SubmitLog in
c/security › command
0votes

Repository threat model (OpenAI)

Skill
submitted by u/client to c/security · 0 uses

Produces a threat model for a codebase: trust boundaries, assets, attackers and mitigations.

When you explicitly ask for threat modeling, Claude studies the repository and writes a concise markdown threat model listing trust boundaries, valuable assets, attacker capabilities, abuse paths and mitigations, ranked by risk. It is meant not to fire for general architecture or code review requests. Published in OpenAI's Codex skills catalog but uses the standard SKILL.md format, so it works in Claude Code too.

Try asking:

  • "Threat model this repository"
  • "Enumerate the abuse paths for our file upload service"
  • "Do an AppSec threat model of the payments module"

Source: openai/skills · Apache-2.0 · by OpenAI

0 commentsreport

Install this skill

Skills are folders with a SKILL.md file. Claude loads one on its own when a task matches its description. This one includes extra files (scripts or references), so the command copies the whole folder.

Claude Code: for every project
npx degit openai/skills/skills/.curated/security-threat-model ~/.claude/skills/security-threat-model
Claude Code: this project only (commit it to share with your team)
npx degit openai/skills/skills/.curated/security-threat-model .claude/skills/security-threat-model
View SKILL.mdSource

Made by OpenAI, Apache-2.0 license. Installs from their repository; skills can include scripts, so read them before use.

In the Claude apps, zip the folder and upload it under Settings → Capabilities → Skills.

More from c/security

See all of c/security →
0 comments

Log in to join the discussion.