large corpora by sink and attack class, and routes each item blind to one §1.17 disposition. Reports MODEL-GAP, contradictory or ambiguous routing, coverage, qualified §1.15 candidates, and §1.18 questions. The corpus is not published. DO NOT USE FOR: drafting, sidecar generation, or triaging one new finding.Security★ 60
- threat-model-triagealpha-omega-security/threat-modelTriage one inbound vulnerability report, scanner hit, fuzzer artifact, or AI finding against a finished threat model. USE WHEN asked whether a finding is valid or in scope. Applies the §1.1 routing algorithm and §1.17 precedence to assign exactly one closed disposition with section and provenance citations; inferred claims may escalate but never close, and assumptions close only what the model's declared triage policy permits. A finding with no supported route is MODEL-GAP and triggers §1.16. DO NOT USE FOR: producing a model from scratch or backtesting a corpus.Security★ 60
- threat-modelingcbrock84/headcountIdentifies what could go wrong in a system before it is built or changed — the assets worth attacking, the entry points, the trust boundaries, and the controls that actually address the realistic threats. Use this when designing a feature or system, when a change touches authentication, data handling, payments, or external input, before a security review, or when deciding which security work is worth doing at all.Security★ 2.1K
- securitynotque/vexjoy-agentSecurity: review git changes for vulnerabilities, threat-model a system's attack surface, audit supply-chain risks.Security★ 443
Ratings & reviews
—
no reviews
Tried this skill? Rate it to help others. Sign in
Discussion
Join the discussion. Sign in