agentsclimarketplace
Sign in

Shelves Security

Threat modelling

737 rows from 351 repositories

Working out what an attacker would actually do first.

What Threat modelling skills agree on

309 skill files read, by 325 of the 341 authors on this shelf whose files we hold, 2026-09-06

The middle one of the 53 measured here is ~1.7k tokens long, counted with cl100k_base

Counted by distinct author, so one author publishing three of these counts once. Where a claim sits in fewer files than authors, that is said: a claim held by forty authors across three files is one file people copied, not forty people who agreed. Near-identical wordings are grouped and the other wordings are shown, so the grouping is yours to check.

What they tell the agent to do

  1. Use parameterized queries for all database access58 of 325 in 34 filesalso worded as Use parameterized database queries; Use parameterized queries for all database operations
  2. Validate all user input with schemas52 of 325 in 29 filesalso worded as Validate every user input against a schema; Validate all user inputs
  3. Store tokens in httpOnly cookies50 of 325 in 27 filesalso worded as Store auth tokens in httpOnly cookies; Store auth tokens in httpOnly cookies, not localStorage
  4. Store secrets in environment variables50 of 325 in 27 filesalso worded as Store all secrets in environment variables; Store secrets in environment or secret manager
  5. Sanitize user-provided HTML before rendering49 of 325 in 26 filesalso worded as Sanitize user-provided HTML; Sanitize all user-provided HTML
  6. Apply rate limiting to all API endpoints48 of 325 in 25 filesalso worded as Rate limit all API endpoints; Apply rate limiting to API endpoints
  7. Verify authorization before sensitive operations47 of 325 in 24 filesalso worded as Check authorization before sensitive operations; Verify roles and ownership before sensitive operations
  8. Require CSRF tokens on state-changing operations46 of 325 in 23 filesalso worded as Require CSRF tokens on state-changing requests; Verify CSRF tokens on state-changing requests
  9. Return generic error messages to users40 of 325 in 22 filesalso worded as Return generic error messages to clients; Return generic error messages in production
  10. Restrict file uploads by size, type, and extension38 of 325 in 20 filesalso worded as Validate file uploads by size, type, extension; Restrict file uploads by size, type, and extension
  11. Run npm audit and fix vulnerabilities28 of 325 in 16 filesalso worded as Run npm audit and update dependencies; Run npm audit and commit lock files
  12. Redact sensitive data from logs25 of 325 in 11 filesalso worded as Redact sensitive data from logs and errors; Redact sensitive data from all logs
  13. Classify findings by severity13 of 325 in 12 filesalso worded as Document findings with severity; Rank findings by severity
  14. Complete the pre-deployment security checklist11 of 325 in 6 filesalso worded as Complete the security checklist before production deployment; Complete pre-deployment security checklist before deployment
  15. Evaluate every component against all six STRIDE categories10 of 325 in 8 filesalso worded as Evaluate every component against STRIDE; check all six STRIDE categories per boundary

What they tell it not to do

  1. Never concatenate user input into SQL58 of 325 in 33 filesalso worded as Never concatenate user input into SQL strings; Concatenating user input into SQL queries
  2. Never expose stack traces to users57 of 325 in 34 filesalso worded as Do not expose stack traces to users; Exposing stack traces to users
  3. Never hardcode secrets in source code55 of 325 in 33 filesalso worded as Never hardcode secrets or credentials; Hardcoding secrets in source code
  4. Never store tokens in localStorage52 of 325 in 30 filesalso worded as Storing tokens in localStorage; Do not store tokens in localStorage/sessionStorage
  5. Never log passwords, tokens, or secrets49 of 325 in 26 filesalso worded as Never log passwords, tokens, or card numbers; never log passwords or card numbers
  6. Never hardcode API keys, tokens, or passwords23 of 325 in 19 filesalso worded as Never hardcode credentials or keys; Never hardcode API keys in code
  7. Never allow blind transaction signing15 of 325 in 10 filesalso worded as Never sign transactions blindly; Never blind-sign blockchain transactions
  8. Do not default CSP to unsafe-inline or unsafe-eval14 of 325 in 6 filesalso worded as Defaulting CSP to unsafe-inline or unsafe-eval; Do not default to unsafe-inline or unsafe-eval in CSP
  9. Never log sensitive data10 of 325 in 9 filesalso worded as Never log credentials or sensitive data; Never log sensitive data in release builds
  10. Never use MD5 or SHA1 for passwords10 of 325 in 8 filesalso worded as Never hash passwords with MD5 or SHA1; Never use MD5, SHA-1, or SHA-256 for passwords

What they expect to be installed

  1. npm audit83 of 325 in 58 files
  2. zod50 of 325 in 28 files
  3. DOMPurify48 of 325 in 25 files
  4. npm ci48 of 325 in 25 files
  5. express-rate-limit46 of 325 in 23 files
  6. grep33 of 325
  7. Dependabot24 of 325 in 15 files
  8. pip-audit21 of 325 in 20 files
  9. git21 of 325
  10. semgrep16 of 325 in 15 files

What they ask it to produce

  1. Automated security tests42 of 325 in 19 filesalso worded as automated security tests for auth, validation, and rate limiting
  2. Completed pre-deployment security checklist31 of 325 in 18 filesalso worded as Completed security verification checklist; Completed security checklist
  3. Threat model document23 of 325also worded as docs/threat-model.md; completed threat model document
  4. STRIDE threat model15 of 325 in 12 filesalso worded as STRIDE threat model document; STRIDE/PASTA threat model
  5. Data flow diagram14 of 325 in 13 filesalso worded as data flow diagrams; Data flow diagram of the system
  6. Security review report14 of 325 in 11 filesalso worded as Security review report with findings and summary counts; structured security review report
  7. Data flow diagram with trust boundaries13 of 325 in 12 filesalso worded as Data flow diagram with marked trust boundaries; Data-flow diagram with trust boundaries
  8. Prioritized remediation plan11 of 325 in 6 filesalso worded as Remediation plan; Remediation plan with priority, preconditions, and owner

When Threat modelling authors say to reach for one

The situations these authors wrote into their own files, counted out of the same 325 authors, with the skills that name each one

How Threat modelling skills are built

682 skill directories by 333 authors, read from their repositories’ own file trees 2026-08-05

The middle bundle among those shipping files is 3 files, 18.5 KB beside SKILL.md

Counted by distinct author, same as above, so one author publishing forty template copies counts once. SKILL.md itself is not counted as a file, so a single-file skill is one where that file is the whole skill.

The shape

  1. SKILL.md is the whole skill146 of 333 authors, 310 of 682 skills
  2. files ship beside it187 of 333 authors, 372 of 682 skills
  3. executable scripts ship inside47 of 333 authors, 77 of 682 skills

The folders they converge on

  1. references/117 of 333 authors, 218 of 682 skills
  2. scripts/40 of 333 authors, 69 of 682 skills
  3. agents/29 of 333 authors, 53 of 682 skills
  4. assets/15 of 333 authors, 17 of 682 skills
  5. evals/11 of 333 authors, 25 of 682 skills
  6. resources/8 of 333 authors, 12 of 682 skills

  • Aegis

    myclaude-sh/myclaude-creator-engine/.claude/skills/aegis Skill

    24★ repo

    The creation pipeline for Claude Code products — research, create, validate, publish. 13 types, 20 quality patterns, zero coding required.

  • Threat model authoring

    alpha-omega-security/threat-model/skills/threat-model-authoring Skill

    18★ repo

    Agent skill for producing threat models for open-source projects

  • Prompt injection auditor

    screem500/prompt-injection-auditor Skill

    13★

    Security audit skill for LLM agents - prompt injection scanner, attack catalog & defense checklist

  • Cybersorted

    cyber-sorted/skills-pro/cybersorted Skill

    no license3★ repo

    Professional security and enterprise architecture advisory skills for Claude Code

  • Skill security review lens

    zantific/skill-security-review-lens Skill

    3★

    Security review skill for Claude Code. Scans third-party agent skills against 35 detection rules and 7 semantic checks before you install them. Finds patterns worth looking at, flags what could go wrong. Does not pass or fail anything.

  • Claude bug bounty

    Mikacr1138/claude-bug-bounty Skill

    2★

    Enable efficient bug bounty hunting across Web2 and Web3 with a tool that supports full recon to detailed reporting.

  • Iac security review

    uttej-badwane/secure-cloud-prompt-engineering/skills/iac-security-review Skill

    2★ repo

    Security-focused prompt library and Claude Code skill for automated IaC security reviews. Covers Terraform, Kubernetes, Docker, Ansible, CloudFormation, and CI/CD pipelines. Compliance mapping to CIS, NIST 800-53, PCI-DSS, SOC2, HIPAA, and GDPR.

  • Dread threat modeling framework

    ivan-sincek/threat-modeling-agent-skills/json/dread-threat-modeling-framework Skill

    2★ repo

    Easy-to-use, high-quality threat modeling agent skills.

  • Github actions security review

    Fyzel/claude-skills/skills/github-actions-security-review Skill

    1★ repo

    A collection of Claude skills.

  • Prompt injection guard

    kauaim/skills/prompt-injection-guard Skill

    no license1★ repo

    Free, open-source skills for Claude Code and Claude Desktop — starting with a prompt-injection guard for safely ingesting untrusted documents.

  • Prompt injection hardening

    anthalehq/anthale-agent-skills/skills/prompt-injection-hardening Skill

    1★ repo

    Anthale's official AI agent security skills

  • Production readiness audit

    P1tak4s/production-readiness-audit Skill

    1★

    Claude Agent Skill: scan, review & harden codebases for production — security, reliability, testing, data/compliance, ops, accessibility. Includes a dependency-free scanner, deep checklists, and templates.

  • Pre deploy security review pl

    GeorgeMJZak/before-you-deploy/skills/pre-deploy-security-review-pl Skill

    1★ repo

    A pre-deploy security review skill for any AI agent (Claude, Codex, Gemini). Runs the 'Before You Deploy Your Vibe-Coded App' 8-category review on your real code.

  • Postgres auth security review

    maherukhislam/postgres-auth-security-review/skills/postgres-auth-security-review Skill

    1★ repo

    An Agent Skill that reviews and writes PostgreSQL/Supabase authentication code against a researched set of common and uncommon security mistakes - before it ships.

  • Attack surface mcp server

    cyanheads/attack-surface-mcp-server/io.github.cyanheads/attack-surface-mcp-server MCP server

    1★ repo

    Passive external attack-surface mapping: CT subdomains, DNS, TLS, HTTP posture, RDAP/WHOIS, Shodan.

  • Secure development

    siam-hossain9/secure-development-skill/plugins/secure-development/skills/secure-development Skill

    0★ repo

    Secure Development — a Claude Code skill: 23 security reference domains + a phase-by-phase secure build lifecycle (secure-by-design).

  • Agent security guard

    bensonmaxai/minis-security-skills/skills/agent-security-guard Skill

    no license0★ repo

    Security skills for Minis on iOS: agent operational safety and prompt-injection defense.

  • Zama fhevm security review

    thericardoli/zama-dev-skills/skills/zama-fhevm-security-review Skill

    0★ repo

    Agent skills for Zama FHEVM and protocol development.

  • Cairo audit skill

    alebeta06/cairo-audit-skill Skill

    0★

    AI-assisted security auditing for Cairo smart contracts. An open-source Agent Skill for Claude Code.

  • Skill

    alexbanda08/solana-auditor-skill/skill Skill

    0★ repo

    Practical Solana/Anchor security audit workflow skill for the Solana AI Kit (static + manual + dynamic + report); fills the official seed. MIT.

  • Threat model studio

    satishTheLegend/threat-model-studio Skill

    0★

    Claude Code skill: a complete STRIDE/LINDDUN threat-modeling engagement — data-flow model, OWASP risk scoring, mitigations, gap loop, and a diffable remediation register. Enterprise AppSec rigor for solo builders.

  • Risk register csf

    satishTheLegend/risk-register-csf Skill

    0★

    Claude Code skill: a solo security program as durable artifacts — a living risk register, NIST CSF 2.0 self-assessment, and a lightweight incident-response plan. The right-sized GRC slice, no SOC2 ceremony.

  • Ai rmf governor

    satishTheLegend/ai-rmf-governor Skill

    0★

    Claude Code skill: run NIST AI RMF (Govern/Map/Measure/Manage) on your LLM/ML feature — named failure modes, metric thresholds, an offline eval gate, and signed-off residual risk.

  • System upgrade

    kazani-351/system-upgrade Skill

    0★

    Agent skill: run system-upgrade meta-prompts on your own setup. Adapted from Daniel Miessler's Fable prompts.

  • Regulatory threat model skill

    Ansvar-Systems/regulatory-threat-model-skill Skill

    no license0★

    Agent skill: server-enforced STRIDE + LINDDUN threat modeling with cited EU security-obligations mapping via the Ansvar Gateway MCP connector

  • Agent prompt injection firewall mcp

    CSOAI-ORG/agent-prompt-injection-firewall-mcp/io.github.CSOAI-ORG/agent-prompt-injection-firewall-mcp MCP server

    0★ repo

    The WAF for agents. Pattern-based + heuristic firewall scans prompts, RAG documents, tool argume...

  • Risk assessment ai mcp

    CSOAI-ORG/risk-assessment-ai-mcp/io.github.CSOAI-ORG/risk-assessment-ai-mcp MCP server

    0★ repo

    Risk Assessment Ai MCP Server by MEOK AI Labs

  • 007

    sickn33/agentic-awesome-skills/plugins/agentic-awesome-skills-claude/skills/007 Skill

    44,658★ repo

    AAS Core is the local, agent-first control plane for complete catalog discovery, agent-owned selection, stack validation, and planning, backed by 1,987+ agentic skills. Includes CLI, local MCP, catalog, plugins, and Workbench.

  • Security review

    kklimuk/docx-cli/.claude/skills/security-review Skill

    178★ repo

    CLI for AI agents (Claude, Codex) to read, edit, and comment on .docx files with full format fidelity.

  • Attack path architect

    Orizon-eu/claude-code-pentest/attack-path-architect Skill

    22★ repo

    6 Claude Code skills that automate the entire pentest lifecycle. From recon to exploit chains to bug bounty reports — just give it a domain. 43 scripts, zero dependencies, pure Python.

  • Threat model backtest

    alpha-omega-security/threat-model/skills/threat-model-backtest Skill

    18★ repo

    Agent skill for producing threat models for open-source projects

  • Overcast attack surface

    kdr/overcast/skills/overcast-attack-surface Skill

    12★ repo

    Video OSINT agent: senses + OSINT reach for any agent.

  • 007

    pinkpixel-dev/skills-collection-1/SKILLS/007 Skill

    7★ repo

    Part 1 of a large AI and agent skills collection featuring 900+ reusable skill folders, prompt workflows, references, scripts, and assets across engineering, cloud, security, research, writing, design, and automation.

  • Infosec engineer

    CrashBytes/claude-role-skills/skills/infosec-engineer Skill

    6★ repo

    Claude Code plugin with 7 role-based professional skills for software teams — Scrum Master, Product Owner, Product Manager, UX/UI Developer, InfoSec Engineer, DevOps Engineer, and Software Migration Engineer

  • 007

    ranbot-ai/awesome-skills/skills/007 Skill

    no license6★ repo

    Awesome Claude Skills, Tools for Customizing Claude AI workflows

  • Bug bounty

    Mikacr1138/claude-bug-bounty/skills/bug-bounty Skill

    2★ repo

    Enable efficient bug bounty hunting across Web2 and Web3 with a tool that supports full recon to detailed reporting.

  • Pasta threat modeling framework

    ivan-sincek/threat-modeling-agent-skills/json/pasta-threat-modeling-framework Skill

    2★ repo

    Easy-to-use, high-quality threat modeling agent skills.

  • 007

    newmindsgroup/ai-agent-skills-library/dist/skills/007 Skill

    1★ repo

    Shared library of AI agent skills — works across Claude Code, Cursor, Codex, Windsurf, OpenCode, and Google Antigravity via a single universal installer.

  • Pre deploy security review

    GeorgeMJZak/before-you-deploy/skills/pre-deploy-security-review Skill

    1★ repo

    A pre-deploy security review skill for any AI agent (Claude, Codex, Gemini). Runs the 'Before You Deploy Your Vibe-Coded App' 8-category review on your real code.

  • Cybersorted lite

    cyber-sorted/skills-free/cybersorted-lite Skill

    0★ repo

    Free Claude Code skills for cloud architecture diagrams and security advisory

  • Prompt injection defense

    bensonmaxai/minis-security-skills/skills/prompt-injection-defense Skill

    no license0★ repo

    Security skills for Minis on iOS: agent operational safety and prompt-injection defense.

  • Security research

    code-yeongyu/oh-my-openagent/.agents/skills/security-research Skill

    no license67,917★ repo

    omo/lazycodex: The coding agent for tokenmaxxers;the one and only agent harness for complex codebases. For your Codex, for your OpenCode

  • Cc skill security review

    sickn33/agentic-awesome-skills/plugins/agentic-awesome-skills-claude/skills/cc-skill-security-review Skill

    44,658★ repo

    AAS Core is the local, agent-first control plane for complete catalog discovery, agent-owned selection, stack validation, and planning, backed by 1,987+ agentic skills. Includes CLI, local MCP, catalog, plugins, and Workbench.

  • Gha security review

    sickn33/agentic-awesome-skills/plugins/agentic-awesome-skills-claude/skills/gha-security-review Skill

    44,658★ repo

    AAS Core is the local, agent-first control plane for complete catalog discovery, agent-owned selection, stack validation, and planning, backed by 1,987+ agentic skills. Includes CLI, local MCP, catalog, plugins, and Workbench.

  • Stride analysis patterns

    sickn33/agentic-awesome-skills/plugins/agentic-awesome-skills-claude/skills/stride-analysis-patterns Skill

    44,658★ repo

    AAS Core is the local, agent-first control plane for complete catalog discovery, agent-owned selection, stack validation, and planning, backed by 1,987+ agentic skills. Includes CLI, local MCP, catalog, plugins, and Workbench.

  • Threat modeling expert

    sickn33/agentic-awesome-skills/plugins/agentic-awesome-skills-claude/skills/threat-modeling-expert Skill

    44,658★ repo

    AAS Core is the local, agent-first control plane for complete catalog discovery, agent-owned selection, stack validation, and planning, backed by 1,987+ agentic skills. Includes CLI, local MCP, catalog, plugins, and Workbench.

  • 007

    sickn33/agentic-awesome-skills/plugins/agentic-awesome-skills/skills/007 Skill

    44,658★ repo

    AAS Core is the local, agent-first control plane for complete catalog discovery, agent-owned selection, stack validation, and planning, backed by 1,987+ agentic skills. Includes CLI, local MCP, catalog, plugins, and Workbench.

  • Cc skill security review

    sickn33/agentic-awesome-skills/plugins/agentic-awesome-skills/skills/cc-skill-security-review Skill

    44,658★ repo

    AAS Core is the local, agent-first control plane for complete catalog discovery, agent-owned selection, stack validation, and planning, backed by 1,987+ agentic skills. Includes CLI, local MCP, catalog, plugins, and Workbench.

  • Gha security review

    sickn33/agentic-awesome-skills/plugins/agentic-awesome-skills/skills/gha-security-review Skill

    44,658★ repo

    AAS Core is the local, agent-first control plane for complete catalog discovery, agent-owned selection, stack validation, and planning, backed by 1,987+ agentic skills. Includes CLI, local MCP, catalog, plugins, and Workbench.

  • Stride analysis patterns

    sickn33/agentic-awesome-skills/plugins/agentic-awesome-skills/skills/stride-analysis-patterns Skill

    44,658★ repo

    AAS Core is the local, agent-first control plane for complete catalog discovery, agent-owned selection, stack validation, and planning, backed by 1,987+ agentic skills. Includes CLI, local MCP, catalog, plugins, and Workbench.

  • Threat modeling expert

    sickn33/agentic-awesome-skills/plugins/agentic-awesome-skills/skills/threat-modeling-expert Skill

    44,658★ repo

    AAS Core is the local, agent-first control plane for complete catalog discovery, agent-owned selection, stack validation, and planning, backed by 1,987+ agentic skills. Includes CLI, local MCP, catalog, plugins, and Workbench.

  • Cc skill security review

    sickn33/agentic-awesome-skills/plugins/agentic-bundle-aas-privacy-compliance-engineering/skills/cc-skill-security-review Skill

    44,658★ repo

    AAS Core is the local, agent-first control plane for complete catalog discovery, agent-owned selection, stack validation, and planning, backed by 1,987+ agentic skills. Includes CLI, local MCP, catalog, plugins, and Workbench.

  • Cc skill security review

    sickn33/agentic-awesome-skills/plugins/agentic-bundle-aas-secure-app-builder/skills/cc-skill-security-review Skill

    44,658★ repo

    AAS Core is the local, agent-first control plane for complete catalog discovery, agent-owned selection, stack validation, and planning, backed by 1,987+ agentic skills. Includes CLI, local MCP, catalog, plugins, and Workbench.

  • Cc skill security review

    sickn33/agentic-awesome-skills/plugins/agentic-bundle-security-developer/skills/cc-skill-security-review Skill

    44,658★ repo

    AAS Core is the local, agent-first control plane for complete catalog discovery, agent-owned selection, stack validation, and planning, backed by 1,987+ agentic skills. Includes CLI, local MCP, catalog, plugins, and Workbench.

  • Threat modeling expert

    sickn33/agentic-awesome-skills/plugins/agentic-bundle-security-engineer/skills/threat-modeling-expert Skill

    44,658★ repo

    AAS Core is the local, agent-first control plane for complete catalog discovery, agent-owned selection, stack validation, and planning, backed by 1,987+ agentic skills. Includes CLI, local MCP, catalog, plugins, and Workbench.

  • 007

    sickn33/agentic-awesome-skills/skills/007 Skill

    44,658★ repo

    AAS Core is the local, agent-first control plane for complete catalog discovery, agent-owned selection, stack validation, and planning, backed by 1,987+ agentic skills. Includes CLI, local MCP, catalog, plugins, and Workbench.

  • Cc skill security review

    sickn33/agentic-awesome-skills/skills/cc-skill-security-review Skill

    44,658★ repo

    AAS Core is the local, agent-first control plane for complete catalog discovery, agent-owned selection, stack validation, and planning, backed by 1,987+ agentic skills. Includes CLI, local MCP, catalog, plugins, and Workbench.

  • Gha security review

    sickn33/agentic-awesome-skills/skills/gha-security-review Skill

    44,658★ repo

    AAS Core is the local, agent-first control plane for complete catalog discovery, agent-owned selection, stack validation, and planning, backed by 1,987+ agentic skills. Includes CLI, local MCP, catalog, plugins, and Workbench.

  • Stride analysis patterns

    sickn33/agentic-awesome-skills/skills/stride-analysis-patterns Skill

    44,658★ repo

    AAS Core is the local, agent-first control plane for complete catalog discovery, agent-owned selection, stack validation, and planning, backed by 1,987+ agentic skills. Includes CLI, local MCP, catalog, plugins, and Workbench.

  • Threat modeling expert

    sickn33/agentic-awesome-skills/skills/threat-modeling-expert Skill

    44,658★ repo

    AAS Core is the local, agent-first control plane for complete catalog discovery, agent-owned selection, stack validation, and planning, backed by 1,987+ agentic skills. Includes CLI, local MCP, catalog, plugins, and Workbench.

All 737 in the catalog