Agent skill · OpenAI

Security Threat Model skill for Claude Code, Codex and Cursor

Writes a threat model for a repository: trust boundaries, assets, attack paths and mitigations.

Officialname: security-threat-model★ 28k (repo)pushed 2026-09-08Apache-2.0SKILL.md on GitHubchecked 2026-11-07

What it does, in the publisher's words

Repository-grounded threat modeling that enumerates trust boundaries, assets, attacker capabilities, abuse paths, and mitigations, and writes a concise Markdown threat model. Trigger only when the user explicitly asks to threat model a codebase or path, enumerate threats/abuse paths, or perform AppSec threat modeling. Do not trigger for general architecture summaries, code review, or non-security design work.

The description field of the SKILL.md. The agent reads only this at startup and decides from it when to load the full skill.

Install Security Threat Model

The skills CLI copies the skill into the folder of each agent you pick (Claude Code, Codex, Cursor, Copilot, Gemini CLI, OpenCode, Windsurf...). Add -g for all projects. Needs Node.js 22.20+. docs

npx skills add openai/skills --skill security-threat-model

Copy the skill folder into ~/.claude/skills (all projects) or .claude/skills (this repo). Claude Code picks it up without a restart. docs

npx skills add openai/skills --skill security-threat-model -a claude-code

# or by hand:
git clone --depth 1 https://github.com/openai/skills.git /tmp/security-threat-model-src
cp -r /tmp/security-threat-model-src/skills/.curated/security-threat-model ~/.claude/skills/security-threat-model

Download the skill folder, zip it, then Customize > Skills > + > Create skill > Upload a skill. Code execution must be on (Settings > Capabilities). docs

git clone --depth 1 https://github.com/openai/skills.git /tmp/security-threat-model-src
cp -r /tmp/security-threat-model-src/skills/.curated/security-threat-model ./security-threat-model
zip -r security-threat-model.zip security-threat-model

It's in OpenAI's own catalog: ask Codex for $skill-installer security-threat-model, or use the skills CLI. docs

$skill-installer security-threat-model

gh skill (GitHub CLI 2.90+, preview) installs it for Copilot in VS Code, the CLI and the cloud agent. Copilot also reads .github/skills and ~/.copilot/skills. docs

gh skill install openai/skills security-threat-model

Cursor reads .cursor/skills, .agents/skills and ~/.cursor/skills (and .claude/skills). It does not install loose skills from a GitHub URL, so copy it in. docs

npx skills add openai/skills --skill security-threat-model -a cursor

Installs from the GitHub repo; --path picks this skill out of the repo. Default scope is user (all projects). docs

gemini skills install https://github.com/openai/skills.git --path skills/.curated/security-threat-model

OpenCode reads .opencode/skills, ~/.config/opencode/skills and the Claude and .agents folders. docs

npx skills add openai/skills --skill security-threat-model -a opencode

Windsurf (now Devin Desktop) reads .devin/skills, .windsurf/skills and ~/.codeium/windsurf/skills. docs

npx skills add openai/skills --skill security-threat-model -a windsurf

Works with

Claude Code, Claude.ai and Claude Desktop, Codex, GitHub Copilot, Cursor, Gemini CLI, OpenCode, Windsurf and other agents that read the open Agent Skills format.

What's in the SKILL.md

12 sections

Quick start
Workflow
1) Scope and extract the system model
2) Derive boundaries, assets, and entry points
3) Calibrate assets and attacker capabilities
4) Enumerate threats as abuse paths
5) Prioritize with explicit likelihood and impact reasoning
6) Validate service context and assumptions with the user
7) Recommend mitigations and focus paths
8) Run a quality check before finalizing
Risk prioritization guidance (illustrative, not exhaustive)
References

Bundled files

LICENSE.txt
agents/openai.yaml
references/prompt-template.md
references/security-controls-and-assets.md

Loaded only when the instructions point to them.

Facts

Skill name: security-threat-model
Publisher: OpenAI (official)
Repo: openai/skills
License: Apache-2.0
SKILL.md size: 702 words, 77 lines
Bundled files: 4, 2 docs
Repo stars: 28k (as of 2026-10-24)
SKILL.md checked: 2026-11-07

More skills from openai/skills

ChatGPT Apps: Scaffolds and debugs ChatGPT apps built with the Apps SDK: an MCP server plus widget UI.
GitHub: Address PR Comments: Works through review comments on the current branch's pull request using the gh CLI.
GitHub: Fix CI: Reads failing GitHub Actions checks with gh, summarizes the cause and proposes a fix.
Image Generation: Generates or edits raster images such as illustrations, sprites, mockups and transparent cutouts.
Linear: Reads, creates and updates Linear issues and projects from the agent.
OpenAI Docs: Looks up current OpenAI API and Codex documentation and helps pick a model.
Playwright Browser Automation: Automates a real browser from the terminal for form filling, snapshots, scraping and UI debugging.
Security Best Practices Review: Reviews code for language- and framework-specific security issues and suggests safer defaults.
Skill Installer (Codex): Codex's built-in helper that installs skills from the curated list or any GitHub repo path.

Related security & auth skills

Sign In With Google (Web) · Google
Agentic Actions Auditor · Trail of Bits
CodeQL Scan · Trail of Bits
Constant-Time Analysis · Trail of Bits
Differential Security Review · Trail of Bits
Semgrep Rule Creator · Trail of Bits
Sharp Edges · Trail of Bits
Security Review (Sentry) · Sentry

FAQ

What does the security-threat-model skill do?+

Writes a threat model for a repository: trust boundaries, assets, attack paths and mitigations. In its own SKILL.md, OpenAI describes it as: "Repository-grounded threat modeling that enumerates trust boundaries, assets, attacker capabilities, abuse paths, and mitigations, and writes a concise Markdown threat model."

How do I install the security-threat-model skill?+

Run npx skills add openai/skills --skill security-threat-model and pick your agents, or use the tab for your agent above. In Claude Code the skill ends up in ~/.claude/skills/security-threat-model/SKILL.md; in Codex and Cursor in .agents/skills/security-threat-model/.

Does Security Threat Model work in Codex, Cursor and Copilot, or only Claude?+

It's a standard SKILL.md, so any agent that reads the Agent Skills format can use it: Claude Code, the Claude apps, Codex, GitHub Copilot, Cursor, Gemini CLI, OpenCode, Windsurf and more.

Who maintains Security Threat Model?+

OpenAI, the company or project behind it, in the openai/skills repo on GitHub, last pushed 2026-09-08. License: Apache-2.0.

Read a skill's SKILL.md and scripts before you install it: skills aren't verified by any agent vendor. Claude skills marketplace · How to install skills · MCP servers