Ready to supercharge your AI agents?

Install any skill in seconds. Free to start, no credit card required.

Get Started Free →

Threat Model Generation · codexstar69 | DecimalAI

securityby codexstar69

Threat Model Generation

codexstar69/threat-model-generation

Source codexstar69/bug-hunter ↗License MIT

Generate or refresh a STRIDE-based threat model for the current repository using Bug Hunter-native artifacts.

NewMaintained

Automatic

Security & AppSec pack

Last verified 8/19/2026

What it changes

Passed 10 of 19 test cases with the skill, and 10 of 19 without it.

Without skill50%

With skill50%

Checks it passed that the model alone missed

Populates severity threshold defaults within the configuration file.
Categorizes identified security threats using the STRIDE categories.
Generates the threat model document at `.bug-hunter/threat-model.md`.

and 5 more in the full report

6 fixed11 passed either way2 still failing3 broke

Pass-rate lift: 0 pp
Tokens: -21%
Agent turns: 0%
Response time: -17%

Model gemini-3.6-flashMeasured 8/19/2026v217 of 22 cases passed with skill · 19 comparable

Tokens, turns and time describe resource use, not a dollar price.

Use this skill

Save it into your project's skills folder. Claude Code picks it up in its next session.

curl -fsSL --create-dirs -o .claude/skills/codexstar69-threat-model-generation/SKILL.md https://app.decimal.ai/s/codexstar69-threat-model-generation/SKILL.md

Want it pinned and updatable? pip install "decimalai>=0.15", then decimalai skills add codexstar69-threat-model-generation, and start Claude Code with claude --plugin-dir "$(git rev-parse --show-toplevel)/.agents"

1 · One-time — install the CLI (docs ↗)

pip install "decimalai>=0.15"

2 · Get the skill — writes .agents/skills/codexstar69-threat-model-generation/ and pins it in .decimal/skills.lock

decimalai skills add codexstar69-threat-model-generation

No CLI? Get the same file — curl · raw file

curl -fsSL --create-dirs -o .claude/skills/codexstar69-threat-model-generation/SKILL.md https://app.decimal.ai/s/codexstar69-threat-model-generation/SKILL.md

Raw file: /s/codexstar69-threat-model-generation/SKILL.md ↗ · machine-readable summary at /s/codexstar69-threat-model-generation.json ↗

Safety checks: 3 of 3 passed

Code scan CleanIntent PassedContent Clean

See it in action

One of 5 test cases the skill fixed. Same model, same prompt, with and without the skill.

1 of 5

Prompt

Our CI script attempts to write security artifacts to `~/.config/bug-hunter/` or `.factory/`. Where should threat model artifacts strictly reside relative to the project root?

What was checked, without and with the skill
Checked	Without skill	With skill
Restricts all generated security context artifacts strictly to the `.bug-hunter/` project subdirectory.	Missed	Passed

case-17 · gemini-3.6-flash · 8/19/2026 · answers are capped and redacted

What's inside

The instructions your model reads when the skill loads.

SKILL.md41 linessingle file

Threat Model Generation

This is a bundled local Bug Hunter companion skill. It generates portable threat-model artifacts under .bug-hunter/.

Purpose

Create the security context that the other security skills depend on:

trust boundaries
major components
STRIDE threats
vulnerability pattern library
severity/config defaults

Required outputs

Write:

.bug-hunter/threat-model.md
.bug-hunter/security-config.json

Workflow

Read .bug-hunter/triage.json if available for file structure and domain hints.
Inspect the repository to identify:
- languages and frameworks
- public/authenticated/internal entry points
- data stores and external integrations
- sensitive assets and trust boundaries
Generate a concise STRIDE threat model.
Generate a matching security config with thresholds and tech-stack metadata.

Compatibility

prompts/threat-model.md is generated from this skill for older clients. This skill is the canonical source and must be edited instead of the generated compatibility prompt.

Output rules

Keep the threat model short enough for downstream agents to consume.
Be specific about trust boundaries and vulnerable code patterns.

Track record

Benchmark

10 / 19

test cases passed, vs 10 / 19 without

Adoption

Users: 0
Times used: 0

Safety and source details

SkillSafety

✓ 3 of 3 passed

Code scan15 of 15 checks clean

0 critical · 0 warning · 0 info — scanner v4 — 8/10/2026

View 15 scanner checks

live_secretremote_code_executionreverse_shelldata_exfiltrationssrf_metadataagent_snoopinganti_refusaldestructive_commandsobfuscated_unicodeunicode_homoglyphopaque_blobsuspicious_urltool_overreachtrigger_abuseprompt_injection_phrasing

IntentSafe

LLM judge · does the skill do what it claims

ContentClean

LLM judge · policy & harmful-content review

Source

Imported

codexstar69 / bug-hunter

skills/threat-model-generation/SKILL.md

View on GitHub ↗

License MITImported 8/10/2026Version v2

More skills from the same source and nearby in the registry, with their headline benchmark lift.

Ready to supercharge your AI agents?

See it in action

What's inside

Threat Model Generation

Purpose

Required outputs

Workflow

Compatibility

Output rules

Track record

Benchmark

Adoption

SkillSafety

Source

Related skills