Loading skill
Install any skill in seconds. Free to start, no credit card required.
Get Started Free →ruvnet/threat-model
MCP threat-model artifact for a scaffolded harness. Reports allowed/denied tools, dangerous permissions count, secrets reachability, network/shell/file-write grants, default-deny posture. Verdict: clean (exit 0) / medium (exit 1) / high (exit 2). The 'enterprise gold' artifact for PR + compliance review.
Passed 20 of 21 test cases with the skill, and 9 of 21 without it.
and 8 more in the full report
12 fixed9 passed either way1 still failing0 broke
Tokens, turns and time describe resource use, not a dollar price.
One of 11 test cases the skill fixed. Same model, same prompt, with and without the skill.
When running the CLI threat model tool on `./my-harness` to generate a bundled artifact matching ADR-031 schema-1, which flag should be appended to the command?
| Checked | Without skill | With skill |
|---|---|---|
| Uses the harness threat-model command on ./my-harness. | Missed | Passed |
| Includes the --bundle flag. | Passed | Passed |
The instructions your model reads when the skill loads.
Codex skill: MCP threat-model artifact for PR / compliance review (iter 112 → iter 114). User-labelled "enterprise gold."
Renders the existing mcp-scan findings as a clean threat-model artifact
in the shape a security / compliance reviewer wants to see attached to a
PR:
MCP Threat Model
Allowed tools: 3
Denied tools: 14
Dangerous permissions: 0
Secrets reachable: no
Network access: no
Shell access: no
File write: no
Default-deny policy: yes
Audit log: yes
Verdict: clean (exit 0)
Same underlying scan as mcp-scan, presented as a single-screen artifact.
| Verdict | Exit | Triggers |
|---|---|---|
clean | 0 | no dangerous perms, no secret exposure |
medium | 1 | network OR file-write granted, OR no audit log |
high | 2 | shell granted OR default-deny OFF OR secrets reachable |
The "secrets reachable" heuristic is conservative: true when MCP is in
use AND deny rules don't guard .env* AND allow rules include any
Read(...) grant.
test cases passed, vs 9 / 21 without
More skills from the same source and nearby in the registry, with their headline benchmark lift.