security-threat-model
Repository-grounded threat modeling that enumerates trust boundaries, assets, attacker capabilities, abuse paths, and mitigations, and writes a concise Markdown threat model. Trigger only when the user explicitly asks to threat model a codebase or path, enumerate threats/abuse paths, or perform AppSec threat modeling. Do not trigger for general architecture summaries, code review, or non-security design work.
Target: Cloud, operations & security. Automatically collected · unverified.
Excerpt from the author’s documentation
Extracted from a fixed version of SKILL.md in its original language. This is the author’s documentation; installation, compatibility and runtime results have not been verified by this site.
Read the original English text
Topics in the source
- Threat Model Source Code Repo
- Quick start
- Workflow
- 1) Scope and extract the system model
- 2) Derive boundaries, assets, and entry points
- 3) Calibrate assets and attacker capabilities
- 4) Enumerate threats as abuse paths
- 5) Prioritize with explicit likelihood and impact reasoning
Deliver an actionable AppSec-grade threat model that is specific to the repository or a project path, not a generic checklist. Anchor every architectural claim to evidence in the repo and keep assumptions explicit. Prioritizing realistic attacker goals and concrete impacts over generic checklists. 1) Collect (or infer) inputs: Repo root path and any in-scope paths. Intended usage, deployment model, internet exposure, and auth expectations (if known). Any existing repository summary or architecture spec. Use prompts in references/prompt-template.md to generate a repository summary. Follow the required output contract in references/prompt-template.md. Use it verbatim when possible. Identify primary components, data stores, and external integrations from the repo summary. Identify how the system runs (server, CLI, library, worker) and its entrypoints. Separate runtime behavior from CI/build/dev tooling and from tests/examples. Map the in-scope locations to those components and exclude out-of-scope items explicitly. Do not claim components, flows, or controls without evidence. Enumerate trust boundaries as concrete edges between components, noting protocol, auth, encryption, validation
This is an excerpt. Refer to the complete source and its current requirements.
- Source repository
- davila7/claude-code-templates
- Source file
- cli-tool/components/skills/security/security-threat-model/SKILL.md
- Fixed revision
- 21be197f100a12b8d0dd9a211cc244c8179f84d3
Sources and evidence
This record was collected automatically. Its documentation, suitability and runtime behavior have not been manually verified.
Author: davila7/claude-code-templates · original repository metadata. Documentation review: Not reviewed. Last source check: 2026-11-09T15:01:40.607Z.
Categories are inferred from names, descriptions and paths. They do not establish compatibility.
License and attribution
MIT. Third-party content and copyright remain with their authors. Refer to the original license and terms.
Original license ↗Synchronization, copying and user-reported success do not mark a resource as runtime-tested.
Limitations and notes
- Collecting metadata does not mean this site has installed, adapted, runtime-tested or security-reviewed the resource.