security-threat-model

Repository-grounded threat modeling that enumerates trust boundaries, assets, attacker capabilities, abuse paths, and mitigations, and writes a concise Markdown threat model. Trigger only when the user explicitly asks to threat model a codebase or path, enumerate threats/abuse paths, or perform AppSec threat modeling. Do not trigger for general architecture summaries, code review, or non-security design work.

2.54x

Quality

88%

Does it follow best practices?

Impact

94%

2.54x

Average score across 3 eval scenarios

Securityby

Passed

No findings from the security scan

Quality

Content

85%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A well-structured, mostly lean instruction skill with a clear multi-step workflow, explicit validation checkpoints, and clean progressive disclosure. The main weakness is mild redundancy in the assets enumeration.

Suggestions

De-duplicate the assets listing: step 2 already enumerates assets, so step 3 can reference it rather than re-listing 'List the assets that drive risk (credentials, PII, integrity-critical state, availability-critical components, build artifacts)'.

Tighten step 4's guidance into the concrete abuse-path format the prompt template requires (attacker goal -> steps -> impact) so the SKILL.md body matches the output contract it points to.

Consider moving the inline 'Risk prioritization guidance' exemplars into the security-controls-and-assets reference to keep the body focused on process.

Dimension	Reasoning	Score
Conciseness	The body is lean and assumes Claude's competence, but assets are listed redundantly across steps 2 ('List assets that drive risk') and 3 ('List the assets that drive risk'), adding minor avoidable tokens.	4 / 5
Actionability	Concrete, instruction-only guidance—output filename '<repo-or-dir-name>-threat-model.md', enumerated control types, and an implementation-hint example ('enforce schema at gateway for upload payloads')—with only minor gaps in specificity.	4 / 5
Workflow Clarity	Eight well-sequenced steps include explicit validation checkpoints: step 6 pauses for user confirmation and step 8 provides a quality-check checklist before finalizing, giving clear feedback loops.	5 / 5
Progressive Disclosure	The SKILL.md is an overview pointing to two real, one-level-deep reference files (references/prompt-template.md, references/security-controls-and-assets.md) with clearly signaled navigation and appropriate content split.	5 / 5
	Total	18 / 20 Passed

Description

92%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A strong, third-person description that concretely lists capabilities, gives explicit positive and negative trigger guidance, and carves out a distinct niche. Minor synonym coverage on trigger terms is the only gap.

Dimension	Reasoning	Score
Specificity	Enumerates concrete actions—'trust boundaries, assets, attacker capabilities, abuse paths, and mitigations'—and 'writes a concise Markdown threat model', giving comprehensive coverage of what the skill does.	5 / 5
Completeness	It states both what the skill does and an explicit 'when'—'Trigger only when the user explicitly asks...'—plus negative triggers ('Do not trigger for...'), answering both clearly with concrete trigger phrases.	5 / 5
Trigger Term Quality	Natural phrases like 'threat model a codebase or path', 'enumerate threats/abuse paths', and 'AppSec threat modeling' map well to user speech, though a few common synonyms (e.g. 'attack tree', 'security review') are absent.	4 / 5
Distinctiveness Conflict Risk	A clear AppSec threat-modeling niche with distinct triggers, and the explicit exclusion of 'general architecture summaries, code review, or non-security design work' minimizes conflict with adjacent skills.	5 / 5
	Total	19 / 20 Passed

Validation

100%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 16 / 16 Passed

Validation for skill structure

No warnings or errors.

Repository: foryourhealth111-pixel/Vibe-Skills
Path: bundled/skills/security-threat-model/SKILL.md
Commit: d5ae560

Reviewed: 4 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.