Security Threat Model

这个 Skill 可以做什么

• Frames assets, trust boundaries, attacker capabilities, abuse paths, and mitigations.
• Requires repository evidence instead of generic security checklists.
• Produces concise Markdown threat-model output for review.

最佳使用场景

• Threat modeling a repository before deployment.
• Documenting trust boundaries around auth, secrets, external APIs, or generated artifacts.
• Reviewing mitigations for realistic abuse paths.

不适合

• Replacing a formal security review for high-risk production systems.
• Creating generic security advice without repository evidence.
• Treating relationship or evidence metadata as proof that a system is secure.

输入

• Repository path, in-scope components, deployment model, exposure, and auth expectations.
• Existing architecture notes or evidence gathered from the repo.

输出

• Threat model with assets, trust boundaries, abuse paths, and mitigations.
• Explicit assumptions and out-of-scope items.
• Concrete follow-up checks for security review.

兼容性