agentsclimarketplace

Threat model

Skill K95M65/AI_ONBOARD/skills/threat-model

Portable agent workflow framework for Codex, Claude Code, and OpenCode—shared project context, focused skills, independent review, and safe updates.

Install
npx -y skills add K95M65/AI_ONBOARD --skill threat-model

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

2 things to look at

  • 19 days oldThe repository was created 19 days ago. New is not bad, but a brand new repository carrying a familiar-sounding name is the shape a typosquat arrives in, and there has been no time for anyone else to find a problem with it.
  • 0 stars0 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

What its author says it does

Copied from the file, not written here

Produce a threat model for a feature or system using STRIDE and a data-flow view. Use at design time before building something security-sensitive, or as the framing step of a security audit — to decide what's worth protecting before hunting for bugs.

SKILL.md

1.7 KB, as published. Nobody here has run it

Threat model

The design-time companion to security-audit: the audit finds bugs; this decides what you're protecting and from whom, so the audit knows where to look.

When to use

Before building a security-sensitive feature (auth, payments, file handling, multi-tenant data), or as the first step of an audit on an unfamiliar system.

Steps

  1. Draw the data flow. List external entities (users, third parties), processes (services, handlers), data stores, and the trust boundaries the data crosses. A rough text DFD is enough.
  2. Identify assets. What's worth stealing or breaking? PII, credentials, money, integrity of records, availability.
  3. Apply STRIDE to each element and each boundary crossing — see reference.md for the per-category prompts.
  4. Rate & prioritize. For each threat: likelihood × impact using the packaged rubric in reference.md. Focus on boundary crossings.
  5. Assign mitigations. For each meaningful threat, name the control (authz check, validation, rate limit, encryption) and where it lives. Gaps become audit targets or backlog items.

Output

A short doc: the DFD, the asset list, a threat table (element → STRIDE category → threat → likelihood/impact → mitigation/owner), and the top risks to address first. See the template in reference.md.

Keep looking

Skills are one crate of 328,083. Ordering is by how many stacks a row turns up in, so the top of any crate is what has actually been picked rather than what has the most stars.