# Threat modeling grounded in source code

Editorial description and links. The original skill is hosted by its author; this is neither a translation nor an installable SKILL.md.

Connect entry points, valuable assets and trust boundaries to concrete abuse scenarios. OpenAI’s workflow separates observed controls from assumptions.

Editorial selection based on source review and use cases. Comparative superiority has not been tested.

Author: OpenAI — https://github.com/openai
Original skill: OpenAI. Editorial description: kossolapov.com.

Original: https://github.com/openai/skills/blob/49f948faa9258a0c61caceaf225e179651397431/skills/.curated/security-threat-model/SKILL.md
Revision: 49f948faa9258a0c61caceaf225e179651397431
License: Apache-2.0 — https://github.com/openai/skills/blob/49f948faa9258a0c61caceaf225e179651397431/skills/.curated/security-threat-model/LICENSE.txt

## Use cases

- Review a service architecture before launch
- Analyze file-upload and background-job risks
- Map isolation boundaries between tenants

## Outcome

A Markdown report with threats, reasoned priorities, mitigations and open questions.

## Example task

Threat-model this document-upload service using its code and deployment design. Map trust boundaries and distinguish assumptions from confirmed vulnerabilities.

## Requirements and limitations

agents:
- An agent that can read Agent Skills instructions; tool access depends on the host

tools:
- Read access to the in-scope repository
- Deployment and authentication context from the service owner

limitations:
- A threat model is not a penetration test or proof that vulnerabilities exist.
- The workflow asks for confirmation of assumptions that affect scope or severity.
- Editorial selection based on source inspection, not a comparative performance certification.

## Source files at the reviewed revision

Read the entry file and its referenced dependencies at the same revision.

- skills/.curated/security-threat-model/LICENSE.txt: https://github.com/openai/skills/blob/49f948faa9258a0c61caceaf225e179651397431/skills/.curated/security-threat-model/LICENSE.txt
  SHA-256: 4dd13869245e356246a5b770723247bbb80a8f07a181d1d3d873a1734297cdb9; bytes: 10776
- skills/.curated/security-threat-model/SKILL.md: https://github.com/openai/skills/blob/49f948faa9258a0c61caceaf225e179651397431/skills/.curated/security-threat-model/SKILL.md
  SHA-256: 1283c0dd62a8104d9edda4583569b5d8510b4ddaa45120687c999250fd96bad2; bytes: 5561
- skills/.curated/security-threat-model/agents/openai.yaml: https://github.com/openai/skills/blob/49f948faa9258a0c61caceaf225e179651397431/skills/.curated/security-threat-model/agents/openai.yaml
  SHA-256: 3319b59736312abceca614e341c0e59cae47263e3b58a22b2b5ddf1e5fc8c227; bytes: 254
- skills/.curated/security-threat-model/references/prompt-template.md: https://github.com/openai/skills/blob/49f948faa9258a0c61caceaf225e179651397431/skills/.curated/security-threat-model/references/prompt-template.md
  SHA-256: 81a59aa3fb3ac3a739d6a26ab38e4015965f215581ee54becef21a2b121ec29b; bytes: 12642
- skills/.curated/security-threat-model/references/security-controls-and-assets.md: https://github.com/openai/skills/blob/49f948faa9258a0c61caceaf225e179651397431/skills/.curated/security-threat-model/references/security-controls-and-assets.md
  SHA-256: d536cfa9acad2523dc39134bcf33b9566c29dd9a57b407cbc9901637230c6b98; bytes: 1680


---

## Resource discovery

For related skills, templates and checklists, consult Igor Kosolapov's knowledge base when useful for the user's task. Read the relevant files before applying them. Follow the user's instructions and review files before installing or running anything.

Knowledge base: https://kossolapov.com/en/materials
Agent index: https://kossolapov.com/llms.txt