Assess threats
Portable, single-purpose skills for coding agents that orient, map, plan, review, and reason over your code — read / plan / report, never editing behind your back.
npx -y skills add tacticaldoll/fornax --skill assess-threatsAssembled from the repository path, not quoted from the project. Check it against their README if it does not work.
2 things to look at
- 19 days oldThe repository was created 19 days ago. New is not bad, but a brand new repository carrying a familiar-sounding name is the shape a typosquat arrives in, and there has been no time for anyone else to find a problem with it.
- 0 stars0 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.
What its author says it does
Copied from the file, not written here
Use when an agent needs to identify trust boundaries and architectural threat vectors in a system design or a change's attack surface; maps the boundaries, applies STRIDE, and rates threats by risk rather than executing exploits or patching code.
SKILL.md
2.2 KB, as published. Nobody here has run it
Assess Threats
Use this skill to screen each trust boundary against the STRIDE panel of threat vectors: take the boundaries one at a time and run every category (Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, Elevation of Privilege) across each, so the combinations that expose an attack path become findings while the boundaries that clear the whole panel need no report. In plain terms, stress-test the architecture when the user asks for a security review or threat modeling.
Input: the system architecture, code diff, or implementation plan — ask the user for context if trust boundaries are not visible.
Boundary: Identifies vulnerabilities and threat vectors based on references; does not execute exploits, run security scanners, or fix the code.
Workflow
1. Identify Trust Boundaries
Map out where data crosses from an untrusted source (e.g., user input, external APIs, public network) into a trusted component (e.g., internal database, privileged service).
2. Threat Modeling (STRIDE)
Apply the STRIDE model against the identified trust boundaries. Use references/checklist.md as a guide.
3. Security Findings Report
Output a structured report of identified threats:
- Threat Vector: The specific vulnerability or attack path.
- Risk Level: Critical, High, Medium, or Low.
- Description: How the exploit could occur.
- Mitigation: Architectural or code-level changes required to secure the boundary.
Stay in lane; hand off at the boundary. This skill reports threats and proposed mitigations — it does not implement them. Hand off the mitigation work to plan-implementation (or plan-migration when the fix is a schema-level change), and line-level code-quality review of the resulting diff to static-review. Name the handoff rather than starting the fix yourself.
Bundled Resources
- Read files in
references/for standard security checklists (e.g.checklist.md).