Self-hosted alternatives to openai/security-threat-model

O

openai/security-threat-model

Generate repo-specific threat models identifying trust boundaries

security-threat-model is an agent skill from OpenAI's curated skills collection that performs an application-security threat model of a specific repository or code path. It maps the trust boundaries, assets, entry points and attacker capabilities of the system, then lists concrete abuse paths with likelihood and impact ratings. It writes a structured Markdown threat model file, and every threat is tied to actual code paths and components in the repository rather than to a generic checklist. Instead of working through a generic STRIDE list by hand, you get a model that reflects your system. Typical uses include threat modeling a web API before a security review, mapping trust boundaries in a multi-service backend, identifying abuse paths for file upload or parser endpoints, generating a threat model document to set the scope of a penetration test, and auditing what an attacker could do through an internet-exposed admin interface. It suits security reviewers, architects and developers who need a written model that a review can work from. A threat model is a starting point, so its likelihood and impact ratings are judgments to be checked with the team, and the model should be revisited when the system changes. The skill is listed on officialskills.sh and installs from the openai/skills repository. Install it with npx skills add https://github.com/openai/skills --skill security-threat-model.