---
name: codexstar69-threat-model-generation
description: "Generate or refresh a STRIDE-based threat model for the current repository using Bug Hunter-native artifacts. Use whenever the repository has no threat model yet, the architecture changed materially, a security review needs fresh trust-boundary context, or the user explicitly asks for a threat model."
license: "MIT"
metadata:
  decimalai-skill-id: "a1ca5f25-e8c0-431a-97cc-3dafff820a1e"
  decimalai-version-id: "e1600bbf-46c8-4bb1-b845-dda16a4aaf62"
  decimalai-version: "2"
  decimalai-body-sha256: "fdc51d3331ba5ce6a1b0ac2b9f9f9d2744accdcd9874775f171935e62cf3adbb"
  decimalai-name: "codexstar69/threat-model-generation"
  decimalai-format: "1"
  decimalai-invocation: "model"
  decimalai-category: "security"
  decimalai-source: "https://app.decimal.ai/s/codexstar69-threat-model-generation@2/SKILL.md"
---
# Threat Model Generation

This is a bundled local Bug Hunter companion skill. It generates portable threat-model artifacts under `.bug-hunter/`.

## Purpose

Create the security context that the other security skills depend on:
- trust boundaries
- major components
- STRIDE threats
- vulnerability pattern library
- severity/config defaults

## Required outputs

Write:
- `.bug-hunter/threat-model.md`
- `.bug-hunter/security-config.json`

## Workflow

1. Read `.bug-hunter/triage.json` if available for file structure and domain hints.
2. Inspect the repository to identify:
   - languages and frameworks
   - public/authenticated/internal entry points
   - data stores and external integrations
   - sensitive assets and trust boundaries
3. Generate a concise STRIDE threat model.
4. Generate a matching security config with thresholds and tech-stack metadata.

## Compatibility

`prompts/threat-model.md` is generated from this skill for older clients. This
skill is the canonical source and must be edited instead of the generated
compatibility prompt.

## Output rules

- Keep the threat model short enough for downstream agents to consume.
- Be specific about trust boundaries and vulnerable code patterns.
- Keep all artifacts under `.bug-hunter/`, never `.factory/`.