Individual skill
threat-model
Security threat modeling, attack surface mapping, and trust boundary analysis on a codebase. Triggers on 'threat model', 'security review', 'attack surface', 'trust boundaries', or when assessing a project's security posture. Also trigger when the user is about to build security-sensitive features (auth, crypto, file I/O, network services, native bridges) and needs to understand the threat landscape first — even if they don't explicitly say "threat model." Also triggers on 'what changed' or 'diff analysis' for incremental security review of recent commits.
skills/.experimental/threat-model/SKILL.md
Source commit cf93c57cac89d6fc3e4194686000411567f5caf3
What was checked
- Matches the observed repository HEAD
- Yes
- Scanner rules are current
- No
- Repository scan complete
- No
- Skill scan complete
- Yes
- Observed behavior
- Not checked yet
- Last checked
- Nov 5, 2026
These are observations at the recorded commit, not a guarantee of safety. Review the source before running it.
Install this skill
Choose an agent in your Stack or copy a command below. Commands fetch the pinned commit and copy only this skill directory. Existing destinations are refused. Copying a command does not install anything.
An install command is unavailable: current rules, complete repository and skill scans, an eligible behavior level and a permitted license are required.
Repository context
- Repository stars (not skill ratings)
- 222
- Repository last updated
- Aug 15, 2026
- License
- MIT
Observed agent integration: No specific integration evidence. Standard SKILL.md installation does not imply verified compatibility.
- security Derived category
Files and excerpt
File metadata and permitted, redacted excerpts come from the recorded scan. Source links are pinned to that commit.
Browse files
SKILL.mdcore · 6,831 bytesconfig.jsonasset · 334 bytesgotchas.mddoc · 2,054 bytesmetadata.jsonasset · 872 bytesreferences/attack-patterns.mddoc · 8,436 bytesreferences/findings-schema.mddoc · 6,844 bytesreferences/methodology.mddoc · 10,708 bytesreferences/output-format.mddoc · 9,066 bytesreferences/techniques/bridge-analysis.mddoc · 7,272 bytesreferences/techniques/data-flow-tracing.mddoc · 7,411 bytesreferences/techniques/diff-analysis.mddoc · 4,882 bytesreferences/techniques/exploit-chains.mddoc · 5,792 bytesreferences/techniques/pattern-clustering.mddoc · 5,316 bytesscripts/scan-patterns.shruns · 4,472 bytesscripts/trace-data-flows.shruns · 6,805 bytes
Read excerpt
# Threat Model
Produces structured, evidence-backed security threat models for any codebase. Goes beyond surface enumeration by tracing untrusted data through actual code paths, clustering findings by root cause, and constructing exploit chains that combine individual findings into higher-severity attack paths.
## When to Apply
- User asks to threat model, security review, or map attack surfaces for a codebase
- Starting work on security-sensitive features (auth, crypto, file I/O, networking, native bridges)
- Evaluating a new codebase or major architectural change for security implications
- Reviewing a PR or recent commits for security regressions (incremental/diff mode)
- After a security incident to reassess the threat landscape
## Workflow Overview
```