---
name: repository-threat-model
description: "Builds a threat model of a repository: its assets, trust boundaries, attacker capabilities, and abuse paths, each tied to the code that enables it. Use when a maintainer or security reviewer needs a code-anchored threat model of a repository, with abuse paths from attacker capability to harm. Do not use for scanning for known vulnerabilities in dependencies or a compliance audit. Related topics: coding, technical."
---

# Repository Threat Model

Builds a threat model of a repository: its assets, trust boundaries, attacker capabilities, and abuse paths, each tied to the code that enables it.

## When to use

Use this skill when a maintainer or security reviewer needs a code-anchored threat model of a repository, with abuse paths from attacker capability to harm. Do not use it for scanning for known vulnerabilities in dependencies or a compliance audit.

## Workflow

1. Ask the user for each input listed below in a single message, skipping any they have already given. Where options are listed, offer them, but accept other answers too.
2. Read the code in scope and list the assets with where each is stored or processed.
3. Describe the trust boundaries where data moves from less to more trusted components.
4. State what each chosen attacker type can do now and what they must not be able to do.
5. Write numbered abuse paths citing the file and function at each step, rated by likelihood and impact.
6. Propose the cheapest control that breaks each path and list the five paths to fix first.

## Inputs

- **Repository and purpose** (longer free text)
- **Deployment shape** (choose one: Web service, Library, CLI tool, Mobile app, Serverless, Batch job)
- **Key entry points** (longer free text)
- **Most valuable assets** (choose any: User data, Credentials, Money movement, Source code, Availability, Reputation)
- **Attacker types to consider** (choose any: Anonymous internet user, Authenticated user, Malicious insider, Compromised dependency)
- **Scope of code to read** (free text, e.g. "Folders or services")

## Output

An assets list, trust boundaries, attacker capabilities, a table of abuse paths with code references and ratings, controls, and a top five list, with unconfirmed items marked.

## Prompt template

Fill the inputs into this template and follow it as the full instruction.

### Repository Threat Model

Threat model this repository.

- Repository and purpose: {{Repository and purpose}}
- Deployment shape: {{Deployment shape}}
- Key entry points: {{Key entry points}}
- Most valuable assets: {{Most valuable assets}}
- Attacker types to consider: {{Attacker types to consider}}
- Scope of code to read: {{Scope of code to read}}

Read the code before theorising. List the assets and where each is stored or processed. Draw the trust boundaries in words: where data crosses from less trusted to more trusted. For each attacker type, state what they can already do and what they must not be able to do. Then write abuse paths: a numbered chain of steps from attacker capability to harm, and cite the file and function at each step. Rate each path by likelihood and impact, with a one-line reason. For every path propose the cheapest control that breaks the chain, naming where it goes. Mark anything you inferred but could not confirm in code. End with the five paths to fix first.

## Pitfalls

- Writing generic threats with no file or function cited, which cannot be acted on.
- Treating every path as high impact, which hides the ones that matter.
- Presenting inferences about code never read as confirmed findings.