Security Threat Model

What this Skill can do

• Frames assets, trust boundaries, attacker capabilities, abuse paths, and mitigations.
• Requires repository evidence instead of generic security checklists.
• Produces concise Markdown threat-model output for review.

Best use cases

• Threat modeling a repository before deployment.
• Documenting trust boundaries around auth, secrets, external APIs, or generated artifacts.
• Reviewing mitigations for realistic abuse paths.

Not suitable for

• Replacing a formal security review for high-risk production systems.
• Creating generic security advice without repository evidence.
• Treating relationship or evidence metadata as proof that a system is secure.

Inputs

• Repository path, in-scope components, deployment model, exposure, and auth expectations.
• Existing architecture notes or evidence gathered from the repo.

Outputs

• Threat model with assets, trust boundaries, abuse paths, and mitigations.
• Explicit assumptions and out-of-scope items.
• Concrete follow-up checks for security review.

Compatibility