[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M740HAQAHT0T68PMDWQQ0BY8":3,"skill-same:01M740HAQAHT0T68PMDWQQ0BY8":89},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":16,"sourceHtmlUrl":17,"categories":18,"keywords":19,"publishedAt":20,"linkOnly":21,"markdownContent":22,"markdownBody":23,"frontMatter":24,"refName":40,"commitSha":41,"skillDirectory":42,"forksCount":14,"repositoryHtmlUrl":43,"repositoryHomepageUrl":6,"ownerHtmlUrl":44,"ownerBlogUrl":6,"ownerDescription":45,"updatedAt":46,"install":47,"resources":60},"01M740HAQAHT0T68PMDWQQ0BY8","threat-modeler",null,"Identify assets, trust boundaries, abuse cases, attack paths, threats, and required security controls.","domehahn\u002Fskcr","domehahn","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F41511445?v=4","01M735R3R9KEBEJ6D5YYAE9A61","Dominik Hahn","01M735R3SCNX1SGB3T840Z1H3H",0,"MIT","https:\u002F\u002Fgithub.com\u002Fdomehahn\u002Fskcr\u002Fblob\u002Fmain\u002Fexamples\u002F.agents\u002Fskills\u002Fthreat-modeler\u002FLICENSE","https:\u002F\u002Fgithub.com\u002Fdomehahn\u002Fskcr\u002Fblob\u002Fmain\u002Fexamples\u002F.agents\u002Fskills\u002Fthreat-modeler\u002FSKILL.md",[],[],"2026-11-11 15:11:14",false,"---\nname: threat-modeler\ndescription: Identify assets, trust boundaries, abuse cases, attack paths, threats, and required security controls.\nversion: \"1.1.0\"\nsince: \"2026-06-10\"\nlast_modified: \"2026-06-10\"\nauthors:\n  - platform-engineering\nstability: stable\nmin_platform_version:\n  codex: \"unknown\"\n  claude-code: \"unknown\"\n  github-copilot: \"unknown\"\n  gitlab-duo: \"unknown\"\n  opencode: \"unknown\"\n  openhands: \"unknown\"\n  cursor: \"unknown\"\n  roo-code: \"unknown\"\n  kiro: \"unknown\"\n  junie: \"unknown\"\n  gemini-cli: \"unknown\"\n  windsurf: \"unknown\"\n  ollama: \"unknown\"\ndeprecated_since:\nreplaces:\nsupersedes: []\nchangelog:\n  - version: \"1.1.0\"\n    date: \"2026-06-10\"\n    change: \"Added production-ready skill-specific operating model, checklist, decision rules, acceptance criteria, and output requirements\"\n  - version: \"1.0.0\"\n    date: \"2025-01-01\"\n    change: \"Initial release\"\n---\n\n# Threat Modeler\n\n## Purpose\n\nIdentify assets, trust boundaries, abuse cases, attack paths, threats, and required security controls.\n\n## When to use\n\nUse this skill when the task matches the description above or when the central agent instructions route work to `$threat-modeler`.\n\n## Operating model\n\n1. Clarify the goal and constraints.\n2. Inspect the minimum relevant repository context.\n3. Produce a concise execution plan for non-trivial work.\n4. Execute with tools when implementation is requested.\n5. Validate the result with repository-native checks.\n6. Summarize changed files, validation results, and residual risks.\n\n## DevSecOps guardrails\n\n- Do not read secrets, `.env` files, private keys, production credentials, masked CI\u002FCD variables, database dumps, or sensitive logs unless explicitly required.\n- Do not push, deploy, publish, merge, or create releases unless explicitly asked.\n- Prefer merge requests, reviewable diffs, and auditable validation evidence.\n- Prefer least privilege, minimal changes, and explicit rollback notes.\n- Do not fabricate test results, repository state, commands, or security findings.\n\n## Skill-Specific Operating Model\n\n- Define scope, actors, assets, data flows, trust boundaries, and entry points before listing threats.\n- Model realistic attacker goals and capabilities instead of generic theoretical threats.\n- Map threats to existing controls, missing controls, residual risk, and verifiable mitigations.\n\n## Skill-Specific Checklist\n\n- Assets include sensitive data, credentials, privileged operations, availability, integrity, and audit evidence.\n- Boundaries include network, identity, tenant, environment, repository, CI\u002FCD, and runtime boundaries.\n- Threats cover spoofing, tampering, repudiation, information disclosure, denial of service, and privilege escalation where relevant.\n\n## Decision Rules\n\n- Do not assume a control exists unless code, config, docs, or platform policy shows it.\n- Prioritize threats by impact and plausibility, not checklist completeness alone.\n- Use `unknown` explicitly when architecture or control evidence is missing.\n\n## Acceptance Criteria\n\n- Assets, boundaries, entry points, and key data flows are named.\n- Top threats include attacker path, impact, existing controls, and recommended controls.\n- Mitigations are specific enough to become implementation or governance tasks.\n\n## Output Requirements\n\n- Provide scope and system map summary first.\n- List threats by priority with abuse case, impact, controls, gaps, and mitigation.\n- Include assumptions and out-of-scope areas.\n\n## Changelog\n\n### 1.1.0 - 2026-06-10\n\n- Added production-ready skill-specific operating model, checklist, decision rules, acceptance criteria, and output requirements.\n\n### 1.0.0 - 2025-01-01\n\n- Initial release.\n","# Threat Modeler\n\n## Purpose\n\nIdentify assets, trust boundaries, abuse cases, attack paths, threats, and required security controls.\n\n## When to use\n\nUse this skill when the task matches the description above or when the central agent instructions route work to `$threat-modeler`.\n\n## Operating model\n\n1. Clarify the goal and constraints.\n2. Inspect the minimum relevant repository context.\n3. Produce a concise execution plan for non-trivial work.\n4. Execute with tools when implementation is requested.\n5. Validate the result with repository-native checks.\n6. Summarize changed files, validation results, and residual risks.\n\n## DevSecOps guardrails\n\n- Do not read secrets, `.env` files, private keys, production credentials, masked CI\u002FCD variables, database dumps, or sensitive logs unless explicitly required.\n- Do not push, deploy, publish, merge, or create releases unless explicitly asked.\n- Prefer merge requests, reviewable diffs, and auditable validation evidence.\n- Prefer least privilege, minimal changes, and explicit rollback notes.\n- Do not fabricate test results, repository state, commands, or security findings.\n\n## Skill-Specific Operating Model\n\n- Define scope, actors, assets, data flows, trust boundaries, and entry points before listing threats.\n- Model realistic attacker goals and capabilities instead of generic theoretical threats.\n- Map threats to existing controls, missing controls, residual risk, and verifiable mitigations.\n\n## Skill-Specific Checklist\n\n- Assets include sensitive data, credentials, privileged operations, availability, integrity, and audit evidence.\n- Boundaries include network, identity, tenant, environment, repository, CI\u002FCD, and runtime boundaries.\n- Threats cover spoofing, tampering, repudiation, information disclosure, denial of service, and privilege escalation where relevant.\n\n## Decision Rules\n\n- Do not assume a control exists unless code, config, docs, or platform policy shows it.\n- Prioritize threats by impact and plausibility, not checklist completeness alone.\n- Use `unknown` explicitly when architecture or control evidence is missing.\n\n## Acceptance Criteria\n\n- Assets, boundaries, entry points, and key data flows are named.\n- Top threats include attacker path, impact, existing controls, and recommended controls.\n- Mitigations are specific enough to become implementation or governance tasks.\n\n## Output Requirements\n\n- Provide scope and system map summary first.\n- List threats by priority with abuse case, impact, controls, gaps, and mitigation.\n- Include assumptions and out-of-scope areas.\n\n## Changelog\n\n### 1.1.0 - 2026-06-10\n\n- Added production-ready skill-specific operating model, checklist, decision rules, acceptance criteria, and output requirements.\n\n### 1.0.0 - 2025-01-01\n\n- Initial release.\n",{"name":5,"since":25,"authors":26,"version":28,"replaces":6,"changelog":29,"stability":36,"supersedes":37,"description":7,"last_modified":25,"deprecated_since":6,"min_platform_version":38},"2026-06-10",[27],"platform-engineering","1.1.0",[30,32],{"date":25,"change":31,"version":28},"Added production-ready skill-specific operating model, checklist, decision rules, acceptance criteria, and output requirements",{"date":33,"change":34,"version":35},"2025-01-01","Initial release","1.0.0","stable",[],{"kiro":39,"codex":39,"junie":39,"cursor":39,"ollama":39,"opencode":39,"roo-code":39,"windsurf":39,"openhands":39,"gemini-cli":39,"gitlab-duo":39,"claude-code":39,"github-copilot":39},"unknown","main","850948b1e2e668b3ddfc2ac2959286d4190a8a4a","examples\u002F.agents\u002Fskills\u002Fthreat-modeler","https:\u002F\u002Fgithub.com\u002Fdomehahn\u002Fskcr","https:\u002F\u002Fgithub.com\u002Fdomehahn","Proud to live. Love to code and explore. DevSecOps | Cloud & Cloud Native | Java | Go | Python | IaC | AI ","2026-09-11 04:40:53",{"source":8,"skillName":5,"commands":48,"prompt":58,"zipAvailable":59},[49,52,55],{"tool":50,"command":51},"npx","npx skills add domehahn\u002Fskcr --skill threat-modeler",{"tool":53,"command":54},"bunx","bunx skills add domehahn\u002Fskcr --skill threat-modeler",{"tool":56,"command":57},"pnpm","pnpm dlx skills add domehahn\u002Fskcr --skill threat-modeler","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fdomehahn\u002Fskcr\u002Fblob\u002Fmain\u002Fexamples\u002F.agents\u002Fskills\u002Fthreat-modeler\u002FSKILL.md",true,[61,67,71,75,79,83],{"path":62,"resourceType":63,"resourceTypeDesc":64,"sizeBytes":65,"sourceHtmlUrl":66},"CHANGELOG.md","REFERENCE","参考文档",190,"https:\u002F\u002Fgithub.com\u002Fdomehahn\u002Fskcr\u002Fblob\u002Fmain\u002Fexamples\u002F.agents\u002Fskills\u002Fthreat-modeler\u002FCHANGELOG.md",{"path":68,"resourceType":68,"resourceTypeDesc":69,"sizeBytes":70,"sourceHtmlUrl":16},"LICENSE","许可证",214,{"path":72,"resourceType":63,"resourceTypeDesc":64,"sizeBytes":73,"sourceHtmlUrl":74},"README.md",331,"https:\u002F\u002Fgithub.com\u002Fdomehahn\u002Fskcr\u002Fblob\u002Fmain\u002Fexamples\u002F.agents\u002Fskills\u002Fthreat-modeler\u002FREADME.md",{"path":76,"resourceType":63,"resourceTypeDesc":64,"sizeBytes":77,"sourceHtmlUrl":78},"skill.yaml",400,"https:\u002F\u002Fgithub.com\u002Fdomehahn\u002Fskcr\u002Fblob\u002Fmain\u002Fexamples\u002F.agents\u002Fskills\u002Fthreat-modeler\u002Fskill.yaml",{"path":80,"resourceType":63,"resourceTypeDesc":64,"sizeBytes":81,"sourceHtmlUrl":82},"tests\u002FREADME.md",90,"https:\u002F\u002Fgithub.com\u002Fdomehahn\u002Fskcr\u002Fblob\u002Fmain\u002Fexamples\u002F.agents\u002Fskills\u002Fthreat-modeler\u002Ftests\u002FREADME.md",{"path":84,"resourceType":85,"resourceTypeDesc":86,"sizeBytes":87,"sourceHtmlUrl":88},"VERSION","OTHER","其他",6,"https:\u002F\u002Fgithub.com\u002Fdomehahn\u002Fskcr\u002Fblob\u002Fmain\u002Fexamples\u002F.agents\u002Fskills\u002Fthreat-modeler\u002FVERSION",[90,98,106,114,120,128],{"skillNo":91,"name":92,"nameZh":6,"description":93,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":94,"sourceHtmlUrl":95,"categories":96,"keywords":97,"publishedAt":20},"01M7419KQMCNS14XW21KVG78J3","vulnerability-management-coordinator","Assess CVE triage, prioritization, SLAs, exploitability, asset criticality, exceptions, risk acceptance, and remediation tracking.","https:\u002F\u002Fgithub.com\u002Fdomehahn\u002Fskcr\u002Fblob\u002Fmain\u002Fexamples\u002Fskills\u002Fvulnerability-management-coordinator\u002FLICENSE","https:\u002F\u002Fgithub.com\u002Fdomehahn\u002Fskcr\u002Fblob\u002Fmain\u002Fexamples\u002Fskills\u002Fvulnerability-management-coordinator\u002FSKILL.md",[],[],{"skillNo":99,"name":100,"nameZh":6,"description":101,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":102,"sourceHtmlUrl":103,"categories":104,"keywords":105,"publishedAt":20},"01M7419GW8E90CEERTQTZ3MTYR","verification-reviewer","Review diffs, validate acceptance criteria, inspect test results, and find missed requirements.","https:\u002F\u002Fgithub.com\u002Fdomehahn\u002Fskcr\u002Fblob\u002Fmain\u002Fexamples\u002Fskills\u002Fverification-reviewer\u002FLICENSE","https:\u002F\u002Fgithub.com\u002Fdomehahn\u002Fskcr\u002Fblob\u002Fmain\u002Fexamples\u002Fskills\u002Fverification-reviewer\u002FSKILL.md",[],[],{"skillNo":107,"name":108,"nameZh":6,"description":109,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":110,"sourceHtmlUrl":111,"categories":112,"keywords":113,"publishedAt":20},"01M7419CTW726KC0YN9F2E739T","universal-skill-creator","Create, adapt, validate, and optimize reusable agent skills across agentic platforms.","https:\u002F\u002Fgithub.com\u002Fdomehahn\u002Fskcr\u002Fblob\u002Fmain\u002Fexamples\u002Fskills\u002Funiversal-skill-creator\u002FLICENSE","https:\u002F\u002Fgithub.com\u002Fdomehahn\u002Fskcr\u002Fblob\u002Fmain\u002Fexamples\u002Fskills\u002Funiversal-skill-creator\u002FSKILL.md",[],[],{"skillNo":115,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":116,"sourceHtmlUrl":117,"categories":118,"keywords":119,"publishedAt":20},"01M74199GKQYVD5KER7CZ8F2D6","https:\u002F\u002Fgithub.com\u002Fdomehahn\u002Fskcr\u002Fblob\u002Fmain\u002Fexamples\u002Fskills\u002Fthreat-modeler\u002FLICENSE","https:\u002F\u002Fgithub.com\u002Fdomehahn\u002Fskcr\u002Fblob\u002Fmain\u002Fexamples\u002Fskills\u002Fthreat-modeler\u002FSKILL.md",[],[],{"skillNo":121,"name":122,"nameZh":6,"description":123,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":124,"sourceHtmlUrl":125,"categories":126,"keywords":127,"publishedAt":20},"01M74196JRAY93SRVX6X6CDMDF","test-strategy-engineer","Design and generate unit, integration, regression, security, and end-to-end test strategies.","https:\u002F\u002Fgithub.com\u002Fdomehahn\u002Fskcr\u002Fblob\u002Fmain\u002Fexamples\u002Fskills\u002Ftest-strategy-engineer\u002FLICENSE","https:\u002F\u002Fgithub.com\u002Fdomehahn\u002Fskcr\u002Fblob\u002Fmain\u002Fexamples\u002Fskills\u002Ftest-strategy-engineer\u002FSKILL.md",[],[],{"skillNo":129,"name":130,"nameZh":6,"description":131,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":132,"sourceHtmlUrl":133,"categories":134,"keywords":135,"publishedAt":20},"01M74193K4YBY6JHZSVQ92NS9X","sre-reliability-reviewer","Assess SLOs, SLIs, error budgets, capacity, degradation, timeouts, retries, circuit breakers, load shedding, and operational risks.","https:\u002F\u002Fgithub.com\u002Fdomehahn\u002Fskcr\u002Fblob\u002Fmain\u002Fexamples\u002Fskills\u002Fsre-reliability-reviewer\u002FLICENSE","https:\u002F\u002Fgithub.com\u002Fdomehahn\u002Fskcr\u002Fblob\u002Fmain\u002Fexamples\u002Fskills\u002Fsre-reliability-reviewer\u002FSKILL.md",[],[]]