threat-model — Codex skill: what it does, how to install
Builds repository threat models, maps trust boundaries, and outputs threatmodel.md in Codex.
npx skills add openai/plugins --skill threat-model -a codexWhat threat-model does
The skill triggers during the security threat-modeling phase or via the explicit $threat-model invocation. It maps project architecture, examines attacker capabilities, and locates trust boundaries. The resulting analysis is produced as a Markdown document named threatmodel.md.
The workflow checks Git revisions and snapshot digests against an existing cache. When cached results match the current repository version, the skill reuses the stored model instead of generating a new one. It also takes context from existing AGENTS.md or SECURITY.md guidelines when available.
Do not invoke this skill as the main trigger for full branch, commit, or PR scans, since standard Codex scans run threat modeling internally. Install it if you need a standalone threat model artifact or want manual control over security updates.
What it helps with
- generate a standalone threat model for a repository
- identify trust boundaries and security failure modes
- update cached security documentation across Git revisions
- incorporate AGENTS.md or SECURITY.md into architectural risk checks
Example prompts for the agent
- $threat-model
- Create a threat model for this repository and save it to threatmodel.md
- Update the repository threat model for the latest commit
How to install threat-model
1Skills CLI (Vercel)
npx skills add openai/plugins --skill threat-model -a codex2Manually: put the files in place
.agents/skills/threat-model/SKILL.mdFor all projects use ~/.agents/skills/
1Skills CLI (Vercel)
npx skills add openai/plugins --skill threat-model -a claude-code2Manually: put the files in place
~/.claude/skills/threat-model/SKILL.mdCopy the whole skill folder; for one project use .claude/skills/threat-model/
Manually: put the files in place
.cursor/skills/threat-model/SKILL.mdCursor also reads .agents/skills/ and .claude/skills/
1GitHub CLI
gh skill install openai/plugins threat-model2Manually: put the files in place
.github/skills/threat-model/SKILL.mdPlatform CLI
gemini skills install https://github.com/openai/plugins --path plugins/codex-security/skills/threat-modelManually: put the files in place
.devin/skills/threat-model/SKILL.mdThe legacy .windsurf/skills/ path still works
Claude.ai
Zip the folder and upload it in Settings → Capabilities → Skills
From the same set201
The whole set →Similar
Questions about threat-model
How to install threat-model in Codex?
Run npx skills add openai/plugins --skill threat-model -a codex or add the configuration to .agents/skills/threat-model/SKILL.md.
What does threat-model do?
It evaluates repository architecture, outlines attacker capabilities, maps trust boundaries, and outputs the assessment to threatmodel.md.
Can threat-model replace a full PR security scan?
No. Standard Codex scans handle PRs and branches internally, while this skill focuses specifically on generating and updating threat models.
