security-threat-model — Claude Code skill: purpose and install
This skill builds a repository-specific AppSec threat model, ranks abuse paths, and writes a concise Markdown report for a codebase or selected path.
npx claude-code-templates@latest --skill security/security-threat-modelWhat security-threat-model does
The skill examines a repository or an in-scope directory and maps its components, data stores, entry points, runtime model, and outside integrations. It separates production behavior from CI, development tools, builds, tests, and examples. From that evidence, it connects trust boundaries and assets with attacker capabilities, abuse paths, impacts, and proposed controls.
Threats receive qualitative likelihood and impact ratings, then an overall priority that accounts for existing safeguards. The workflow distinguishes observed controls from recommendations, asks one to three focused questions about service context, and pauses for the answers before the final report. The report is written to <repo-or-dir-name>-threat-model.md and checked against references/prompt-template.md. Unresolved context leaves some priorities conditional.
What it helps with
- map trust boundaries across repository components
- identify assets and exposed entry points
- trace abuse paths to data or privilege impact
- rank threats by likelihood and impact
- write the result to a Markdown threat-model file
Example prompts for the agent
- Threat-model this repository for AppSec and list the most credible abuse paths.
- Analyze
src/paymentsfor threats and save the result as a Markdown report. - Build a threat model for this codebase, including external integrations and trust boundaries.
How to install security-threat-model
1claude-code-templates
npx claude-code-templates@latest --skill security/security-threat-model2Skills CLI (Vercel)
npx skills add davila7/claude-code-templates --skill security-threat-model -a claude-code3Manually: put the files in place
~/.claude/skills/security-threat-model/SKILL.mdCopy the whole skill folder; for one project use .claude/skills/security-threat-model/
Manually: put the files in place
.agents/skills/security-threat-model/SKILL.mdFor all projects use ~/.agents/skills/
Manually: put the files in place
.cursor/skills/security-threat-model/SKILL.mdCursor also reads .agents/skills/ and .claude/skills/
1GitHub CLI
gh skill install davila7/claude-code-templates security-threat-model2Manually: put the files in place
.github/skills/security-threat-model/SKILL.mdPlatform CLI
gemini skills install https://github.com/davila7/claude-code-templates --path cli-tool/components/skills/security/security-threat-modelManually: put the files in place
.devin/skills/security-threat-model/SKILL.mdThe legacy .windsurf/skills/ path still works
Claude.ai
Zip the folder and upload it in Settings → Capabilities → Skills
Step by step, with commands for each platform: How to install skills in Claude Code: five ways
Questions about security-threat-model
How do I install security-threat-model in Claude Code?
Run npx claude-code-templates@latest --skill security/security-threat-model.
What does security-threat-model do?
It inspects repository evidence to map assets, trust boundaries, entry points, and attacker capabilities, then produces a prioritized Markdown threat model.
Why does the skill ask questions before producing the final report?
Deployment, authentication, exposure, and data context can change threat priority. The skill asks focused follow-up questions and waits for the answers before completing the report.
