fmway-threat-model
Pass
Audited by Gen Agent Trust Hub on Sep 4, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes standard Git commands (
git switch,git pull,git worktree add) to create isolated environments for threat modeling tasks. These commands are restricted to the local repository and follow standard development workflows. - [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted inputs from project documentation, PRDs, and source code diffs to identify security threats. While this ingestion represents a theoretical attack surface, the risk is mitigated by explicit 'Gate' requirements that pause execution for human verification of the scope and the final report.
- [DATA_EXPOSURE]: Instructions include the identification of sensitive assets such as credentials and personal data. This is a legitimate and necessary component of the STRIDE threat modeling process to ensure these assets are properly protected in the target system's design.
- [SAFE]: The skill references a suite of internal developer tools (e.g.,
fmway-pr,fmway-dev) and follows best practices for secret management by advising against assuming mitigations are in place without verification.
Audit Metadata