[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6DBW8AVAT3VAVT5E73ABCJ9":3,"skill-same:01M6DBW8AVAT3VAVT5E73ABCJ9":89},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":23,"publishedAt":44,"linkOnly":45,"markdownContent":46,"markdownBody":47,"frontMatter":48,"refName":49,"commitSha":50,"skillDirectory":51,"forksCount":14,"repositoryHtmlUrl":52,"repositoryHomepageUrl":6,"ownerHtmlUrl":53,"ownerBlogUrl":6,"ownerDescription":6,"updatedAt":54,"install":55,"resources":68},"01M6DBW8AVAT3VAVT5E73ABCJ9","security-threat-model",null,"Repository-grounded threat modeling that enumerates trust boundaries, assets, attacker capabilities, abuse paths, and mitigations, and writes a concise Markdown threat model. Trigger only when the user explicitly asks to threat model a codebase or path, enumerate threats\u002Fabuse paths, or perform AppSec threat modeling. Not for general architecture summaries or code review.","Prekzursil\u002Fagent-skills-toolchain","Prekzursil","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F54636077?v=4","01M6DACZ1PCQHD99SCR1YXG28B","Andrei Mihai Visalon","01M6DACZ670WZF535V3WYYSS4Z",0,"MIT","https:\u002F\u002Fgithub.com\u002FPrekzursil\u002Fagent-skills-toolchain\u002Fblob\u002Fmain\u002F.agents\u002Fskills\u002Fsecurity-threat-model\u002FSKILL.md",[18],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000007","代码审查","SCENARIO","使用场景",[24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43],"security","threat model","security threat model","threat","model","markdown","trigger","modeling","trust","general","AppSec","only","assets","code review","repository","capabilities","code","architecture","threat modeling","review","2026-11-10 10:12:30",false,"---\nname: \"security-threat-model\"\ndescription: Repository-grounded threat modeling that enumerates trust boundaries, assets, attacker capabilities, abuse paths, and mitigations, and writes a concise Markdown threat model. Trigger only when the user explicitly asks to threat model a codebase or path, enumerate threats\u002Fabuse paths, or perform AppSec threat modeling. Not for general architecture summaries or code review.\n---\n\n# Threat Model Source Code Repo\n\nDeliver an actionable AppSec-grade threat model that is specific to the repository or a project path, not a generic checklist. Anchor every architectural claim to evidence in the repo and keep assumptions explicit. Prioritizing realistic attacker goals and concrete impacts over generic checklists.\n\n## Quick start\n\n1) Collect (or infer) inputs:\n- Repo root path and any in-scope paths.\n- Intended usage, deployment model, internet exposure, and auth expectations (if known).\n- Any existing repository summary or architecture spec.\n- Use prompts in `references\u002Fprompt-template.md` to generate a repository summary.\n- Follow the required output contract in `references\u002Fprompt-template.md`. Use it verbatim when possible.\n\n## Workflow\n\n### 1) Scope and extract the system model\n- Identify primary components, data stores, and external integrations from the repo summary.\n- Identify how the system runs (server, CLI, library, worker) and its entrypoints.\n- Separate runtime behavior from CI\u002Fbuild\u002Fdev tooling and from tests\u002Fexamples.\n- Map the in-scope locations to those components and exclude out-of-scope items explicitly.\n- Do not claim components, flows, or controls without evidence.\n\n### 2) Derive boundaries, assets, and entry points\n- Enumerate trust boundaries as concrete edges between components, noting protocol, auth, encryption, validation, and rate limiting.\n- List assets that drive risk (data, credentials, models, config, compute resources, audit logs).\n- Identify entry points (endpoints, upload surfaces, parsers\u002Fdecoders, job triggers, admin tooling, logging\u002Ferror sinks).\n\n### 3) Calibrate assets and attacker capabilities\n- List the assets that drive risk (credentials, PII, integrity-critical state, availability-critical components, build artifacts).\n- Describe realistic attacker capabilities based on exposure and intended usage.\n- Explicitly note non-capabilities to avoid inflated severity.\n\n\n### 4) Enumerate threats as abuse paths\n- Prefer attacker goals that map to assets and boundaries (exfiltration, privilege escalation, integrity compromise, denial of service).\n- Classify each threat and tie it to impacted assets.\n- Keep the number of threats small but high quality.\n\n### 5) Prioritize with explicit likelihood and impact reasoning\n- Use qualitative likelihood and impact (low\u002Fmedium\u002Fhigh) with short justifications.\n- Set overall priority (critical\u002Fhigh\u002Fmedium\u002Flow) using likelihood x impact, adjusted for existing controls.\n- State which assumptions most influence the ranking.\n\n### 6) Validate service context and assumptions with the user\n- Summarize key assumptions that materially affect threat ranking or scope, then ask the user to confirm or correct them.\n- Ask 1–3 targeted questions to resolve missing context (service owner and environment, scale\u002Fusers, deployment model, authn\u002Fauthz, internet exposure, data sensitivity, multi-tenancy).\n- Pause and wait for user feedback before producing the final report.\n- If the user declines or can’t answer, state which assumptions remain and how they influence priority.\n\n### 7) Recommend mitigations and focus paths\n- Distinguish existing mitigations (with evidence) from recommended mitigations.\n- Tie mitigations to concrete locations (component, boundary, or entry point) and control types (authZ checks, input validation, schema enforcement, sandboxing, rate limits, secrets isolation, audit logging).\n- Prefer specific implementation hints over generic advice (e.g., \"enforce schema at gateway for upload payloads\" vs \"validate inputs\").\n- Base recommendations on validated user context; if assumptions remain unresolved, mark recommendations as conditional.\n\n### 8) Run a quality check before finalizing\n- Confirm all discovered entrypoints are covered.\n- Confirm each trust boundary is represented in threats.\n- Confirm runtime vs CI\u002Fdev separation.\n- Confirm user clarifications (or explicit non-responses) are reflected.\n- Confirm assumptions and open questions are explicit.\n- Confirm that the format of the report matches closely the required output format defined in prompt template: `references\u002Fprompt-template.md`\n- Write the final Markdown to a file named `\u003Crepo-or-dir-name>-threat-model.md` (use the basename of the repo root, or the in-scope directory if you were asked to model a subpath).\n\n\n## Risk prioritization guidance (illustrative, not exhaustive)\n- High: pre-auth RCE, auth bypass, cross-tenant access, sensitive data exfiltration, key or token theft, model or config integrity compromise, sandbox escape.\n- Medium: targeted DoS of critical components, partial data exposure, rate-limit bypass with measurable impact, log\u002Fmetrics poisoning that affects detection.\n- Low: low-sensitivity info leaks, noisy DoS with easy mitigation, issues requiring unlikely preconditions.\n\n## References\n\n- Output contract and full prompt template: `references\u002Fprompt-template.md`\n- Optional controls\u002Fasset list: `references\u002Fsecurity-controls-and-assets.md`\n\nOnly load the reference files you need. Keep the final result concise, grounded, and reviewable.\n","# Threat Model Source Code Repo\n\nDeliver an actionable AppSec-grade threat model that is specific to the repository or a project path, not a generic checklist. Anchor every architectural claim to evidence in the repo and keep assumptions explicit. Prioritizing realistic attacker goals and concrete impacts over generic checklists.\n\n## Quick start\n\n1) Collect (or infer) inputs:\n- Repo root path and any in-scope paths.\n- Intended usage, deployment model, internet exposure, and auth expectations (if known).\n- Any existing repository summary or architecture spec.\n- Use prompts in `references\u002Fprompt-template.md` to generate a repository summary.\n- Follow the required output contract in `references\u002Fprompt-template.md`. Use it verbatim when possible.\n\n## Workflow\n\n### 1) Scope and extract the system model\n- Identify primary components, data stores, and external integrations from the repo summary.\n- Identify how the system runs (server, CLI, library, worker) and its entrypoints.\n- Separate runtime behavior from CI\u002Fbuild\u002Fdev tooling and from tests\u002Fexamples.\n- Map the in-scope locations to those components and exclude out-of-scope items explicitly.\n- Do not claim components, flows, or controls without evidence.\n\n### 2) Derive boundaries, assets, and entry points\n- Enumerate trust boundaries as concrete edges between components, noting protocol, auth, encryption, validation, and rate limiting.\n- List assets that drive risk (data, credentials, models, config, compute resources, audit logs).\n- Identify entry points (endpoints, upload surfaces, parsers\u002Fdecoders, job triggers, admin tooling, logging\u002Ferror sinks).\n\n### 3) Calibrate assets and attacker capabilities\n- List the assets that drive risk (credentials, PII, integrity-critical state, availability-critical components, build artifacts).\n- Describe realistic attacker capabilities based on exposure and intended usage.\n- Explicitly note non-capabilities to avoid inflated severity.\n\n\n### 4) Enumerate threats as abuse paths\n- Prefer attacker goals that map to assets and boundaries (exfiltration, privilege escalation, integrity compromise, denial of service).\n- Classify each threat and tie it to impacted assets.\n- Keep the number of threats small but high quality.\n\n### 5) Prioritize with explicit likelihood and impact reasoning\n- Use qualitative likelihood and impact (low\u002Fmedium\u002Fhigh) with short justifications.\n- Set overall priority (critical\u002Fhigh\u002Fmedium\u002Flow) using likelihood x impact, adjusted for existing controls.\n- State which assumptions most influence the ranking.\n\n### 6) Validate service context and assumptions with the user\n- Summarize key assumptions that materially affect threat ranking or scope, then ask the user to confirm or correct them.\n- Ask 1–3 targeted questions to resolve missing context (service owner and environment, scale\u002Fusers, deployment model, authn\u002Fauthz, internet exposure, data sensitivity, multi-tenancy).\n- Pause and wait for user feedback before producing the final report.\n- If the user declines or can’t answer, state which assumptions remain and how they influence priority.\n\n### 7) Recommend mitigations and focus paths\n- Distinguish existing mitigations (with evidence) from recommended mitigations.\n- Tie mitigations to concrete locations (component, boundary, or entry point) and control types (authZ checks, input validation, schema enforcement, sandboxing, rate limits, secrets isolation, audit logging).\n- Prefer specific implementation hints over generic advice (e.g., \"enforce schema at gateway for upload payloads\" vs \"validate inputs\").\n- Base recommendations on validated user context; if assumptions remain unresolved, mark recommendations as conditional.\n\n### 8) Run a quality check before finalizing\n- Confirm all discovered entrypoints are covered.\n- Confirm each trust boundary is represented in threats.\n- Confirm runtime vs CI\u002Fdev separation.\n- Confirm user clarifications (or explicit non-responses) are reflected.\n- Confirm assumptions and open questions are explicit.\n- Confirm that the format of the report matches closely the required output format defined in prompt template: `references\u002Fprompt-template.md`\n- Write the final Markdown to a file named `\u003Crepo-or-dir-name>-threat-model.md` (use the basename of the repo root, or the in-scope directory if you were asked to model a subpath).\n\n\n## Risk prioritization guidance (illustrative, not exhaustive)\n- High: pre-auth RCE, auth bypass, cross-tenant access, sensitive data exfiltration, key or token theft, model or config integrity compromise, sandbox escape.\n- Medium: targeted DoS of critical components, partial data exposure, rate-limit bypass with measurable impact, log\u002Fmetrics poisoning that affects detection.\n- Low: low-sensitivity info leaks, noisy DoS with easy mitigation, issues requiring unlikely preconditions.\n\n## References\n\n- Output contract and full prompt template: `references\u002Fprompt-template.md`\n- Optional controls\u002Fasset list: `references\u002Fsecurity-controls-and-assets.md`\n\nOnly load the reference files you need. Keep the final result concise, grounded, and reviewable.\n",{"name":5,"description":7},"main","a298c929b6cbd662e1fce54302ce520d5ceea1a5",".agents\u002Fskills\u002Fsecurity-threat-model","https:\u002F\u002Fgithub.com\u002FPrekzursil\u002Fagent-skills-toolchain","https:\u002F\u002Fgithub.com\u002FPrekzursil","2026-11-02 14:30:57",{"source":8,"skillName":5,"commands":56,"prompt":66,"zipAvailable":67},[57,60,63],{"tool":58,"command":59},"npx","npx skills add Prekzursil\u002Fagent-skills-toolchain --skill security-threat-model",{"tool":61,"command":62},"bunx","bunx skills add Prekzursil\u002Fagent-skills-toolchain --skill security-threat-model",{"tool":64,"command":65},"pnpm","pnpm dlx skills add Prekzursil\u002Fagent-skills-toolchain --skill security-threat-model","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002FPrekzursil\u002Fagent-skills-toolchain\u002Fblob\u002Fmain\u002F.agents\u002Fskills\u002Fsecurity-threat-model\u002FSKILL.md",true,[69,75,81,85],{"path":70,"resourceType":71,"resourceTypeDesc":72,"sizeBytes":73,"sourceHtmlUrl":74},"agents\u002Fopenai.yaml","REFERENCE","参考文档",254,"https:\u002F\u002Fgithub.com\u002FPrekzursil\u002Fagent-skills-toolchain\u002Fblob\u002Fmain\u002F.agents\u002Fskills\u002Fsecurity-threat-model\u002Fagents\u002Fopenai.yaml",{"path":76,"resourceType":77,"resourceTypeDesc":78,"sizeBytes":79,"sourceHtmlUrl":80},"LICENSE.txt","LICENSE","许可证",10776,"https:\u002F\u002Fgithub.com\u002FPrekzursil\u002Fagent-skills-toolchain\u002Fblob\u002Fmain\u002F.agents\u002Fskills\u002Fsecurity-threat-model\u002FLICENSE.txt",{"path":82,"resourceType":71,"resourceTypeDesc":72,"sizeBytes":83,"sourceHtmlUrl":84},"references\u002Fprompt-template.md",12642,"https:\u002F\u002Fgithub.com\u002FPrekzursil\u002Fagent-skills-toolchain\u002Fblob\u002Fmain\u002F.agents\u002Fskills\u002Fsecurity-threat-model\u002Freferences\u002Fprompt-template.md",{"path":86,"resourceType":71,"resourceTypeDesc":72,"sizeBytes":87,"sourceHtmlUrl":88},"references\u002Fsecurity-controls-and-assets.md",1680,"https:\u002F\u002Fgithub.com\u002FPrekzursil\u002Fagent-skills-toolchain\u002Fblob\u002Fmain\u002F.agents\u002Fskills\u002Fsecurity-threat-model\u002Freferences\u002Fsecurity-controls-and-assets.md",[90,112,141,167,181,197],{"skillNo":91,"name":92,"nameZh":6,"description":93,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":94,"categories":95,"keywords":96,"publishedAt":44},"01M6DF7D7478R55P46REYH4QAC","clarify-requirements","Resolve genuine pre-execution ambiguity by scanning repo context, generating 1-6 grounded options, and asking 1-3 focused questions via AskUserQuestion. NOT for mid-task use (injection risk); NOT when the goal is already unambiguous; use to disambiguate vague prompts before any file edits.","https:\u002F\u002Fgithub.com\u002FPrekzursil\u002Fagent-skills-toolchain\u002Fblob\u002Fmain\u002Ftools\u002Fworkspace-hooks\u002Fskills\u002Fclarify-requirements\u002FSKILL.md",[],[97,98,99,100,101,102,103,104,105,106,107,108,109,110,111],"clarify requirements","clarify","requirements","risk","options","task","prompts","goal","scanning","use","context","repo","injection","execution","file",{"skillNo":113,"name":114,"nameZh":6,"description":115,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":116,"categories":117,"keywords":121,"publishedAt":44},"01M6DF79CA4BHJS66J8EZDBPWJ","openmm-md","Run FREE, open-source, Windows-native GPU molecular dynamics via the openmm-md MCP (OpenMM + CUDA on the local NVIDIA GPU). Use for protein \u002F protein-ligand MD when you want a free stack or are on Windows without a Schrodinger license. Covers the full workflow (prepare, solvate, minimize, equilibrate, production, analyze, mmgbsa) AND an honest decision guide vs Schrodinger Desmond, including how to run Desmond legitimately on Linux or a cloud GPU with a real license. This is a deliberately LESSER free alternative and does NOT replace the schrodinger MCP tools. Do NOT use it to pick a free tool when a validated FEP+, WaterMap, IFD-MD, or Prime MM-GBSA result is actually required.","https:\u002F\u002Fgithub.com\u002FPrekzursil\u002Fagent-skills-toolchain\u002Fblob\u002Fmain\u002Ftools\u002Fmcp\u002Fopenmm-md-mcp\u002Fskill\u002Fopenmm-md\u002FSKILL.md",[118],{"categoryNo":119,"categoryName":120,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发",[122,123,124,125,126,127,128,129,130,131,132,133,134,135,106,136,137,138,139,140],"openmm md","how","decision","pick","linux","analyze","tool","stack","open","NVIDIA","gpu","license","workflow","windows","free","molecular dynamics","local","do","MCP",{"skillNo":142,"name":143,"nameZh":6,"description":144,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":145,"categories":146,"keywords":153,"publishedAt":44},"01M6DF76C1MG85VEWP8VZCBNMN","visual-review","Take screenshots of web pages and UI using Playwright for visual review and iteration","https:\u002F\u002Fgithub.com\u002FPrekzursil\u002Fagent-skills-toolchain\u002Fblob\u002Fmain\u002Ftools\u002Feditor\u002Fmetaswarm\u002Fskills\u002Fvisual-review\u002FSKILL.md",[147,150],{"categoryNo":148,"categoryName":149,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000003","演示文稿",{"categoryNo":151,"categoryName":152,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000008","测试与质量",[43,154,155,156,157,158,159,160,161,162,123,163,164,165,166],"visual","visual review","pages","web","false","iteration","take","check","slides","ui","screenshot","playwright","screenshots",{"skillNo":168,"name":169,"nameZh":6,"description":170,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":171,"categories":172,"keywords":173,"publishedAt":44},"01M6DF73AQVCBZKEN0YXEX9FXP","status","Diagnostic status report — shows metaswarm installation state, project setup, and potential issues","https:\u002F\u002Fgithub.com\u002FPrekzursil\u002Fagent-skills-toolchain\u002Fblob\u002Fmain\u002Ftools\u002Feditor\u002Fmetaswarm\u002Fskills\u002Fstatus\u002FSKILL.md",[],[169,174,175,176,177,178,179,180],"setup","report","project","installation","project setup","issues","state",{"skillNo":182,"name":183,"nameZh":6,"description":184,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":185,"categories":186,"keywords":188,"publishedAt":44},"01M6DF6X6C2XB0P6GX76P7TTYV","start","Use when starting work on any task, when the user mentions metaswarm, or when the user wants to begin tracked development work","https:\u002F\u002Fgithub.com\u002FPrekzursil\u002Fagent-skills-toolchain\u002Fblob\u002Fmain\u002Ftools\u002Feditor\u002Fmetaswarm\u002Fskills\u002Fstart\u002FSKILL.md",[187],{"categoryNo":119,"categoryName":120,"taxonomyType":21,"taxonomyTypeDesc":22},[183,189,102,190,191,192,106,193,194,195,196],"start issue","issue","ready","work on issue","user","work","work on","development",{"skillNo":198,"name":174,"nameZh":6,"description":199,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":200,"categories":201,"keywords":202,"publishedAt":44},"01M6DF6QMJ9AJKFKHHKRT005PQ","Interactive project setup — detects your project, configures metaswarm, writes project-local files","https:\u002F\u002Fgithub.com\u002FPrekzursil\u002Fagent-skills-toolchain\u002Fblob\u002Fmain\u002Ftools\u002Feditor\u002Fmetaswarm\u002Fskills\u002Fsetup\u002FSKILL.md",[],[174,176,138,203,178,204],"files","interactive"]