Threat model discipline

Skill hypnguyen1209/offensive-claude/skills/threat-model-discipline

Use when starting an engagement, before exploitation, or whenever the attack surface changes — build/validate the threat model and detect drift (new unreviewed surface) before advancingFrom its SKILL.md

Install

npx -y skills add hypnguyen1209/offensive-claude --skill threat-model-discipline

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

SKILL.md

2.6 KB, 592 tokens by cl100k_base, as published. Nobody here has run it

Threat-Model Discipline

Overview

You cannot test what you have not modeled. A threat model names the assets, entry points, trust boundaries, relevant ATT&CK techniques, and existing mitigations — so coverage is deliberate, not accidental. On a long engagement the surface drifts (a new endpoint, a new dependency); un-reviewed drift is where bugs hide. This skill keeps the model complete and re-checks it for drift.

When to Activate

At engagement start (after recon-osint), before weaponize/exploit.
Whenever recon is re-run or the target changes — to catch new attack surface.
At /engage.gate — the gate refuses to advance on un-acknowledged drift.

The model (JSON, materialized from recon)

threat-model.json (see templates/threat-model/): five required lists — assets, entry_points, trust_boundaries, attck (technique ids), mitigations.

# 1. Lint - every required field present, no placeholders, valid ATT&CK ids
python skills/threat-model-discipline/scripts/threatmodel_lint.py lint .engage/recon/threat-model.json

# 2. Drift - diff a re-run against the reviewed baseline; NEW entry points/assets/boundaries are
#    unreviewed surface and BLOCK the gate until re-reviewed or acknowledged
python skills/threat-model-discipline/scripts/threatmodel_lint.py drift \
    .engage/recon/threat-model.baseline.json .engage/recon/threat-model.json

Or use /engage.threatmodel (materialize | lint | drift).

Red Flags — STOP

"We'll model it as we go" — unmodeled surface = untested surface. Model first.
"Recon changed but the threat model didn't" — re-run drift; new surface must be re-reviewed.
A threat model full of TBD/[fill in] — that is not a model; the lint fails it.
A new entry_point appeared and you proceeded anyway — that is the exact gap attackers use.

Rationalizations

Excuse	Reality
"The model is obvious, skip it"	Obvious to you ≠ documented. Coverage you can't diff is coverage you can't trust.
"Drift is just noise"	A new entry point is new attack surface. Acknowledge it explicitly or re-review.
"ATT&CK mapping is busywork"	It turns 'we tested stuff' into 'we covered these techniques' — the report's backbone.

Pairs with scope-discipline (what you may touch) and finding-discipline (what counts as proven).

What ships with it: 1 file

5.8 KB alongside SKILL.md, 1 of them executable

scripts/

threatmodel_lint.pyruns5.8 KB

Gives 0 of the 12 instructions most threat modeling skills give in 592 tokens

Counted across 325 of the 341 authors here whose files we hold, read 2026-09-06

Use parameterized queries for all database accessin 58 of 325, across 34 files
Validate all user input with schemasin 52 of 325, across 29 files
Store tokens in httpOnly cookiesin 50 of 325, across 27 files
Store secrets in environment variablesin 50 of 325, across 27 files
Sanitize user-provided HTML before renderingin 49 of 325, across 26 files
Apply rate limiting to all API endpointsin 48 of 325, across 25 files
Verify authorization before sensitive operationsin 47 of 325, across 24 files
Require CSRF tokens on state-changing operationsin 46 of 325, across 23 files
Return generic error messages to usersin 40 of 325, across 22 files
Restrict file uploads by size, type, and extensionin 38 of 325, across 20 files
Run npm audit and fix vulnerabilitiesin 28 of 325, across 16 files
Redact sensitive data from logsin 25 of 325, across 11 files

Said here and by no other author read

build the threat model before exploitation
materialize threat-model.json from recon with the five required lists
lint the model for required fields and valid ATT&CK ids
diff re-run recon against the reviewed baseline for drift
re-review new entry points, assets and boundaries before advancing
acknowledge drift explicitly or re-review it

Grouped from the skills themselves: near-identical wordings counted once, and counted by distinct author, so one author publishing three of these counts once. Length counted with cl100k_base; the agent that loads this file may tokenize it differently.