threat-model SKILL.md skillA

threat-model from perrylink/dsh-skill-pack-security is an agent skill: a SKILL.md folder an AI agent loads when a task calls for it.

mdr add perrylink/dsh-skill-pack-security/threat-model@v2.2.25

Pins v2.2.25 in mdr.lock. Pin the fingerprint instead.

Audit grade

A, 17 of 17 checks passed

Kind

SKILL.md skill

Repository

perrylink/dsh-skill-pack-security

Path

skills-en/threat-model/SKILL.md

Versions recorded

13

Latest version

v2.2.25, committed Oct 31, 2026

First version recorded

Sep 7, 2026

Size

6,239 bytes

Repository stars

22

License

Apache-2.0

Lightweight threat modeling for new features/systems: fix the target, scope and trust boundaries, asset inventory, per-asset STRIDE table, optional attack tree, mitigations and priority — producing a threat-model document ready for design review. Use for design-stage security review of new features/changes, mapping trust boundaries, or drawing attack trees; not for unrelated pure bug fixes, and teams with an established modeling process need not run this flow.

Collected from public GitHub. Every version is saved exactly as it was and never changes. Install it at an exact version with the mdr tool, and every file is checked before it reaches your agent. The main file is checked against the SHA-256 fingerprint recorded here, and the others against the fingerprints GitHub keeps for its source commit. The automatic checks below grade the latest version, and the same checks always give the same file the same grade.

What the file says

# Threat modeling (threat-model)

This skill does **design-stage** lightweight threat modeling: for one change or one new component, it produces trust boundaries, a STRIDE threat table, and a mitigation list. It covers the modeling method only; tiering existing audit findings goes to `security-audit`, and looking up specific vulnerabilities goes to `vuln-intel`. The output carries no secrets and can go into design documents.

## 1. Fix the modeling target (an unfixed target makes the model unreproducible)

```sh
git rev-parse --show-toplevel
git log -1 --format='%H %cd' --date=iso-strict
```

Expected sample output (use the actual output):

```
D:\repo\example
a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0 2026-08-14T10:30:00+08:00
```

Criterion: exit code 0 and the first line is an absolute path; the threat-model document header must record this commit hash so reviewers know which version the model targets.

## 2. Scope: what changed, where the boundaries are

```sh
git diff --stat <base>...HEAD
git diff --name-only <base>...HEAD
```

Expected sample output: `src/auth/session.ts | 40 ++++`, followed by the changed file paths.
…

Read the whole file at its exact version.

How to install

mdr add perrylink/dsh-skill-pack-security/threat-model@sha256:fb44798c9ae91d33

[![mdr](https://markdownregistry.com/badge/art_iubrbqwfegjao24u.svg)](https://markdownregistry.com/a/art_iubrbqwfegjao24u)

Versions

The registry has recorded 13 versions of this file, between Sep 7, 2026 and Oct 31, 2026, about one every 5 days.

Audit of the latest version

Source

API

GET https://markdownregistry.com/api/v1/artifacts/art_iubrbqwfegjao24u
GET https://markdownregistry.com/api/v1/resolve?ref=perrylink/dsh-skill-pack-security/threat-model
GET https://markdownregistry.com/api/v1/blob/fb44798c9ae91d331f21b78dd036686ce03b90a52568b4c77bad7f9953b514a0

Your AI assistant does the legwork. You hear about the deals worth your word. Hand yours the standing instructions at modelranch.com and it joins the network that reads files like this one.

Guides: the SKILL.md format and its required fields · what to check before you install a skill · how to pin a skill to an exact version · where to find agent skills · keeping a team on the same skills · which agent file does what.

More from perrylink/dsh-skill-pack-security

Every file in perrylink/dsh-skill-pack-security

Other files named threat-model

Browse by kind, by grade A, or by owner.