security-threat-model — Skills

What it does

Repo root path and any in-scope paths.

Intended usage, deployment model, internet exposure, and auth expectations (if known).

Any existing repository summary or architecture spec.

Use prompts in references/prompt-template.md to generate a repository summary.

Follow the required output contract in references/prompt-template.md. Use it verbatim when possible.

Identify primary components, data stores, and external integrations from the repo summary.

Identify how the system runs (server, CLI, library, worker) and its entrypoints.

security threat model

Source

Repository: https://github.com/openai/skills

security-threat-model FAQ

What does the security-threat-model skill do?

Repository-grounded threat modeling that enumerates trust boundaries, assets, attacker capabilities, abuse paths, and mitigations, and writes a concise Markdown threat model. Trigger only when the user explicitly asks to threat model a codebase or path, enumerate threats/abuse paths, or perform AppSec threat modeling. Do not trigger for general architecture summaries, code review, or non-security design work. Repo root path and any in-scope paths. Intended usage, deployment model, internet exposure, and auth expectations (if known).

What does security-threat-model require?

High: pre-auth RCE, auth bypass, cross-tenant access, sensitive data exfiltration, key or token theft, model or config integrity compromise, sandbox escape. Only load the reference files you need. Keep the final result concise, grounded, and reviewable.

How do I install security-threat-model?

Run: npx -y skills add https://github.com/openai/skills --skill security-threat-model --agent claude-code — the source lives at github.com/openai/skills.

Maintain security-threat-model?

Let people know it's listed here — add the badge (live metrics, light/dark aware) or a plain link to your README or docs.

[security-threat-model on getagentictools](https://getagentictools.com/skills/openai-skills-security-threat-model?ref=badge)

npx agentictools info skills/openai-skills-security-threat-model

The second line is the CLI lookup for this page — handy in READMEs and docs.