Identifies what could go wrong in a system before it is built or changed — the assets worth attacking, the entry points, the trust boundaries, and the controls that actually address the realistic threats. Use this when designing a feature or system, when a change touches authentication, data handling, payments, or external input, before a security review, or when deciding which security work is worth doing at all.
Collected from public GitHub. Every version is saved exactly as it was and never changes. Install it at an exact version with the mdr tool, and every file is checked before it reaches your agent. The main file is checked against the SHA-256 fingerprint recorded here, and the others against the fingerprints GitHub keeps for its source commit. The automatic checks below grade the latest version, and the same checks always give the same file the same grade.
What the file says
# Threat modeling
Done at design time this is cheap and changes the design. Done after launch it produces a list of
things that are expensive to fix, so the timing is most of the value.
## Four questions, in order
**1. What are we building?** A diagram of the actual data flow — not the org chart, not the
marketing architecture. Components, the data moving between them, and where each store lives. If
nobody can draw it, that is the first finding.
Mark the **trust boundaries**: every point where data crosses from something you control to
something you do not, or from one privilege level to another. Almost every real vulnerability lives
on a boundary.
**2. What can go wrong?** Walk each boundary and each asset. A usable prompt set:
- **Spoofing** — can someone claim to be another user, service, or system?
- **Tampering** — can data be modified in transit, at rest, or in the client?
- **Repudiation** — can someone deny an action, and would we be able to show otherwise?
- **Information disclosure** — what leaks: to other users, to logs, to error messages, to the
client bundle?
- **Denial of service** — what is unbounded? Uploads, queries, retries, fan-out.
…
The line at the top of this page pins the label git:20260916.0e7cd01, which is what most people want. This one pins the sha256 fingerprint of the contents instead, so it survives a label being moved. Either way the exact version is written to mdr.lock, and mdr install downloads and checks those contents again, so it installs them exactly or stops with an error.
A 17 of 17 checks passed. Fixed automatic checks with no AI involved, so the same checks give the same answer every run.
pass: Frontmatter block present
pass: Frontmatter declares a name
pass: Frontmatter declares a description
pass: Size between 200 bytes and 200 KB (3383 bytes)
pass: No zero-width or bidi control characters
pass: No instruction hidden inside an HTML comment
pass: No link to an exfiltration or paste host
pass: No credential-shaped string
pass: No instruction to send local credentials anywhere
pass: No text hidden with inline styles
pass: No prompt-injection phrasing
pass: No curl or wget piped into a shell
pass: No recursive delete of root, home or parent
pass: No instruction to read or print local credentials
pass: No base64 blob over 200 characters
pass: No link to a raw IP address
pass: No script tag
Source
GitHub
cbrock84/headcount · 2,076 stars · license MIT · pushed 2026-10-18 · branch main
API
GET https://markdownregistry.com/api/v1/artifacts/art_mctvm2wl4rkybrft
GET https://markdownregistry.com/api/v1/resolve?ref=cbrock84/headcount/threat-modeling
GET https://markdownregistry.com/api/v1/blob/cfd3dcfb8195b4ae817ac7ba717b27bc627d628f3296c7bf33e79c05470bcffe
Your AI assistant does the legwork. You hear about the deals worth your word. Hand yours the standing instructions at modelranch.com and it joins the network that reads files like this one.
cbrock84/headcount · plugins/corporate-strategy/skills/chief-strategy-officer/SKILL.md · Owns where the business plays and how it wins over a multi-year horizon — portfolio choices, corporate development…
cbrock84/headcount · plugins/corporate-strategy/skills/market-entry/SKILL.md · Decides whether and how to enter a new market — sizing demand from the bottom up rather than from a market report…
cbrock84/headcount · plugins/corporate-strategy/skills/portfolio-strategy/SKILL.md · Decides where capital and attention go across business lines, products, and markets — what to fund, hold, harvest, or…
cbrock84/headcount · plugins/corporate-strategy/skills/scenario-planning/SKILL.md · Plans under genuine uncertainty — building scenarios, identifying which assumptions are load-bearing, setting…
cbrock84/headcount · plugins/corporate-strategy/skills/strategic-alliances/SKILL.md · Structures partnerships that change what the business can do — technology integrations, channel and reseller…
cbrock84/headcount · plugins/customer-experience/skills/chief-customer-officer/SKILL.md · Owns the customer's experience after the sale — support, success, escalation, and the feedback loop back into product…
cbrock84/headcount · plugins/customer-experience/skills/customer-onboarding-and-implementation/SKILL.md · Takes a new customer from signature to working — setting a definition of live that both sides agreed before the…
cbrock84/headcount · plugins/customer-experience/skills/customer-success-management/SKILL.md · Runs the ongoing relationship with accounts after the sale — segmenting coverage against account value, building a…
cbrock84/headcount · plugins/customer-experience/skills/escalation-management/SKILL.md · Handles customer situations that have exceeded normal support — severity assessment, incident communication, executive…
cbrock84/headcount · plugins/customer-experience/skills/self-service-and-knowledge/SKILL.md · Builds the help center, in-product guidance, and knowledge base that let customers resolve problems without contacting…
naodeng/awesome-qa-skills · skills/en/testing-types/threat-modeling/SKILL.md · Use this skill when you need evidence-bounded threat-modeling analysis and validation preparation; triggers include…
miosa-osa/osa · priv/skills/threat-modeling/SKILL.md · Build a concrete cyber defense threat model from assets, data flows and trust boundaries, then map controls to attack…
nahid-sparktales/agent-dispatcher · skills/security/threat-modeling/SKILL.md · Work out what is actually worth defending in this system — the trust boundaries data crosses, the assets behind them…
jpeetz/agent-skills · skills/security/threat-modeling/SKILL.md · Use this skill when performing security reviews of features, APIs, or architecture changes. Produces a STRIDE threat…
timwukp/agent-skills-best-practice · skills/skills/threat-modeling/SKILL.md · Performs STRIDE threat modeling for features, APIs, and architecture changes, producing a threat model document with…
