Threat Model Generator plugin
Skills that write a threat model for an open-source project: what it promises and disclaims. A contract document, not a scanner
- 61 ★ on the repository
- Last commit
- MIT
Minimal access
Why this level
- The skills read project code and docs and write a text threat model without running a scan.
Install
- Works in
In your terminal, with SkillFoxx CLI
npx skillfoxx add plugins/threat-model-generatorDetects the agents on your machine, shows the access level and pins the version.
Other ways to install
Access and checks
How we reviewMinimal accessThe tool runs nothing and makes no network calls.
- The skills read project code and docs and write a text threat model without running a scan.
This is third-party code. Review the repository files before installing.
What it does
`Threat Model Generator` is a set of skills for writing a threat model of an open-source project: a `threat-model` orchestrator and independent specialists (recon, interview, attack surface, authoring, sidecar, backtest, triage). The output is a document on the implicit security contract between a project and its users: what it assumes about its environment and inputs, which properties it claims, which it disclaims and what is left to the integrator. The document serves two readers: an integrator deciding what they are now responsible for, and a maintainer deciding whether an inbound vulnerability report fits the model. By default the skill works draft-first: each claim is tagged documented, maintainer or inferred, and open questions for maintainers live inside the model.
Who it is for. Open-source maintainers and vulnerability report triagers who need a written agreement on security boundaries.
Good fit when
- A `SECURITY.md` section is drafted on what the threat model covers
- An inbound vulnerability report is matched to the model: in scope, out of model or by design
- An integrator wants to know which threats they own when adopting the project
- The model is backtested on past reports with `threat-model-backtest`
Not a fit when
- You need vulnerability hunting in code, since the project is not a scanner or audit
- The project has no code or docs to infer from
- A formal security certification is required
Example request
Produce a draft threat model for this project, tag each claim and collect questions for the maintainers.Limitations
The result holds no findings: it is a document of assumptions and boundaries, not a list of vulnerabilities. Claims marked inferred stay hypotheses until maintainers answer a wave of questions inside the model. Specialists share references from `threat-model/references/` through relative paths, so keep the skill folders as siblings. For batch work in CI `new_threat_model.py` clones a target repository and installs the skills into its checkout. Other agents get the skills by copying the directory.
How to disable. In Claude Code run `/plugin uninstall threat-model`. Copies of the skills in `.claude/skills/` and finished threat models are removed separately.
FAQ
How do I install it?
In Claude Code: `/plugin marketplace add alpha-omega-security/threat-model`, then `/plugin install threat-model@threat-model`. For other agents copy the `skills/` directory.
What is the output?
A document about the security contract: assumptions, claimed and disclaimed properties and threats left to the integrator. Open questions sit in section 1.18 of the model itself.
Does it find vulnerabilities?
No, it produces no findings. It is a tool for responsibility boundaries and for triaging inbound reports.
Can a specialist be called alone?
Yes, each skill stands alone, for example `threat-model-triage` for report assessment or `threat-model-recon` for code reconnaissance.
Where should a newcomer start?
Open the glossary `skills/threat-model/references/glossary.md`, which explains terms such as disclaimed property and sink in plain language.
Discussion
No questions or reviews yet.
Related
PluginsA threat modeling skill: the agent reads the project code and builds a threat model with file and line citations
A CLI that reads a project's code and builds a STRIDE threat model, with a report in Markdown, JSON, SARIF or HTML
An AWS Labs MCP server that guides the agent through phased STRIDE threat modeling, from context to mitigations and code checks.
A Claude Code skill that finds vulnerabilities in one session: threat model, verified findings, CWE and CVSS report.
VibeSec
VibeSec-Skill
A secure coding skill: the agent looks at code from a bug hunter's perspective and prevents common web vulnerabilities
A security scanner for agent skills: finds prompt injection, data exfiltration and malicious code before you install
README in short
The README states the document's purpose, install, orchestrator and specialist calls, draft-first mode with questions to maintainers and a batch CI run. A glossary sits alongside for first-timers.