threat-model
Threat model
Writes docs/threat-model.md: one document that says what the system protects, who it protects it from, where its trust boundaries run, and which threats are known. Then it wires the document into the agent instructions so it stays in use.
A threat model is not an audit. An audit goes stale on the next pull request and nobody can cite it. This one lives in the repository, gives every threat an ID that never changes, and is updated by the pull requests that change the system.
An agent doesn't know where a system's trust boundaries are. It treats a database row as truth even when a system the team doesn't control wrote it, and it "simplifies" a check without knowing which threat the check exists for. The model gives people and agents the same map.
What this skill does not do
- It fixes nothing. Each fix ships in its own pull request, later, reviewed like any change.
- It accepts nothing. Living with a threat is a business decision. Only people make it, in an ADR.
- It doesn't attack anything. It reads code and configuration. It never sends requests to a deployed environment, production or otherwise.
- It doesn't commit.