{"name":"threat-model-your-app","description":"Writes a short, evidence-based threat model for your own codebase - map components, trust boundaries, assets and entry points, list realistic abuse paths, rank them by likelihood and impact, and tie each fix to a place in the code. Use when the user asks for a threat model, wants to know how an attacker could abuse their app, or plans security work before launch.","category":"backend","tags":["security","architecture"],"models":["any"],"proven":false,"passing_families":0,"model_testing":"Not yet model-tested; testing Jan 2027","url":"https://theskillvault.ai/skills/threat-model-your-app","api_url":"https://theskillvault.ai/api/skills/threat-model-your-app","raw_url":"https://theskillvault.ai/api/skills/threat-model-your-app/raw","body":"# Threat model your app\n\nA threat model answers one question: who could misuse this, how, and what would it cost? Keep it short and tied to real code.\n\n## When to use\n- You are about to launch and want to know where the real risks are.\n- A client, investor or review asks for a threat model.\n- You added payments, uploads, admin tools or multi-tenant data.\n\n## When not to use\n- You want a hands-on scan for leaked keys and missing checks. Use audit-app-security, then use this to prioritise.\n\n## Steps\n1. Set the scope: which repo or folder, how it is deployed, and who can reach it from the internet.\n2. List the parts that run: web app, API, workers, database, storage, third-party services. Only list what the code shows.\n3. Draw the trust boundaries: browser to API, API to database, app to each outside service. Note auth and validation at each.\n4. List the assets: user data, credentials and tokens, payment state, admin powers, compute budget.\n5. List entry points: routes, forms, uploads, webhooks, cron jobs, admin pages.\n6. Write 5 to 10 abuse paths as \"attacker does X through Y to get Z\", tied to an asset.\n7. Rate each as low, medium or high for likelihood and impact, with one line of reasoning.\n8. Ask the owner 1 to 3 questions that would change the ranking, such as \"Is the admin page public?\"\n9. Recommend fixes tied to a location, such as \"check order owner in `GET /orders/:id`\". Mark which already exist.\n\n## Output outline\n- Scope and assumptions\n- System summary and trust boundaries\n- Assets and entry points\n- Abuse paths table: path, asset, likelihood, impact, priority, fix\n- Open questions\n\n## Gotchas\n- Generic lists (\"use HTTPS\") are not a threat model. Every row must point at this app.\n- Separate runtime risks from build and CI risks; leaked CI secrets are their own row.\n- Do not paste real secrets, customer data or private keys into the report.\n- Do not overstate: note what an attacker cannot do, so priorities stay honest.\n\n## Portability\nWorks with any language, framework or host. If you use a formal method like STRIDE, map each abuse path to its category; the steps stay the same.\n\n## Example prompt\n\"Threat model my Next.js and Supabase app before launch. Rank the top risks and tell me where to fix each one.\"\n\n## Done when\n- Every entry point and trust boundary appears in at least one abuse path or is marked out of scope.\n- Each high item has a fix pointing at a file, route or setting.\n- Assumptions and open questions are written down.\n\n---\nModified from \"security-threat-model\" in openai/skills (Apache-2.0). Changes by TheSkillVault are listed in the metadata above. See LICENSE.txt.","files":["LICENSE.txt"],"license":"Apache-2.0","license_name":"Apache License 2.0","license_url":"https://www.apache.org/licenses/LICENSE-2.0","attribution":"Based on work by OpenAI (openai/skills, security-threat-model) (Copyright (c) OpenAI (openai/skills, security-threat-model); Apache License 2.0 text in LICENSE.txt, Apache License 2.0), https://github.com/openai/skills/tree/49f948faa9258a0c61caceaf225e179651397431/skills/.curated/security-threat-model; adapted by TheSkillVault, https://theskillvault.ai","install":{"claude_code":"curl -fsSL --create-dirs 'https://theskillvault.ai/api/skills/threat-model-your-app/raw' -o ~/'.claude/skills/threat-model-your-app/SKILL.md' && curl -fsSL --create-dirs 'https://theskillvault.ai/api/skills/threat-model-your-app/files/LICENSE.txt' -o ~/'.claude/skills/threat-model-your-app/LICENSE.txt'","cursor":"curl -fsSL --create-dirs 'https://theskillvault.ai/api/skills/threat-model-your-app/raw' -o '.cursor/skills/threat-model-your-app/SKILL.md' && curl -fsSL --create-dirs 'https://theskillvault.ai/api/skills/threat-model-your-app/files/LICENSE.txt' -o '.cursor/skills/threat-model-your-app/LICENSE.txt'","agents":"curl -fsSL --create-dirs 'https://theskillvault.ai/api/skills/threat-model-your-app/raw' -o '.agents/skills/threat-model-your-app/SKILL.md' && curl -fsSL --create-dirs 'https://theskillvault.ai/api/skills/threat-model-your-app/files/LICENSE.txt' -o '.agents/skills/threat-model-your-app/LICENSE.txt'","mcp_url":"https://theskillvault.ai/mcp","cursor_mcp_deeplink":"cursor://anysphere.cursor-deeplink/mcp/install?name=theskillvault&config=eyJ1cmwiOiJodHRwczovL3RoZXNraWxsdmF1bHQuYWkvbWNwIn0%3D","mcp_config":{"mcpServers":{"theskillvault":{"url":"https://theskillvault.ai/mcp"}}}},"bundles":[],"tested_on":[{"family":"chatgpt","name":"ChatGPT","outcome":null,"date":null,"source":null,"counts":false,"stale":false},{"family":"claude","name":"Claude","outcome":null,"date":null,"source":null,"counts":false,"stale":false},{"family":"gemini","name":"Gemini","outcome":null,"date":null,"source":null,"counts":false,"stale":false},{"family":"grok","name":"Grok","outcome":null,"date":null,"source":null,"counts":false,"stale":false},{"family":"llama","name":"Llama","outcome":null,"date":null,"source":null,"counts":false,"stale":false},{"family":"deepseek","name":"DeepSeek","outcome":null,"date":null,"source":null,"counts":false,"stale":false},{"family":"mistral","name":"Mistral","outcome":null,"date":null,"source":null,"counts":false,"stale":false},{"family":"qwen","name":"Qwen","outcome":null,"date":null,"source":null,"counts":false,"stale":false},{"family":"kimi","name":"Kimi K","outcome":null,"date":null,"source":null,"counts":false,"stale":false}],"proven_rule":{"threshold":5,"window_days":365,"computed_at":"2026-11-02T03:20:33.817Z"}}