Fla Ascend Performance
fla-org/flash-linear-attention
Guidelines for Ascend NPU kernel / Triton-Ascend backend performance work in the FLA repo.
Usar para modelar amenazas con metodología STRIDE. An agent skill from 686f6c61/alfred-dev.
Install Threat Model
$ npx skills add 686f6c61/alfred-dev --skill threat-model -a claude-codeProject install by default; add -g for ~/.claude/skills/.
$ gh skill install 686f6c61/alfred-dev threat-model --agent claude-codeProject scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).
$ git clone --depth 1 https://github.com/686f6c61/alfred-dev.git skills-src && mkdir -p .claude/skills && cp -r skills-src/skills/threat-model .claude/skills/threat-model && rm -rf skills-srcUse ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.
Claude Code skills documentation · loads skills from .claude/skills/
Install the "threat-model" agent skill from https://github.com/686f6c61/alfred-dev/tree/main/skills/threat-model into .claude/skills/threat-model/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "threat-model", then confirm the skill loads.Claude Code copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$skill-installer install https://github.com/686f6c61/alfred-dev/tree/main/skills/threat-modelType this inside Codex. $skill-installer <name> installs a curated skill from openai/skills. The installer writes to $CODEX_HOME/skills (default ~/.codex/skills). Restart Codex if the skill does not show up.
$ npx skills add 686f6c61/alfred-dev --skill threat-model -a codexProject install goes to .agents/skills/; add -g for ~/.codex/skills/.
$ gh skill install 686f6c61/alfred-dev threat-model --agent codexProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/686f6c61/alfred-dev.git skills-src && mkdir -p .agents/skills && cp -r skills-src/skills/threat-model .agents/skills/threat-model && rm -rf skills-srcUse ~/.agents/skills/ instead of .agents/skills for a personal install.
Codex skills documentation · loads skills from .agents/skills/
Install the "threat-model" agent skill from https://github.com/686f6c61/alfred-dev/tree/main/skills/threat-model into .agents/skills/threat-model/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "threat-model", then confirm the skill loads.Codex copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ npx skills add 686f6c61/alfred-dev --skill threat-model -a cursorProject install goes to .agents/skills/; add -g for ~/.cursor/skills/.
$ gh skill install 686f6c61/alfred-dev threat-model --agent cursorProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/686f6c61/alfred-dev.git skills-src && mkdir -p .cursor/skills && cp -r skills-src/skills/threat-model .cursor/skills/threat-model && rm -rf skills-srcUse ~/.cursor/skills/ instead of .cursor/skills for a personal install.
Cursor skills documentation · loads skills from .cursor/skills/, .agents/skills/, .claude/skills/, .codex/skills/
Install the "threat-model" agent skill from https://github.com/686f6c61/alfred-dev/tree/main/skills/threat-model into .cursor/skills/threat-model/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "threat-model", then confirm the skill loads.Cursor copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ gemini skills install https://github.com/686f6c61/alfred-dev.git --path skills/threat-model--scope user (default) or --scope workspace; --path is the subfolder of the repo that holds the skill; --consent skips the security confirmation prompt.
$ npx skills add 686f6c61/alfred-dev --skill threat-model -a gemini-cliProject install goes to .agents/skills/; add -g for ~/.gemini/skills/.
$ gh skill install 686f6c61/alfred-dev threat-model --agent gemini-cliProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/686f6c61/alfred-dev.git skills-src && mkdir -p .gemini/skills && cp -r skills-src/skills/threat-model .gemini/skills/threat-model && rm -rf skills-srcUse ~/.gemini/skills/ instead of .gemini/skills for a personal install, then run /skills reload.
Gemini CLI skills documentation · loads skills from .gemini/skills/, .agents/skills/
Install the "threat-model" agent skill from https://github.com/686f6c61/alfred-dev/tree/main/skills/threat-model into .gemini/skills/threat-model/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "threat-model", then confirm the skill loads.Gemini CLI copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ gh skill install 686f6c61/alfred-dev threat-modelInstalls for Copilot at project scope by default; add --scope user for a personal install. Preview a skill first with gh skill preview. Needs GitHub CLI 2.90.0 or later (public preview).
$ npx skills add 686f6c61/alfred-dev --skill threat-model -a github-copilotProject install goes to .agents/skills/; add -g for ~/.copilot/skills/.
$ git clone --depth 1 https://github.com/686f6c61/alfred-dev.git skills-src && mkdir -p .github/skills && cp -r skills-src/skills/threat-model .github/skills/threat-model && rm -rf skills-srcUse ~/.copilot/skills/ instead of .github/skills for a personal install. Commit .github/skills so cloud agent and code review can use it.
GitHub Copilot skills documentation · loads skills from .github/skills/, .claude/skills/, .agents/skills/
Install the "threat-model" agent skill from https://github.com/686f6c61/alfred-dev/tree/main/skills/threat-model into .github/skills/threat-model/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "threat-model", then confirm the skill loads.GitHub Copilot copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ npx skills add 686f6c61/alfred-dev --skill threat-model -a opencodeOpenCode documents no install command of its own. Project install goes to .agents/skills/; add -g for ~/.config/opencode/skills/.
$ gh skill install 686f6c61/alfred-dev threat-model --agent opencodeProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/686f6c61/alfred-dev.git skills-src && mkdir -p .opencode/skills && cp -r skills-src/skills/threat-model .opencode/skills/threat-model && rm -rf skills-srcUse ~/.config/opencode/skills/ instead of .opencode/skills for a personal install.
OpenCode skills documentation · loads skills from .opencode/skills/, .claude/skills/, .agents/skills/
Install the "threat-model" agent skill from https://github.com/686f6c61/alfred-dev/tree/main/skills/threat-model into .opencode/skills/threat-model/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "threat-model", then confirm the skill loads.OpenCode copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
Facts
- Skill name
threat-model- GitHub stars
- 117
- Token cost
- ~1.2k tokens
- SKILL.md length
- 613 words
- Files
- 1
- Skills in repo
- 11
- Repo updated
- First seen
- Licence
- MIT
At a glance
Usar para modelar amenazas con metodología STRIDE. An agent skill from 686f6c61/alfred-dev.
- Works in 7 steps: Identificar los componentes del sistema.… → Generar diagrama de flujo de datos… → Aplicar STRIDE a cada componente. Para… → …
- Tasks that involve Threat modeling
- SKILL.md covers Resumen, Proceso, Criterios de éxito and Paso de memoria, plus 1 more section
- Instructions only: no scripts, shell commands, URLs or credentials in SKILL.md
What it does
Threat Model is an agent skill from 686f6c61/alfred-dev. Usar para modelar amenazas con metodología STRIDE. También: análisis de amenazas, STRIDE, superficie de ataque, vectores de ataque, modelado de amenazas.
Its SKILL.md is about 1.2k tokens, which your agent loads only when the skill is triggered. It is a single SKILL.md file with no bundled scripts.
It sits in Security, covering Threat modeling. The repository describes itself as: Tu equipo de desarrolladores en un plugin. 10 agentes, 11 skills planas, 18 comandos /alfred-dev:. Memoria persistente, quality gates con evidencia y MCP local. The licence is MIT.
When your agent uses it
- Tasks that involve Threat modeling
Example prompts
- “/threat-model”
Workflow steps
7 steps, taken from the first numbered list in SKILL.md.
- Identificar los componentes del sistema. Listar todos los elementos relevantes
- Generar diagrama de flujo de datos (DFD). Dibujar con Mermaid los flujos de datos entre componentes, identificando los límites de…
- Aplicar STRIDE a cada componente. Para cada elemento del diagrama, evaluar las seis categorías
- Clasificar cada amenaza por riesgo. Usar una matriz de probabilidad e impacto
- Proponer mitigaciones para cada amenaza. Las mitigaciones deben ser concretas y accionables
- Priorizar por ratio riesgo/esfuerzo. Las mitigaciones de alto impacto y bajo esfuerzo van primero. Las de bajo impacto y alto esfuerzo se…
- Documentar el modelo. Destino canónico: docs/project/threat-model.md.
What it can do on your machine
Read from SKILL.md and the folder at commit be0b51e. It shows what the files ask for, not the result of running them.
Tool permissions
Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.
From allowed-tools in the SKILL.md frontmatter.
Runs code
No scripts in the folder and no shell commands in SKILL.md.
From the folder's file list and the shell code blocks in SKILL.md.
Network
No URLs in SKILL.md.
From URLs in SKILL.md, links to its own repository left out.
Credentials
Names no API keys, tokens, secrets or passwords.
From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.
Context cost
Threat Model loads about 1.2k tokens when it runs. Until then it costs about 42 tokens; SKILL.md has 613 words of instructions outside code blocks.
Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.
Safety
Auto-check passed
The automated check found no risky patterns in SKILL.md.
Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); files beside SKILL.md are not scanned.
SKILL.md
The full file from 686f6c61/alfred-dev at commit be0b51e, republished under its MIT licence (© 686f6c61). 613 words, ~1,210 tokens.
Download SKILL.mdSave it as
.claude/skills/threat-model/SKILL.md (or your agent's skills folder).- name
- threat-model
- description
- Usar para modelar amenazas con metodología STRIDE. También: análisis de amenazas, STRIDE, superficie de ataque, vectores de ataque, modelado de amenazas.
Modelado de amenazas STRIDE
Resumen
Este skill aplica la metodología STRIDE para identificar y clasificar amenazas de seguridad en el sistema. STRIDE es un modelo desarrollado por Microsoft que categoriza las amenazas en seis tipos, proporcionando un framework sistemático para no dejarse nada en el tintero.
El modelado de amenazas se hace idealmente al principio del desarrollo (cuando es más barato corregir), pero también es valioso como ejercicio periódico para sistemas existentes.
Proceso
Identificar los componentes del sistema. Listar todos los elementos relevantes:
- Aplicaciones y servicios.
- Bases de datos y almacenes de datos.
- APIs e interfaces externas.
- Infraestructura (servidores, redes, balanceadores).
- Usuarios y roles.
- Flujos de datos entre componentes.
Generar diagrama de flujo de datos (DFD). Dibujar con Mermaid los flujos de datos entre componentes, identificando los límites de confianza (trust boundaries). Las amenazas suelen concentrarse en los puntos donde los datos cruzan un límite de confianza.
Aplicar STRIDE a cada componente. Para cada elemento del diagrama, evaluar las seis categorías:
Categoría Descripción Pregunta clave Spoofing (suplantación) Un atacante se hace pasar por otro usuario o sistema. Cómo se verifica la identidad en este punto? Tampering (manipulación) Un atacante modifica datos en tránsito o en reposo. Cómo se garantiza la integridad de los datos? Repudiation (repudio) Un usuario niega haber realizado una acción. Hay registro de auditoría fiable? Information Disclosure (fuga de información) Datos sensibles se exponen a quien no debería verlos. Qué datos se exponen y a quién? Denial of Service (denegación de servicio) El sistema se vuelve inaccesible para usuarios legítimos. Qué recursos se pueden agotar? Elevation of Privilege (elevación de privilegios) Un usuario obtiene permisos que no le corresponden. Cómo se aplican los controles de acceso? Clasificar cada amenaza por riesgo. Usar una matriz de probabilidad e impacto:
- Probabilidad: alta (fácil de explotar, atacante poco sofisticado) / media / baja (requiere acceso interno y conocimiento especializado).
- Impacto: crítico (pérdida de datos, brecha de seguridad) / alto (interrupción del servicio) / medio (degradación parcial) / bajo (molestia menor).
Proponer mitigaciones para cada amenaza. Las mitigaciones deben ser concretas y accionables:
- No: "mejorar la seguridad".
- Sí: "implementar rate limiting de 100 peticiones/minuto en el endpoint de login".
Priorizar por ratio riesgo/esfuerzo. Las mitigaciones de alto impacto y bajo esfuerzo van primero. Las de bajo impacto y alto esfuerzo se documentan pero se posponen.
Documentar el modelo. Destino canónico:
docs/project/threat-model.md. Si no existe, créalo consync-project-docs. Parte de componentes y flujos reales, no de una lista genérica. Usatemplates/threat-model.mdcomo forma. Sustituye<!-- alfred-doc:scaffold -->por<!-- alfred-doc:filled -->.
Show full SKILL.md (198 more words)Show less
Criterios de éxito
- Todos los componentes del sistema han sido evaluados contra las 6 categorías STRIDE.
- Las amenazas están clasificadas por probabilidad e impacto.
- Cada amenaza tiene al menos una mitigación propuesta.
- Las mitigaciones están priorizadas por ratio riesgo/esfuerzo.
- El modelo vive en
docs/project/threat-model.mdcon marcadorfilled. - Las amenazas y mitigaciones se han registrado en la memoria del proyecto.
Paso de memoria
Registrar las amenazas identificadas y las mitigaciones propuestas en la memoria del proyecto con memory_log_decision. Esto permite hacer seguimiento del estado de las mitigaciones entre sesiones y detectar si aparecen nuevas superficies de ataque con la evolución del sistema.
Qué NO hacer
- No modelar amenazas en abstracto sin conocer la arquitectura real del sistema. El modelo debe partir de los componentes y flujos de datos concretos, no de una lista genérica.
- No limitarse a las amenazas técnicas. Las amenazas organizativas (ingeniería social, acceso físico, insiders) también son relevantes si el sistema maneja datos sensibles.
- No dejar el modelo de amenazas como un documento estático. Debe revisarse cuando cambia la arquitectura, se añaden integraciones o se despliega en un nuevo entorno.
- No proponer mitigaciones vagas como "mejorar la seguridad". Cada mitigación debe ser concreta, implementable y verificable.
© 686f6c61, MIT. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file
Files
Just SKILL.md in skills/threat-model of 686f6c61/alfred-dev.
Open the folder on GitHubat commit be0b51e
Compare with similar skills
Threat Model next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.
| Skill | Stars | Used in | Tokens | Auto-check | Licence | Repo updated |
|---|---|---|---|---|---|---|
| Threat Model this skill686f6c61/alfred-dev | 117 | — | ~1.2k | Automated safety check: Pass | MIT | |
| Fla Ascend Performancefla-org/flash-linear-attention | 5.8k | — | ~6.3k | Automated safety check: Pass | MIT | |
| Forensifyalexgreensh/repo-forensics | 188 | — | ~2.5k | Automated safety check: Notes | Custom licence | |
| Create Rulecartography-cncf/cartography | 4.1k | — | ~3k | Automated safety check: Pass | Apache-2.0 | |
| Commit Security Scancodexstar69/bug-hunter | 519 | — | ~629 | Automated safety check: Pass | MIT | |
| Auditing Code For Vulnerabilitiestrilwu/secskills | 157 | — | ~3.2k | Automated safety check: Pass | MIT |
Similar skills
Forensify
alexgreensh/repo-forensics
Cross-agent self-inspection of your AI-agent stack. An agent skill from alexgreensh/repo-forensics.
Create Rule
cartography-cncf/cartography
Author a Cartography security rule (one or more Cypher Facts plus a Pydantic Finding output model) under cartography/rules/data/rules/.
Commit Security Scan
codexstar69/bug-hunter
Scan code changes for security vulnerabilities using Bug Hunter-native artifacts and STRIDE context.
Auditing Code For Vulnerabilities
trilwu/secskills
Audit source code for exploitable vulnerabilities using threat-model-driven review, taint tracing, invariant checking, and variant analysis.
Threat Mitigation Mapping
wshobson/agents
Match identified threats to preventive, detective and corrective controls across network, application, data, endpoint and process layers to plan remediation.
More from 686f6c61/alfred-dev
All 11 skills in this repoIncident Response
686f6c61/alfred-dev
Protocolo de respuesta ante incidentes en produccion: triaje, mitigacion, causa raiz y postmortem.
Memory
686f6c61/alfred-dev
This skill should be used when the user asks to record a design decision, search past project decisions, inspect the Alfred memory timeline, or work with the alfred-memory MCP server.
PR Workflow
686f6c61/alfred-dev
Crear pull requests completas con descripcion, labels y reviewers
Sonarqube
686f6c61/alfred-dev
Levantar SonarQube con Docker, analizar el código y proponer mejoras.
Style Direction
686f6c61/alfred-dev
Abrir y operar el companion visual de Selina para elegir una direccion de estilo en proyectos con interfaz.
Sync Project Docs
686f6c61/alfred-dev
Usar para sincronizar la documentación viva del proyecto después de una fase.
Related
Categories
Questions about Threat Model
What does Threat Model do?
Usar para modelar amenazas con metodología STRIDE. An agent skill from 686f6c61/alfred-dev. Threat Model is an agent skill from 686f6c61/alfred-dev. Usar para modelar amenazas con metodología STRIDE.
When should I use Threat Model?
Threat Model fits situations like: tasks that involve Threat modeling.
How do I install Threat Model in Claude Code?
Run `npx skills add 686f6c61/alfred-dev --skill threat-model -a claude-code`. Or copy the skill folder (skills/threat-model in 686f6c61/alfred-dev) into .claude/skills/threat-model in your project. Claude Code loads it when a task matches its description.
How do I install Threat Model in Codex?
Run `npx skills add 686f6c61/alfred-dev --skill threat-model -a codex`. Or copy the skill folder (skills/threat-model in 686f6c61/alfred-dev) into .agents/skills/threat-model in your project. Codex loads it when a task matches its description.
Can I use Threat Model in Cursor, Gemini CLI or GitHub Copilot?
Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add 686f6c61/alfred-dev --skill threat-model -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/threat-model, .gemini/skills/threat-model, .github/skills/threat-model and .opencode/skills/threat-model in your project.
What does Threat Model need to run?
SKILL.md names no scripts, command-line tools or credentials: Threat Model is instructions for the agent only.
Does Threat Model access the network?
SKILL.md contains no URLs. Any network use would come from the scripts or tools the agent runs. This is read from the text; nothing was executed.
Is Threat Model safe to install?
Our automated static check of SKILL.md found no risky patterns, such as piping downloads into a shell, reading credential files or hidden Unicode. It is not a guarantee. Review the folder before installing.
What licence does Threat Model use?
Threat Model is published under the MIT licence (the repository's licence). It allows redistribution, so the full SKILL.md is shown on this page.
How many tokens does Threat Model use?
About 1.2k tokens (SKILL.md is roughly 4.8k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full.
What are the alternatives to Threat Model?
Skills that share tags, products or a category with Threat Model: Fla Ascend Performance (fla-org/flash-linear-attention, 5.8k stars), Forensify (alexgreensh/repo-forensics, 188 stars), Create Rule (cartography-cncf/cartography, 4.1k stars) and Commit Security Scan (codexstar69/bug-hunter, 519 stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.
Who maintains Threat Model?
686f6c61 (a GitHub user) maintains it in 686f6c61/alfred-dev, which has 117 GitHub stars. The repository holds 11 skills in this directory. The repository was last updated on August 15, 2026.
Source: 686f6c61/alfred-dev on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.