Localized reading guide
security-threat-modelPurpose, usage and source
Repository-grounded threat modeling that enumerates trust boundaries, assets, attacker capabilities, abuse paths, and mitigations, and writes a concise Markdown threat model. Trigger only when the user explicitly asks to threat model a codebase or path, enumerate threats/abuse paths, or perform AppSec threat modeling. Do not trigger for general architecture summaries, code review, or non-security design work.
Source retrieved:
- Source repository
- openai/skills
- SKILL.md
skills/.curated/security-threat-model/SKILL.md- Repository stars
- 28,420
- Repository updated
- 2026-10-29
- Categories
- Development
- Last collected
License: License file needs review
Workflow excerpts are reading aids, not executable instructions from Codez. No third-party Skill was run to produce this page.
The purpose and workflow passages below are upstream material, organized and translated for reading. They are distinct from the separately labeled Codez editorial analysis.
What this Skill does
Repository-grounded threat modeling that enumerates trust boundaries, assets, attacker capabilities, abuse paths, and mitigations, and writes a concise Markdown threat model. Trigger only when the user explicitly asks to threat model a codebase or path, enumerate threats/abuse paths, or perform AppSec threat modeling. Do not trigger for general architecture summaries, code review, or non-security design work.
How the upstream workflow works
Quick start
Collect (or infer) inputs: Repo root path and any in-scope paths. Intended usage, deployment model, internet exposure, and auth expectations (if known). Any existing repository summary or architecture spec.
Upstream passage · L10 ↗Threat Model Source Code Repo
Deliver an actionable AppSec-grade threat model that is specific to the repository or a project path, not a generic checklist. Anchor every architectural claim to evidence in the repo and keep assumptions explicit. Prioritizing realistic attacker goals and concrete impacts over generic checklists.
Upstream passage · L6 ↗1) Scope and extract the system model
Identify primary components, data stores, and external integrations from the repo summary. Identify how the system runs (server, CLI, library, worker) and its entrypoints.
Upstream passage · L21 ↗Requirements and setup
No short requirements passage was selected from this file. This does not mean the Skill has no dependencies. Check the repository setup instructions and referenced files.
Limits and quality checks
8) Run a quality check before finalizing
Confirm all discovered entrypoints are covered. Confirm each trust boundary is represented in threats.
Upstream passage · L61 ↗Start with a safe trial
- Check the supported host and the repository installation instructions. Keep the Skill directory and its referenced scripts, assets and documentation together; SKILL.md alone may omit dependencies.
- Give the agent your real input, desired output and acceptance criteria. Invocation syntax and available tools depend on the host; this site does not assume a universal install command.
- Try the source workflow in a disposable project or on a copy. Review operations that change files, remote services or billable resources before allowing them.
- Validate the output against the source quality checks and your own requirements. A successful trigger or a high repository Star count does not establish a correct result.
Read further in the source
- Threat Model Source Code Repo
- Quick start
- 1) Scope and extract the system model
- 2) Derive boundaries, assets, and entry points
- 3) Calibrate assets and attacker capabilities
- 4) Enumerate threats as abuse paths
- 5) Prioritize with explicit likelihood and impact reasoning
- 6) Validate service context and assumptions with the user
- 7) Recommend mitigations and focus paths
- 8) Run a quality check before finalizing
- Risk prioritization guidance (illustrative, not exhaustive)
- References
Related Skills
Translation and scope
This reading guide selects passages from the pinned upstream SKILL.md. Translation is assisted. It is not a complete manual or a claim of tested compatibility. Read the original and its referenced files before use.
This introduction refers to the pinned version below; current repository activity and collection time are shown separately.
- Pinned source
- Read the original ↗
- Source retrieved
- Source commit
49f948faa9258a0c61caceaf225e179651397431- Source SHA-256
1283c0dd62a8104d9edda4583569b5d8510b4ddaa45120687c999250fd96bad2