Threat model
Builds a threat model grounded in the actual repository, covering assets, trust boundaries, abuse paths and mitigations.
When to use it
- You are launching something that handles sensitive data.
- You want to understand how the system could be abused.
- A security review needs a threat model first.
It only runs when you ask for a threat model.
A practical example
You ask
“Threat model the new public API.”
Your agent does
It maps assets and trust boundaries from the code, lists likely abuse paths and recommends mitigations by priority.
What gets installed
The whole folder is copied, so scripts, references and any license notices stay together.
- agents/openai.yaml254 bytes
- LICENSE.txt10,776 bytes
- references/prompt-template.md12,642 bytes
- references/security-controls-and-assets.md1,680 bytes
- SKILL.md8,110 bytes
Credit and license
An original workflow that incorporates OpenAI’s security review material. It’s shared under the Apache License 2.0, and the license file is installed with it however you choose to install.