The Agent Skills Directory

[NO_CODE]: The skill consists entirely of instructional markdown and a YAML frontmatter configuration. It does not include any scripts (Python, Node.js, Shell) or binary executables.
[SAFE]: The instructions describe a methodology for analysis (threat modeling) and do not contain any prompt injection patterns, data exfiltration attempts, or obfuscation.
[INDIRECT_PROMPT_INJECTION]: The skill defines a surface for processing user-supplied strategies or decisions for analysis. However, it lacks any high-risk capabilities (like file writing or arbitrary command execution) that could be exploited via indirect injection. The severity is low as it is a standard analytical framework.

thinking-threatmodel