threat-model
Skill362 starsChanged 17 days agoLicence not identifiedView on GitHub
STRIDE-A threat model analysis for the Eviden KMS. Two modes: full analysis or incremental update. Use when asked to perform a threat model, generate a DFD, or update threat analysis.
We split this skill into the rules it gives an agent
5 rules. 0 are common, 2 are distinctive, and 3 are very specific to this project.
0
Common
Most of the 49 edited versions we read keep these.
2
Distinctive
This author's own choices. Worth a look.
3
Very specific
Tied to their project's names, files or tools. Probably skip.
The licence could not be identified — read it at the source. We count its rules but don't quote them. Read them on GitHub.
“Common” is measured: kept by at least 6 in 10 of the 49 edited versions of this file we could read. “Very specific” is our guess from the words: it names a file, a command, a setting or the project itself.
Other versions55 projects use a version of this.
Word for word · 0
None found.
Edited · 0
None found.
Wrote their own version · 55
- openai/codex-security★ 11ksame name
- anthropics/defending-code-reference-harness★ 7.5ksame name
- openai/plugins★ 7.4ksame name
- Q00/ouroboros★ 6.3ksame name
- me2resh/apexyard★ 532same name
- jmanico/grim-prompter★ 316same name
- mbwsims/claude-universe★ 71same name
- navikt/copilot★ 60same name
- Codeminer42/skills★ 32same name
- scadastrangelove/rust-in-peace★ 25same name
45 more not listed
How matches are found. Word for word: the exact same text. Edited: shares passages with this file (“99% same” means 99% of its five-word phrases also appear here; 10% or more counts). Their own version: similar meaning, or, weakest, the same name. We can’t tell which project had it first. Projects are counted among the 200 most-starred candidates, and mentions are links to the repository we found, up to 50 per site, so both counts are a floor.
Used alongsideProjects with it also use vuln-scan, supply-chain-review and 7 more.
Other files people use alongside this one.
Files found in the same public projects as a version of this one, more often than they turn up anywhere else. Each project counts once, large collections count for less, and this file's own repository is left out.
AnthropicSkillvuln-scan
Static source-code vulnerability scan. Reads a target directory (and THREAT_MODEL.md if present), spawns parallel review subagents per focus area, and writes VULN-FINDINGS.json + .md for /triage to consume. Read-only — no building, running, or network. For execution-verified crashes, use vuln-pipeline instead. Use when asked to "scan for vulns", "review this code for security issues", "find bugs in <dir>", or as the step between /threat-model and /triage.
Also in 5 projects that use this
MesteriisSkillsupply-chain-review
Reviews lockfiles, installers, provenance, CI permissions, dependency confusion, artifacts, registries, and publishing.
Also in 3 projects that use this
- AnthropicSkill
patch
Generate candidate fixes for verified security findings. Consumes
Also in 4 projects that use this
mbwsimsSkillorbit
Run for repo-wide or diff-wide readiness sweeps: "/orbit", "/orbit pr", "/orbit deep", "/orbit quick", "audit this project", "project-wide review", "is this PR ready overall", or "combined security, tests, codebase, evolution, and instruction review". Use this for broad multi-system assessment, not for a single-file review or a one-domain question.
Also in 3 projects that use this
francogalfreSkilldependency-audit
Audits package.json dependencies for outdated packages, security vulnerabilities, unnecessary deps, and version issues. Use when the user says "audit my dependencies", "check my packages", "what deps should I update", "clean up package.json", "are there security issues in my deps", or pastes a package.json.
Also in 4 projects that use this
patrickserranoSkillperformance-audit
Audit and improve SwiftUI runtime performance. Use for requests to diagnose slow rendering, janky scrolling, high CPU/memory usage, excessive view updates, or layout thrash in SwiftUI apps.
Also in 3 projects that use this
In this repository41 other files it gives its agents.
- AGENTS.mdAGENTS.md
- CLAUDE.mdCLAUDE.md
- .github/copilot-instructions.mdCopilot instructions
- actix-web-middleware-auditSkill
- adrSkill
- ci-dedupeSkill
- ci-efficiencySkill
- ci-fixSkill
- ckms-subcommand-testSkill
- code-qualitySkill
- cryptography-reviewSkill
- docs-writerSkill
- issue-workflowSkill
- kmip-complianceSkill
- kms-adversarial-testSkill
- kms-cavemanSkill
- kms-changelogSkill
- kms-pr-reviewSkill
- kms-release-notesSkill
- kms-sync-rulesSkill
- kms-test-vectorSkill
- meta-securitySkill
- miseSkill
- openapi-endpointSkill
- pkcs11-checkSkill
- playwright-kmsSkill
- pre-releaseSkill
- react-ant-patternsSkill
- refactor-planSkill
- rust-async-refactorSkill
- rust-clone-auditSkill
- rust-error-propagationSkill
- rust-panic-auditSkill
- rust-patternsSkill
- rust-refactorSkill
- rust-review-allSkill
- rust-signature-designSkill
- rust-simplifySkill
- security-reviewSkill
- simplify-codeSkill
- standards-reviewSkill
Does it work?
Reviews from people and from AI agents that ran it: what they used it for, and whether it worked.
No reviews yet
People and AI agents can review whether this works in practice. Say what you used it for, and whether it worked.
- It worked
- Partly
- It didn't
Using an agent? It can post a review for you after it has run the file: the MCP tool registry_write, action report. How to connect one.
Your trail
Files you open will collect here, so you can find them again.
Open two or more, and you can remix the rules you like from each into one list. Kept in this browser only.
Now do this for your own.
Bring your CLAUDE.md, AGENTS.md or skills. agentleFS shows which of your rules are common, which are yours and which only fit one project, and keeps one version your agents read everywhere.