security-threat-model

What problem does it solve? Security reviews often produce generic checklists disconnected from the actual codebase. This Skill produces an AppSec-grade threat model anchored to real repository evidence, with explicit assumptions, prioritized abuse paths, and concrete mitigations. ## Core Features & Use Cases - Evidence-Anchored Analysis: Enumerates trust boundaries, assets, entry points, and attacker capabilities, with every architectural claim tied to a repo path or symbol. - Prioritized Threat Enumeration: Builds multi-step abuse paths with qualitative likelihood and impact reasoning, producing a stable threat table (TM-001, TM-002, ...) with critical/high/medium/low priorities. - Assumption Validation Workflow: Pauses to confirm deployment model, exposure, and data sensitivity with the user before finalizing the report. - Use Case: Point the Skill at a service repository before a launch review; it maps components and boundaries, renders a Mermaid diagram, and writes a <repo>-threat-model.md report with focus paths for manual security review. ## Quick Start Ask the agent to threat model this repository and produce a prioritized Markdown report with abuse paths and mitigations.