Preface¶
When conducting application security work, threat modeling often gets stuck at two ends: on one hand, architecture diagrams and checklists are too vague, and the final output does not align with the actual code; on the other hand, manually sifting through the repository is too slow, and it is difficult to align trust boundaries, attack surfaces, and mitigation measures in one go. After shifting security left, teams increasingly hope to obtain a threat model tied to the current repository during design reviews and pre-release checks, rather than filling out a generic template after the fact.
security-threat-model is exactly the Agent Skill built for this purpose. It requires the Agent to trigger only when you explicitly mention threat modeling, abuse path enumeration, or AppSec threat modeling. It will list trust boundaries, assets, attacker capabilities, abuse paths, and mitigation measures based on repository evidence, and output a reviewable Markdown report. This article explains what it is, how to install it, and how to use it, based on the official SKILL.md and reference templates.
What Is It¶
security-threat-model comes from OpenAI’s curated Agent Skills catalog (openai/skills), and is positioned as a repository-grounded threat modeling workflow: it produces threat models available for AppSec use targeting a specified repository or subpath, rather than a generic vulnerability list.
Trail of Bits offers a Claude Code plugin version of the same capability in its curated skills marketplace (openai-security-threat-model), whose documentation states that the content is sourced from OpenAI’s curated catalog and converted to the Claude Code plugin format. These Skills follow the universal SKILL.md format and can be installed and used in tools that support the open Agent Skills standard, such as Codex, Cursor, and Claude Code.
The core problem it solves is very specific: turning threat modeling from “writing checklists based on experience” into a standardized workflow:
1. Extract the system model from code and documentation
2. Mark boundaries and assets
3. Generate prioritizable abuse paths
4. Provide mitigation suggestions with supporting evidence
Core Features and Highlights¶
According to the official SKILL.md, the workflow is roughly divided into the following steps:
-
Scope and System Model
Identify main components, data storage, external integrations, and entry points; distinguish runtime behavior from CI/build/development tools, tests, and examples; no unsubstantiated components, data flows, or control measures should be included. -
Trust Boundaries, Assets, and Entry Points
Document trust boundaries as specific edges between components (including protocols, authentication, encryption, validation, rate limiting, etc.); cover assets such as data, credentials, models, configurations, computing power, audit logs, etc.; entry points include interfaces, upload surfaces, parsers, task triggers, management tools, log/error exits, etc. -
Attacker Capability Calibration
Describe what attackers can do based on the actual attack surface and usage scenarios, and explicitly state what they cannot do, to avoid overstating the severity level. -
Abuse Paths and Prioritization
Frame threats as attacker-governed paths (such as theft, privilege escalation, integrity damage, denial of service), assign priorities using qualitative likelihood and impact (low/medium/high), and explain which assumptions would significantly alter the ranking. -
Validate Assumptions with Users
Before finalizing the formal report, summarize key assumptions and raise 1 to 3 targeted questions (about deployment method, attack surface, authentication, data sensitivity, multi-tenancy, etc.); even if the user cannot answer, retain the assumptions and their impact on prioritization in the final report. -
Mitigation Measures and Quality Checks
Distinguish between “existing mitigations in the repository (requires evidence)” and “recommended new mitigations”, and tie them to specific components, boundaries, or entry points; before finalizing the draft, confirm that all entry points and boundaries are covered, runtime and CI environments are separated, and assumptions and open issues are clearly documented.
The report format is specified in references/prompt-template.md, and common sections include: executive summary, scope and assumptions, system model (including Mermaid flowcharts), asset table, attacker model, attack surface, Top abuse paths, threat model table (in the form of TM-001, etc.), severity rating, focus paths for follow-up manual reviews, etc. The final Markdown file is conventionally named <repository or directory name>-threat-model.md.
There is also an optional reference references/security-controls-and-assets.md to unify the terminology for asset categories and control categories, avoiding inconsistent wording across different reports.
Installation and Activation¶
The instructions below are provided for common tools, assuming the official catalog is still accessible. The README of OpenAI’s openai/skills repository has been marked as deprecated and points to a new Plugins repository, but this curated Skill catalog and its SKILL.md are still directly readable for now. If you mainly use Claude Code, you can also directly install the Trail of Bits plugin conversion version.
Codex¶
You can use the built-in $skill-installer to install by name:
$skill-installer security-threat-model
Alternatively, use the GitHub directory URL:
$skill-installer install https://github.com/openai/skills/tree/main/skills/.curated/security-threat-model
If it is not automatically detected after installation, restart Codex. You can call it using $security-threat-model, or directly use natural language to request threat modeling for a specific repository (needs to match the Skill’s trigger description).
The default prompt provided by the official for this Skill (agents/openai.yaml) is:
Create a repository-grounded threat model for this codebase with prioritized abuse paths and mitigations.
Cursor¶
Place the entire security-threat-model directory in the project or user-level Skills path, for example:
mkdir -p .cursor/skills/security-threat-model
# Place SKILL.md, references/, agents/ and other files into this directory
Cursor will scan .cursor/skills/, .agents/skills/, the user-level paths ~/.cursor/skills/ and ~/.agents/skills/; it also reads paths like .claude/skills/ and .codex/skills/ for compatibility. Type / in the Agent chat and search for security-threat-model to call it explicitly.
Claude Code (Trail of Bits Plugin)¶
The installation method given in Trail of Bits documentation:
/plugin install trailofbits/skills-curated/plugins/openai-security-threat-model
You can also manually copy the official Skill directory to ~/.claude/skills/security-threat-model/ (personal use) or .claude/skills/security-threat-model/ in the project (shared with the repository).
Typical Usage Examples¶
The official emphasizes: Only trigger the Skill when you explicitly request threat modeling, threat/abuse path enumeration, or AppSec threat modeling; do not treat it as a default process for general architecture summarization or code review.
A reusable prompt example is as follows (fill in the context as needed):
Please use security-threat-model to perform threat modeling on the current repository.
Scope:
- Repository root: .
- Key paths: app/、services/api/
Known context (mark unknown items as assumptions):
- intended_usage: Internal API service
- deployment_model: Kubernetes, multiple replicas
- internet_exposure: Exposed to the internet only via API Gateway
- authn_authz_expectations: OIDC + server-side RBAC
- data_sensitivity: Contains user PII
- out_of_scope: Third-party payment SDK source code
Please first list the key assumptions and raise clarification questions as required by the Skill;
I will confirm before outputting the final <repo>-threat-model.md.
If you do not already have a repository-level security summary, the Skill will first guide you to generate a security-focused repository summary using the “Repository summary prompt” in references/prompt-template.md, before proceeding to threat modeling. The output should尽量 follow the section order and table fields in the template (threat ID, likelihood, impact, priority, evidence path, etc.).
Applicable Scenarios and Notes¶
It is suitable for these scenarios:
- Requiring a first draft of a threat model tied to the current code before release or design reviews
- Conducting focused reviews on a specific service/subdirectory, first sorting out abuse paths and key files for manual review
- Needing a unified report structure and evidence anchor points when AppSec engineers collaborate with R&D teams
Please note the following when using it:
1. Evidence first: Architectural assertions without supporting repository paths, symbols, or configuration should not be treated as confirmed facts.
2. Clarify before finalization: The Skill requires a pause before finalizing the report to wait for your confirmation on deployment, attack surface, authentication and other context.
3. Narrow the trigger surface intentionally: It will not automatically run threat modeling just because you are having architecture discussions, to avoid occupying context with irrelevant security processes.
4. Output is auxiliary material: The report is intended to be readable and reviewable by AppSec engineers, and cannot replace formal penetration testing or compliance audit conclusions.
5. Key hygiene: The template clearly requires that tokens/keys should be desensitized, only describing their existence and location, and never writing secrets into the report.
Summary¶
security-threat-model packages threat modeling into a reusable Agent workflow: extracting the system model from the repository, marking trust boundaries and assets, generating prioritized abuse paths, providing mitigation suggestions tied to specific code locations, and standardizing the output structure. OpenAI’s curated catalog provides the original Skill; Trail of Bits has included it in its curated plugin marketplace for one-click installation in Claude Code.
Official address:
https://github.com/openai/skills/tree/main/skills/.curated/security-threat-model
Trail of Bits plugin version:
https://github.com/trailofbits/skills-curated/tree/main/plugins/openai-security-threat-model