Skill · em Proteger

security-threat-model

Repository-grounded threat modeling that enumerates trust boundaries, assets, attacker capabilities, abuse paths, and mitigations, and writes a concise Markdown threat model. Trigger only when the user explicitly asks to threat model a codebase or path, enumerate threats/abuse paths, or perform…

Procedência

Antes de instalar

5 arquivos · 30,2 KB · só texto, nenhum script

Instalar na sua CLI

O comando baixa a versão fixada (commit 57f899e) direto da origem, para a pasta que a CLI lê. Precisa de curl (macOS e Linux); no Windows não há comando, porque o Rook Labs é para macOS.

Claude Code

Neste projeto: instala em .claude/skills/security-threat-model/.

d=".claude/skills/security-threat-model"
u="https://raw.githubusercontent.com/davila7/claude-code-templates/57f899e5394bb8ca166f38eacae8f0853cbfe033/cli-tool/components/skills/security/security-threat-model"
curl -fsSL --create-dirs \
  -o "$d/SKILL.md" "$u/SKILL.md" \
  -o "$d/agents/openai.yaml" "$u/agents/openai.yaml" \
  -o "$d/LICENSE.txt" "$u/LICENSE.txt" \
  -o "$d/references/prompt-template.md" "$u/references/prompt-template.md" \
  -o "$d/references/security-controls-and-assets.md" "$u/references/security-controls-and-assets.md"

Global: instala em ~/.claude/skills/security-threat-model/.

d="$HOME/.claude/skills/security-threat-model"
u="https://raw.githubusercontent.com/davila7/claude-code-templates/57f899e5394bb8ca166f38eacae8f0853cbfe033/cli-tool/components/skills/security/security-threat-model"
curl -fsSL --create-dirs \
  -o "$d/SKILL.md" "$u/SKILL.md" \
  -o "$d/agents/openai.yaml" "$u/agents/openai.yaml" \
  -o "$d/LICENSE.txt" "$u/LICENSE.txt" \
  -o "$d/references/prompt-template.md" "$u/references/prompt-template.md" \
  -o "$d/references/security-controls-and-assets.md" "$u/references/security-controls-and-assets.md"

Codex

Neste projeto: instala em .agents/skills/security-threat-model/.

d=".agents/skills/security-threat-model"
u="https://raw.githubusercontent.com/davila7/claude-code-templates/57f899e5394bb8ca166f38eacae8f0853cbfe033/cli-tool/components/skills/security/security-threat-model"
curl -fsSL --create-dirs \
  -o "$d/SKILL.md" "$u/SKILL.md" \
  -o "$d/agents/openai.yaml" "$u/agents/openai.yaml" \
  -o "$d/LICENSE.txt" "$u/LICENSE.txt" \
  -o "$d/references/prompt-template.md" "$u/references/prompt-template.md" \
  -o "$d/references/security-controls-and-assets.md" "$u/references/security-controls-and-assets.md"

Global: instala em ~/.agents/skills/security-threat-model/.

d="$HOME/.agents/skills/security-threat-model"
u="https://raw.githubusercontent.com/davila7/claude-code-templates/57f899e5394bb8ca166f38eacae8f0853cbfe033/cli-tool/components/skills/security/security-threat-model"
curl -fsSL --create-dirs \
  -o "$d/SKILL.md" "$u/SKILL.md" \
  -o "$d/agents/openai.yaml" "$u/agents/openai.yaml" \
  -o "$d/LICENSE.txt" "$u/LICENSE.txt" \
  -o "$d/references/prompt-template.md" "$u/references/prompt-template.md" \
  -o "$d/references/security-controls-and-assets.md" "$u/references/security-controls-and-assets.md"

Antigravity

Neste projeto: instala em .agents/skills/security-threat-model/.

d=".agents/skills/security-threat-model"
u="https://raw.githubusercontent.com/davila7/claude-code-templates/57f899e5394bb8ca166f38eacae8f0853cbfe033/cli-tool/components/skills/security/security-threat-model"
curl -fsSL --create-dirs \
  -o "$d/SKILL.md" "$u/SKILL.md" \
  -o "$d/agents/openai.yaml" "$u/agents/openai.yaml" \
  -o "$d/LICENSE.txt" "$u/LICENSE.txt" \
  -o "$d/references/prompt-template.md" "$u/references/prompt-template.md" \
  -o "$d/references/security-controls-and-assets.md" "$u/references/security-controls-and-assets.md"

Global: instala em ~/.gemini/antigravity-cli/skills/security-threat-model/.

d="$HOME/.gemini/antigravity-cli/skills/security-threat-model"
u="https://raw.githubusercontent.com/davila7/claude-code-templates/57f899e5394bb8ca166f38eacae8f0853cbfe033/cli-tool/components/skills/security/security-threat-model"
curl -fsSL --create-dirs \
  -o "$d/SKILL.md" "$u/SKILL.md" \
  -o "$d/agents/openai.yaml" "$u/agents/openai.yaml" \
  -o "$d/LICENSE.txt" "$u/LICENSE.txt" \
  -o "$d/references/prompt-template.md" "$u/references/prompt-template.md" \
  -o "$d/references/security-controls-and-assets.md" "$u/references/security-controls-and-assets.md"

Peça ao Rook

Já usa o Rook Labs? Cole no chat do Rook: instale a skill https://rooklabs.sh/marketplace/cct.security-threat-model

Prévia do SKILL.md

---
name: "security-threat-model"
description: "Repository-grounded threat modeling that enumerates trust boundaries, assets, attacker capabilities, abuse paths, and mitigations, and writes a concise Markdown threat model. Trigger only when the user explicitly asks to threat model a codebase or path, enumerate threats/abuse paths, or perform AppSec thr…
author: openai
---

# Threat Model Source Code Repo

Deliver an actionable AppSec-grade threat model that is specific to the repository or a project path, not a generic checklist. Anchor every architectural claim to evidence in the repo and keep assumptions explicit. Prioritizing realistic attacker goals and concrete impacts over generic checklists.

## Quick start

1) Collect (or infer) inputs:
- Repo root path and any in-scope paths.
- Intended usage, deployment model, internet exposure, and auth expectations (if known).
- Any existing repository summary or architecture spec.
- Use prompts in `references/prompt-template.md` to generate a repository summary.
- Follow the required output contract in `references/prompt-template.md`. Use it verbatim when possible.

## Workflow

### 1) Scope and extract the system model
- Identify primary components, data stores, and external integrations from the repo summary.
- Identify how the system runs (server, CLI, library, worker) and its entrypoints.
- Separate runtime behavior from CI/build/dev tooling and from tests/examples.
- Map the in-scope locations to those components and exclude out-of-scope items explicitly.
- Do not claim components, flows, or controls without evidence.

### 2) Derive boundaries, assets, and entry points
- Enumerate trust boundaries as concrete edges between components, noting protocol, auth, encryption, validation, and rate limiting.
- List assets that drive risk (data, credentials, models, config, compute resources, audit logs).
- Identify entry points (endpoints, upload surfaces, parsers/decoders, job triggers, admin tooling, logging/error sinks).

### 3) Calibrate assets and attacker capabilities
- List the assets that drive risk (credentials, PII, integrity-critical state, availability-critical components, build artifacts).
- Describe realistic attacker capabilities based on exposure and intended usage.
- Explicitly note non-capabilities to avoid inflated severity.


### 4) Enumerate threats as abuse paths
…

Ver todo o marketplace