threat-model-triage
From the author
Triage one inbound vulnerability report, scanner hit, fuzzer artifact, or AI finding against a finished threat model. USE WHEN asked whether a finding is valid or in scope. Applies the §1.1 routing algorithm and §1.17 precedence to assign exactly one closed disposition with section and provenance citations; inferred claims may escalate but never close, and assumptions close only what the model's declared triage policy permits. A finding with no supported route is MODEL-GAP and triggers §1.16. DO NOT USE FOR: producing a model from scratch or backtesting a corpus.
Install
npx skills add alpha-omega-security/threat-model --skill threat-model-triage -a claude-code
Installs to .claude/skills/threat-model-triage/ · Each command fetches the skill straight from GitHub with the open skills CLI.
Byte-identical to the scanned commit, with the repository’s licence and a SOURCE.txt.
Want your agent to suggest skills while you type? See how to use skills from your IDE.
Safety checks on SKILL.md
No warnings.
Why 82
aiqbench computes the trust score from public signals. It is not a security audit, so read a skill before you install it.
Similar skills
Closest to this one by what they do and when they are used.
- threat-model-backtestalpha-omega-security/threat-modelBacktest phase 3.6 of threat-model production against historical findings before sign-off. USE WHEN a draft model must prove it can uniquely route real reports. Builds a stratified producer-side corpus across components and contract dimensions, clusters large corpora by sink and attack class, and routes each item blind to one §1.17 disposition. Reports MODEL-GAP, contradictory or ambiguous routing, coverage, qualified §1.15 candidates, and §1.18 questions. The corpus is not published. DO NOT USE FOR: drafting, sidecar generation, or triaging one new finding.Security★ 60
- finding-triage26zl/cybersec-toolkitUse to triage a single security finding — from a scanner (SAST/DAST/SCA), an audit, a pentest report, a bug bounty submission, a CVE advisory, or a threat hunt — into a defensible disposition with the required evidence. Produces a ticket-ready writeup: Fixed, Deferred, Accepted Risk, or False Positive. Use when normalizing findings across different sources, deciding whether something is real and reachable, assigning contextual severity, or building an audit trail that survives review six months later. Coordinator skill — route findings from audit, offensive, and detection work here for disposition.Security★ 82
- threat-model-authoringalpha-omega-security/threat-modelDraft phase 3.5 of a threat model from the orientation brief, surface analysis, and maintainer answers. USE WHEN writing threat-model.md to the canonical §1.1–§1.19 structure. Combines concise prose with the §1.7 trust table and contract matrix, §1.8 output statements, §1.17 disposition table, §1.1 triager quick-start, and any prior-policy back-map. Tags every non-trivial claim as documented, maintainer, or inferred; maps inferred claims to §1.18; and maintains confidence counts. DO NOT USE FOR: sidecar generation, backtesting, or triage.Security★ 60
- threat-modelingcbrock84/headcountIdentifies what could go wrong in a system before it is built or changed — the assets worth attacking, the entry points, the trust boundaries, and the controls that actually address the realistic threats. Use this when designing a feature or system, when a change touches authentication, data handling, payments, or external input, before a security review, or when deciding which security work is worth doing at all.Security★ 2.1K
- trailmark-finding-triagetrailofbits/skillsPerforms graph-assisted triage of a single security finding, SARIF result, weAudit annotation, suspicious function, or report excerpt using Trailmark reachability, entrypoint paths, taint, privilege-boundary, blast-radius, caller/callee, and neighborhood evidence. Use when deciding whether one candidate issue is reachable, prioritizing a finding before PoC work, preparing evidence for exploit validation, or checking whether a static-analysis result is actionable.Security★ 7.8K
- ai-threat-modelzero-lab-ai/skillsBuilds an evidence-bound AI threat model from partial architecture, trust, identity, data-flow, and control information. Use when scoping an AI assessment, reviewing a design, or prioritizing realistic attack paths under uncertainty.Security★ 282
Ratings & reviews
—
no reviews
Tried this skill? Rate it to help others. Sign in
Discussion
Join the discussion. Sign in