agentsclimarketplace
Sign in

Assess threats

Skill tacticaldoll/fornax/skills/assess-threats

Use when an agent needs to identify trust boundaries and architectural threat vectors in a system design or a change's attack surface; maps the boundaries, applies STRIDE, and rates threats by risk rather than executing exploits or patching code.From its SKILL.md

Install
npx -y skills add tacticaldoll/fornax --skill assess-threats

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

One thing to look at

  • 0 stars0 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

SKILL.md

2.3 KB, as published. Nobody here has run it

Assess Threats

Use this skill to screen each trust boundary against the STRIDE panel of threat vectors: take the boundaries one at a time and run every category (Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, Elevation of Privilege) across each, so the combinations that expose an attack path become findings while the boundaries that clear the whole panel need no report. In plain terms, stress-test the architecture when the user asks for a security review or threat modeling.

Input: the system architecture, code diff, or implementation plan — if none is given, ask which system or change to assess, and ask for more context if trust boundaries are not visible.

Boundary: Identifies vulnerabilities and threat vectors based on references; does not execute exploits, run security scanners, or fix the code.

Workflow

1. Identify Trust Boundaries

Map out where data crosses from an untrusted source (e.g., user input, external APIs, public network) into a trusted component (e.g., internal database, privileged service).

2. Threat Modeling (STRIDE)

Apply the STRIDE model against the identified trust boundaries. Use references/checklist.md as a guide.

3. Security Findings Report

Output a structured report of identified threats:

  • Threat Vector: The specific vulnerability or attack path.
  • Risk Level: Critical, High, Medium, or Low.
  • Description: How the exploit could occur.
  • Mitigation: Architectural or code-level changes required to secure the boundary.

Stay in lane; hand off at the boundary. This skill reports threats and proposed mitigations — it does not implement them. Hand off the mitigation work to plan-implementation (or plan-migration when the fix is a schema-level change), and line-level code-quality review of the resulting diff to static-review. Name the handoff rather than starting the fix yourself.

Bundled Resources

  • Read files in references/ for standard security checklists (e.g. checklist.md).

What ships with it: 2 files

1.5 KB alongside SKILL.md

references/

Gives 0 of the 12 instructions most threat modeling skills give

Counted across 325 of the 341 authors here whose files we hold, read 2026-09-06

  • Use parameterized queries for all database accessin 58 of 325, across 34 files
  • Validate all user input with schemasin 52 of 325, across 29 files
  • Store tokens in httpOnly cookiesin 50 of 325, across 27 files
  • Store secrets in environment variablesin 50 of 325, across 27 files
  • Sanitize user-provided HTML before renderingin 49 of 325, across 26 files
  • Apply rate limiting to all API endpointsin 48 of 325, across 25 files
  • Verify authorization before sensitive operationsin 47 of 325, across 24 files
  • Require CSRF tokens on state-changing operationsin 46 of 325, across 23 files
  • Return generic error messages to usersin 40 of 325, across 22 files
  • Restrict file uploads by size, type, and extensionin 38 of 325, across 20 files
  • Run npm audit and fix vulnerabilitiesin 28 of 325, across 16 files
  • Redact sensitive data from logsin 25 of 325, across 11 files

Said here and by no other author read

  • Ask which system or change to assess
  • Ask for more context if boundaries aren't visible
  • Use the bundled checklist as a guide
  • Hand off mitigation work to plan-implementation
  • Hand off schema fixes to plan-migration
  • Hand off diff review to static-review

Grouped from the skills themselves: near-identical wordings counted once, and counted by distinct author, so one author publishing three of these counts once.

Keep looking

Skills are one crate of 626,045. Ordering is by how many stacks a row turns up in, so the top of any crate is what has actually been picked rather than what has the most stars.