What problem does it solve? Security teams often produce generic threat model checklists disconnected from the actual codebase. This Skill produces an AppSec-grade threat model anchored to real repository evidence, with explicit assumptions, prioritized abuse paths, and concrete mitigations. ## Core Features & Use Cases - Evidence-Anchored Analysis: Enumerates trust boundaries, assets, entry points, and attacker capabilities, with every architectural claim tied to a repo path or symbol. - Prioritized Threat Enumeration: Generates abuse paths with qualitative likelihood and impact reasoning, producing a threat table with stable IDs (TM-001, etc.) and critical/high/medium/low priorities. - Structured Output Contract: Delivers a Markdown report with an executive summary, Mermaid trust-boundary diagram, threat model table, and focus paths for manual security review. - Use Case: Point the Skill at a web service repository before a launch review; it maps endpoints and data flows, validates assumptions with you, then writes a <repo>-threat-model.md file your AppSec team can act on. ## Quick Start Ask the assistant to threat model this repository and write a prioritized Markdown threat model with abuse paths and mitigations.
