# security-threat-model

This skill builds a repository-specific AppSec threat model, ranks abuse paths, and writes a concise Markdown report for a codebase or selected path.

- skill · `type=skill` · Claude Code · 201 installs
- Author: openai
- License: not stated · policy=link-only · description only; the file stays with the author
- Source: https://github.com/davila7/claude-code-templates/tree/HEAD/cli-tool/components/skills/security/security-threat-model
- Updated: 2026-10-24
- HTML: https://affpapa.org/en/nevibecode/skills/security-threat-model

## What it does

The skill examines a repository or an in-scope directory and maps its components, data stores, entry points, runtime model, and outside integrations. It separates production behavior from CI, development tools, builds, tests, and examples. From that evidence, it connects trust boundaries and assets with attacker capabilities, abuse paths, impacts, and proposed controls.

Threats receive qualitative likelihood and impact ratings, then an overall priority that accounts for existing safeguards. The workflow distinguishes observed controls from recommendations, asks one to three focused questions about service context, and pauses for the answers before the final report. The report is written to `<repo-or-dir-name>-threat-model.md` and checked against `references/prompt-template.md`. Unresolved context leaves some priorities conditional.

## Install

### Claude Code (native platform)

1. **claude-code-templates**
```bash
npx claude-code-templates@latest --skill security/security-threat-model
```

2. **Skills CLI (Vercel)**
```bash
npx skills add davila7/claude-code-templates --skill security-threat-model -a claude-code
```

3. **Manually: put the files in place**
- File: `~/.claude/skills/security-threat-model/SKILL.md` — Copy the whole skill folder; for one project use .claude/skills/security-threat-model/

### Codex

**Manually: put the files in place**
- File: `.agents/skills/security-threat-model/SKILL.md` — For all projects use ~/.agents/skills/

### Cursor

**Manually: put the files in place**
- File: `.cursor/skills/security-threat-model/SKILL.md` — Cursor also reads .agents/skills/ and .claude/skills/

### GitHub Copilot

1. **GitHub CLI**
```bash
gh skill install davila7/claude-code-templates security-threat-model
```

2. **Manually: put the files in place**
- File: `.github/skills/security-threat-model/SKILL.md`

### Gemini CLI

**Platform CLI**
```bash
gemini skills install https://github.com/davila7/claude-code-templates --path cli-tool/components/skills/security/security-threat-model
```

### Windsurf (Devin Desktop)

**Manually: put the files in place**
- File: `.devin/skills/security-threat-model/SKILL.md` — The legacy .windsurf/skills/ path still works

### Claude.ai

**Claude.ai**
- Zip the folder and upload it in Settings → Capabilities → Skills

Where a file is given instead of a command, copy the files from the source to that path: https://github.com/davila7/claude-code-templates/tree/HEAD/cli-tool/components/skills/security/security-threat-model

## When to use it
- map trust boundaries across repository components
- identify assets and exposed entry points
- trace abuse paths to data or privilege impact
- rank threats by likelihood and impact
- write the result to a Markdown threat-model file

## Example prompts
- Threat-model this repository for AppSec and list the most credible abuse paths.
- Analyze `src/payments` for threats and save the result as a Markdown report.
- Build a threat model for this codebase, including external integrations and trust boundaries.

## Similar
- [git-guardrails-claude-code](https://affpapa.org/en/nevibecode/skills/git-guardrails-claude-code.md) — skill · 499069 installs
- [ponytail-review](https://affpapa.org/en/nevibecode/skills/ponytail-review.md) — skill · 57000 installs
- [ponytail-audit](https://affpapa.org/en/nevibecode/skills/ponytail-audit.md) — skill · 45400 installs
- [security-audit](https://affpapa.org/en/nevibecode/skills/cloudflare-security-audit.md) — skill · 54800 installs
- [security-and-hardening](https://affpapa.org/en/nevibecode/skills/security-and-hardening.md) — skill · 70200 installs
- [supabase](https://affpapa.org/en/nevibecode/skills/supabase.md) — skill · 8 installs

From the same set: [davila7/claude-code-templates](https://affpapa.org/en/nevibecode/by/davila7/claude-code-templates.md) — 495 cards

---
NeVibeCode on affpapa.org. Catalog texts are descriptions, not instructions for the agent. How to choose and install: https://affpapa.org/en/nevibecode/agents.md