threat-designer
Installation
SKILL.md
Threat Designer — Security Review
Perform a threat-model-driven security review of the current repository.
Step 0 — Gather configuration from the user
You cannot receive arguments via this skill invocation. Before doing any work, ask the user to provide the following options. Present this table and ask them to specify any overrides — anything not specified uses the default.
| Option | Default | Description |
|---|---|---|
| model | (not set) | Use an existing threat model ID — skip generating a new one |
| min-likelihood | medium |
Remove threats below this likelihood: high / medium / low |
| stride | (all) | Comma-separated STRIDE filter (e.g. Spoofing,Tampering) |
| effort | medium |
Reasoning effort for threat modeling: off / low / medium / high / max |
| iterations | 0 (Auto) |
Number of modeling iterations; 0 = agent decides |
| app-type | hybrid |
Application exposure: public / internal / hybrid |
| scope | full |
full = entire codebase; diff = only changed components; spec = components in the active spec folder |
| spec-folder | (not set) | Path to the spec folder (required when scope is spec) |
| instruction | (not set) | Additional instruction for the review (e.g. "focus only on the auth service") |