AymanShams·AymanShams/codex-coding-os/.agents/skills/security-threat-model/SKILL.md

security-threat-model

Skill1 starsChanged 2 months agoMPL-2.0View on GitHub

Use when the user asks to threat model a repository, codebase, service, app, component, path, feature, or architecture from an AppSec perspective. Use for repository-grounded threat models that enumerate assets, trust boundaries, entry points, attacker capabilities, abuse paths, mitigations, likelihood, impact, assumptions, and a concise Markdown threat model. Use for prompts like threat model this repo, enumerate abuse paths, identify trust boundaries, model attacker goals, or produce an AppSec threat model. Do not use for general architecture summaries, normal code review, non-security design work, generic security best-practice advice, live incident response, source verification, or ownership/bus-factor analysis. If the primary task is secure coding best practices or a vulnerability report, use security-best-practices. If the primary task is security ownership from git history, use security-ownership-map. If the primary task is an active security or data incident, use crisis-command-center.