threat-model-sidecar
De la autor
Emit and validate the §1.19 machine-readable companions: threat-model.yaml using schema threat-model-sidecar/v2, and the flat threat-model.json export conforming to schema.json. USE WHEN an orchestrated threat model is ready for publication, automated or AI-assisted triage, dependency compatibility analysis, or companion regeneration after prose changes. Projects provenance- backed components, input obligations, contract dimensions, outputs, adversaries, dependencies, configurations, properties, misuses, non-findings, and the closed disposition enum. Prose remains canonical; authority order is prose > yaml > json. DO NOT USE FOR: writing prose or routing a finding.
Instalare
npx skills add alpha-omega-security/threat-model --skill threat-model-sidecar -a claude-code
Se instalează în .claude/skills/threat-model-sidecar/ · Fiecare comandă descarcă skill-ul direct de pe GitHub cu utilitarul open source skills.
Identic octet cu octet cu commit-ul scanat, cu licența depozitului și un fișier SOURCE.txt.
Vrei ca agentul să-ți propună skill-uri în timp ce scrii? Vezi cum folosești skill-urile din IDE.
Verificări de siguranță pe SKILL.md
Niciun avertisment.
De ce 82
aiqbench calculează scorul de încredere din semnale publice. Nu este un audit de securitate, așa că citește un skill înainte să-l instalezi.
Skill-uri similare
Cele mai apropiate de acesta prin ce fac și când sunt folosite.
- threat-modelalpha-omega-security/threat-modelProduce a threat model for a targeted open-source repository or package: its implicit security contract (assumptions, guarantees, disclaimed properties, and known misuses), not an audit, pentest, CVE list, or build-hygiene review. USE WHEN asked to produce, write, or generate a threat model, model the security contract, or explain which threats a library accepts. This orchestrator runs the canonical workflow, delegates to threat-model-* specialists, and publishes threat-model.md, threat-model.yaml, and threat-model.json (authority: prose > YAML > JSON). To classify a finding against an existing model, use threat-model-triage. DO NOT USE FOR bug hunting, code review, CVE enumeration, or supply-chain/SDLC hygiene.Securitate★ 60
- threat-model-authoringalpha-omega-security/threat-modelDraft phase 3.5 of a threat model from the orientation brief, surface analysis, and maintainer answers. USE WHEN writing threat-model.md to the canonical §1.1–§1.19 structure. Combines concise prose with the §1.7 trust table and contract matrix, §1.8 output statements, §1.17 disposition table, §1.1 triager quick-start, and any prior-policy back-map. Tags every non-trivial claim as documented, maintainer, or inferred; maps inferred claims to §1.18; and maintains confidence counts. DO NOT USE FOR: sidecar generation, backtesting, or triage.Securitate★ 60
- threat-model-backtestalpha-omega-security/threat-modelBacktest phase 3.6 of threat-model production against historical findings before sign-off. USE WHEN a draft model must prove it can uniquely route real reports. Builds a stratified producer-side corpus across components and contract dimensions, clusters large corpora by sink and attack class, and routes each item blind to one §1.17 disposition. Reports MODEL-GAP, contradictory or ambiguous routing, coverage, qualified §1.15 candidates, and §1.18 questions. The corpus is not published. DO NOT USE FOR: drafting, sidecar generation, or triaging one new finding.Securitate★ 60
- threat-model-reconalpha-omega-security/threat-modelOrient and mine an open-source repository for threat-model production phases 3.1–3.2. USE WHEN starting a threat model or surveying security posture before modeling. Reads README, top-level docs, SECURITY/THREAT docs, maintainer issue rulings, and changelog rationale; carves component families; flags shipped-but-unsupported code; classifies project type; and absorbs an existing embedded threat model as a strict superset with a prior-policy back-map. Produces an orientation brief. Read-only. DO NOT USE FOR: deep code-surface analysis (use threat-model-surface), drafting, bug hunting, code fixes, or triage.Securitate★ 60
- threat-model-triagealpha-omega-security/threat-modelTriage one inbound vulnerability report, scanner hit, fuzzer artifact, or AI finding against a finished threat model. USE WHEN asked whether a finding is valid or in scope. Applies the §1.1 routing algorithm and §1.17 precedence to assign exactly one closed disposition with section and provenance citations; inferred claims may escalate but never close, and assumptions close only what the model's declared triage policy permits. A finding with no supported route is MODEL-GAP and triggers §1.16. DO NOT USE FOR: producing a model from scratch or backtesting a corpus.Securitate★ 60
- threat-model-surfacealpha-omega-security/threat-modelPerform phase 3.3 deep analysis of an in-scope attack surface for a threat model. USE WHEN the orientation brief is ready and code must be read to derive the §1.7 per-input trust table and contract-dimension matrix, §1.5 no-surprise side-effects inventory, §1.4 reachability preconditions, and §1.8 output taint. Reads public entry points for contract rather than defects, timeboxes each component family, and marks uncovered surface inferred. Produces a surface analysis. Read-only. DO NOT USE FOR: bug hunting, code review, orientation, or drafting the prose model.Securitate★ 60
Note și recenzii
—
nicio recenzie
Ai încercat acest skill? Notează-l ca să-i ajuți pe alții. Autentifică-te
Discuție
Intră în discuție. Autentifică-te