threat-model
From the author
Produce a threat model for a targeted open-source repository or package: its implicit security contract (assumptions, guarantees, disclaimed properties, and known misuses), not an audit, pentest, CVE list, or build-hygiene review. USE WHEN asked to produce, write, or generate a threat model, model the security contract, or explain which threats a library accepts. This orchestrator runs the canonical workflow, delegates to threat-model-* specialists, and publishes threat-model.md, threat-model.yaml, and threat-model.json (authority: prose > YAML > JSON). To classify a finding against an existing model, use threat-model-triage. DO NOT USE FOR bug hunting, code review, CVE enumeration, or supply-chain/SDLC hygiene.
Install
npx skills add alpha-omega-security/threat-model --skill threat-model -a claude-code
Installs to .claude/skills/threat-model/ · Each command fetches the skill straight from GitHub with the open skills CLI.
Byte-identical to the scanned commit, with the repository’s licence and a SOURCE.txt.
Want your agent to suggest skills while you type? See how to use skills from your IDE.
Safety checks on SKILL.md
No warnings.
Why 82
aiqbench computes the trust score from public signals. It is not a security audit, so read a skill before you install it.
Similar skills
Closest to this one by what they do and when they are used.
- threat-modelingcbrock84/headcountIdentifies what could go wrong in a system before it is built or changed — the assets worth attacking, the entry points, the trust boundaries, and the controls that actually address the realistic threats. Use this when designing a feature or system, when a change touches authentication, data handling, payments, or external input, before a security review, or when deciding which security work is worth doing at all.Security★ 2.1K
- security-threat-modelopenai/skillsRepository-grounded threat modeling that enumerates trust boundaries, assets, attacker capabilities, abuse paths, and mitigations, and writes a concise Markdown threat model. Trigger only when the user explicitly asks to threat model a codebase or path, enumerate threats/abuse paths, or perform AppSec threat modeling. Do not trigger for general architecture summaries, code review, or non-security design work.OfficialSecurity★ 28.3K
- security-modelgetsentry/skillsDefine, review, or update SECURITY_MODEL.md files that tell security review tools a repository's threat model, trust boundaries, invariants, reportable finding classes, and exclusions. Use when asked to "write a security model", "threat model this repo for scanners", "define security review scope", "what counts as a vulnerability here", "update SECURITY_MODEL.md", "why did the scanner flag or miss this", or to check whether existing security guidance still matches the code. Not for running a security review or editing the SECURITY.md disclosure policy.OfficialSecurity★ 1.1K
- create-threat-modeltobihagemann/turboAnalyze a codebase and produce a structured threat model at .turbo/threat-model.md covering assets, trust boundaries, attack surfaces with existing mitigations, attacker stories, and calibrated severity. Use when the user asks to "create a threat model", "threat model", "threat model this codebase", "security analysis", "analyze the attack surface", "what are the threats", or "identify security risks".Security★ 416
- threat-model-reconalpha-omega-security/threat-modelOrient and mine an open-source repository for threat-model production phases 3.1–3.2. USE WHEN starting a threat model or surveying security posture before modeling. Reads README, top-level docs, SECURITY/THREAT docs, maintainer issue rulings, and changelog rationale; carves component families; flags shipped-but-unsupported code; classifies project type; and absorbs an existing embedded threat model as a strict superset with a prior-policy back-map. Produces an orientation brief. Read-only. DO NOT USE FOR: deep code-surface analysis (use threat-model-surface), drafting, bug hunting, code fixes, or triage.Security★ 60
- threat-model-sidecaralpha-omega-security/threat-modelEmit and validate the §1.19 machine-readable companions: threat-model.yaml using schema threat-model-sidecar/v2, and the flat threat-model.json export conforming to schema.json. USE WHEN an orchestrated threat model is ready for publication, automated or AI-assisted triage, dependency compatibility analysis, or companion regeneration after prose changes. Projects provenance- backed components, input obligations, contract dimensions, outputs, adversaries, dependencies, configurations, properties, misuses, non-findings, and the closed disposition enum. Prose remains canonical; authority order is prose > yaml > json. DO NOT USE FOR: writing prose or routing a finding.Security★ 60
Ratings & reviews
—
no reviews
Tried this skill? Rate it to help others. Sign in
Discussion
Join the discussion. Sign in