Threat model discipline

Skill hypnguyen1209/offensive-claude/skills/threat-model-discipline

Offensive security toolkit for Claude Code covering red team, exploit dev, AD attacks, EDR bypass, mobile pentest

Install

npx -y skills add hypnguyen1209/offensive-claude --skill threat-model-discipline

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

What its author says it does

Copied from the file, not written here

Use when starting an engagement, before exploitation, or whenever the attack surface changes — build/validate the threat model and detect drift (new unreviewed surface) before advancing

SKILL.md

2.6 KB, as published. Nobody here has run it

Threat-Model Discipline

Overview

You cannot test what you have not modeled. A threat model names the assets, entry points, trust boundaries, relevant ATT&CK techniques, and existing mitigations — so coverage is deliberate, not accidental. On a long engagement the surface drifts (a new endpoint, a new dependency); un-reviewed drift is where bugs hide. This skill keeps the model complete and re-checks it for drift.

When to Activate

At engagement start (after recon-osint), before weaponize/exploit.
Whenever recon is re-run or the target changes — to catch new attack surface.
At /engage.gate — the gate refuses to advance on un-acknowledged drift.

The model (JSON, materialized from recon)

threat-model.json (see templates/threat-model/): five required lists — assets, entry_points, trust_boundaries, attck (technique ids), mitigations.

# 1. Lint - every required field present, no placeholders, valid ATT&CK ids
python skills/threat-model-discipline/scripts/threatmodel_lint.py lint .engage/recon/threat-model.json

# 2. Drift - diff a re-run against the reviewed baseline; NEW entry points/assets/boundaries are
#    unreviewed surface and BLOCK the gate until re-reviewed or acknowledged
python skills/threat-model-discipline/scripts/threatmodel_lint.py drift \
    .engage/recon/threat-model.baseline.json .engage/recon/threat-model.json

Or use /engage.threatmodel (materialize | lint | drift).

Red Flags — STOP

"We'll model it as we go" — unmodeled surface = untested surface. Model first.
"Recon changed but the threat model didn't" — re-run drift; new surface must be re-reviewed.
A threat model full of TBD/[fill in] — that is not a model; the lint fails it.
A new entry_point appeared and you proceeded anyway — that is the exact gap attackers use.

Rationalizations

Excuse	Reality
"The model is obvious, skip it"	Obvious to you ≠ documented. Coverage you can't diff is coverage you can't trust.
"Drift is just noise"	A new entry point is new attack surface. Acknowledge it explicitly or re-review.
"ATT&CK mapping is busywork"	It turns 'we tested stuff' into 'we covered these techniques' — the report's backbone.

Pairs with scope-discipline (what you may touch) and finding-discipline (what counts as proven).