Fla Ascend Performance
fla-org/flash-linear-attention
Guidelines for Ascend NPU kernel / Triton-Ascend backend performance work in the FLA repo.
Threat modeling and attack surface analysis. An agent skill from hashgraph-online/awesome-codex-plugins.
Install Threat Model
$ npx skills add hashgraph-online/awesome-codex-plugins --skill threat-model -a claude-codeProject install by default; add -g for ~/.claude/skills/.
$ gh skill install hashgraph-online/awesome-codex-plugins threat-model --agent claude-codeProject scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).
$ git clone --depth 1 https://github.com/hashgraph-online/awesome-codex-plugins.git skills-src && mkdir -p .claude/skills && cp -r skills-src/plugins/epicsagas/epic-harness/skills/threat-model .claude/skills/threat-model && rm -rf skills-srcUse ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.
Claude Code skills documentation · loads skills from .claude/skills/
Install the "threat-model" agent skill from https://github.com/hashgraph-online/awesome-codex-plugins/tree/main/plugins/epicsagas/epic-harness/skills/threat-model into .claude/skills/threat-model/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "threat-model", then confirm the skill loads.Claude Code copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$skill-installer install https://github.com/hashgraph-online/awesome-codex-plugins/tree/main/plugins/epicsagas/epic-harness/skills/threat-modelType this inside Codex. $skill-installer <name> installs a curated skill from openai/skills. The installer writes to $CODEX_HOME/skills (default ~/.codex/skills). Restart Codex if the skill does not show up.
$ npx skills add hashgraph-online/awesome-codex-plugins --skill threat-model -a codexProject install goes to .agents/skills/; add -g for ~/.codex/skills/.
$ gh skill install hashgraph-online/awesome-codex-plugins threat-model --agent codexProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/hashgraph-online/awesome-codex-plugins.git skills-src && mkdir -p .agents/skills && cp -r skills-src/plugins/epicsagas/epic-harness/skills/threat-model .agents/skills/threat-model && rm -rf skills-srcUse ~/.agents/skills/ instead of .agents/skills for a personal install.
Codex skills documentation · loads skills from .agents/skills/
Install the "threat-model" agent skill from https://github.com/hashgraph-online/awesome-codex-plugins/tree/main/plugins/epicsagas/epic-harness/skills/threat-model into .agents/skills/threat-model/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "threat-model", then confirm the skill loads.Codex copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ npx skills add hashgraph-online/awesome-codex-plugins --skill threat-model -a cursorProject install goes to .agents/skills/; add -g for ~/.cursor/skills/.
$ gh skill install hashgraph-online/awesome-codex-plugins threat-model --agent cursorProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/hashgraph-online/awesome-codex-plugins.git skills-src && mkdir -p .cursor/skills && cp -r skills-src/plugins/epicsagas/epic-harness/skills/threat-model .cursor/skills/threat-model && rm -rf skills-srcUse ~/.cursor/skills/ instead of .cursor/skills for a personal install.
Cursor skills documentation · loads skills from .cursor/skills/, .agents/skills/, .claude/skills/, .codex/skills/
Install the "threat-model" agent skill from https://github.com/hashgraph-online/awesome-codex-plugins/tree/main/plugins/epicsagas/epic-harness/skills/threat-model into .cursor/skills/threat-model/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "threat-model", then confirm the skill loads.Cursor copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ gemini skills install https://github.com/hashgraph-online/awesome-codex-plugins.git --path plugins/epicsagas/epic-harness/skills/threat-model--scope user (default) or --scope workspace; --path is the subfolder of the repo that holds the skill; --consent skips the security confirmation prompt.
$ npx skills add hashgraph-online/awesome-codex-plugins --skill threat-model -a gemini-cliProject install goes to .agents/skills/; add -g for ~/.gemini/skills/.
$ gh skill install hashgraph-online/awesome-codex-plugins threat-model --agent gemini-cliProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/hashgraph-online/awesome-codex-plugins.git skills-src && mkdir -p .gemini/skills && cp -r skills-src/plugins/epicsagas/epic-harness/skills/threat-model .gemini/skills/threat-model && rm -rf skills-srcUse ~/.gemini/skills/ instead of .gemini/skills for a personal install, then run /skills reload.
Gemini CLI skills documentation · loads skills from .gemini/skills/, .agents/skills/
Install the "threat-model" agent skill from https://github.com/hashgraph-online/awesome-codex-plugins/tree/main/plugins/epicsagas/epic-harness/skills/threat-model into .gemini/skills/threat-model/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "threat-model", then confirm the skill loads.Gemini CLI copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ gh skill install hashgraph-online/awesome-codex-plugins threat-modelInstalls for Copilot at project scope by default; add --scope user for a personal install. Preview a skill first with gh skill preview. Needs GitHub CLI 2.90.0 or later (public preview).
$ npx skills add hashgraph-online/awesome-codex-plugins --skill threat-model -a github-copilotProject install goes to .agents/skills/; add -g for ~/.copilot/skills/.
$ git clone --depth 1 https://github.com/hashgraph-online/awesome-codex-plugins.git skills-src && mkdir -p .github/skills && cp -r skills-src/plugins/epicsagas/epic-harness/skills/threat-model .github/skills/threat-model && rm -rf skills-srcUse ~/.copilot/skills/ instead of .github/skills for a personal install. Commit .github/skills so cloud agent and code review can use it.
GitHub Copilot skills documentation · loads skills from .github/skills/, .claude/skills/, .agents/skills/
Install the "threat-model" agent skill from https://github.com/hashgraph-online/awesome-codex-plugins/tree/main/plugins/epicsagas/epic-harness/skills/threat-model into .github/skills/threat-model/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "threat-model", then confirm the skill loads.GitHub Copilot copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ npx skills add hashgraph-online/awesome-codex-plugins --skill threat-model -a opencodeOpenCode documents no install command of its own. Project install goes to .agents/skills/; add -g for ~/.config/opencode/skills/.
$ gh skill install hashgraph-online/awesome-codex-plugins threat-model --agent opencodeProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/hashgraph-online/awesome-codex-plugins.git skills-src && mkdir -p .opencode/skills && cp -r skills-src/plugins/epicsagas/epic-harness/skills/threat-model .opencode/skills/threat-model && rm -rf skills-srcUse ~/.config/opencode/skills/ instead of .opencode/skills for a personal install.
OpenCode skills documentation · loads skills from .opencode/skills/, .claude/skills/, .agents/skills/
Install the "threat-model" agent skill from https://github.com/hashgraph-online/awesome-codex-plugins/tree/main/plugins/epicsagas/epic-harness/skills/threat-model into .opencode/skills/threat-model/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "threat-model", then confirm the skill loads.OpenCode copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
Facts
- Skill name
threat-model- GitHub stars
- 1.3k
- Token cost
- ~1.1k tokens
- SKILL.md length
- 422 words
- Files
- 1
- Skills in repo
- 714
- Repo updated
- First seen
- Licence
- Apache-2.0
At a glance
Threat modeling and attack surface analysis. An agent skill from hashgraph-online/awesome-codex-plugins.
- Works in 6 steps: Load Engagement Context → Identify Trust Boundaries → Enumerate Threat Actors → …
- Assessing security boundaries
- SKILL.md covers Iron Law, Process, Anti-Rationalization and Evidence Required, plus 1 more section
- Instructions only: no scripts, shell commands, URLs or credentials in SKILL.md
What it does
Threat Model is an agent skill from hashgraph-online/awesome-codex-plugins. Threat modeling and attack surface analysis. Use when assessing security boundaries, modeling threat actors, or generating threat scenarios.
Its SKILL.md is about 1.1k tokens, which your agent loads only when the skill is triggered. It is a single SKILL.md file with no bundled scripts.
It sits in Security, covering Threat modeling. The repository describes itself as: A curated list of awesome OpenAI Codex / ChatGPT plugins, skills, and resources. The 1 Codex Marketplace. See live plugins at: https://hol.org/plugins/best-codex-plugins. The licence is Apache-2.0.
When your agent uses it
- Assessing security boundaries
- Modeling threat actors
- Generating threat scenarios
Example prompts
- “/threat-model”
Workflow steps
6 steps, taken from the step headings in SKILL.md.
What it can do on your machine
Read from SKILL.md and the folder at commit 9e7b281. It shows what the files ask for, not the result of running them.
Tool permissions
Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.
From allowed-tools in the SKILL.md frontmatter.
Runs code
No scripts in the folder and no shell commands in SKILL.md (its code samples are markdown).
From the folder's file list and the shell code blocks in SKILL.md.
Network
No URLs in SKILL.md.
From URLs in SKILL.md, links to its own repository left out.
Credentials
Names no API keys, tokens, secrets or passwords.
From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.
Context cost
Threat Model loads about 1.1k tokens when it runs. Until then it costs about 38 tokens; SKILL.md has 422 words of instructions outside code blocks.
Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.
Safety
Auto-check passed
The automated check found no risky patterns in SKILL.md.
Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); files beside SKILL.md are not scanned.
SKILL.md
The full file from hashgraph-online/awesome-codex-plugins at commit 9e7b281, republished under its Apache-2.0 licence (© hashgraph-online). 422 words, ~1,087 tokens.
Download SKILL.mdSave it as
.claude/skills/threat-model/SKILL.md (or your agent's skills folder).- name
- threat-model
- description
- Threat modeling and attack surface analysis. Use when assessing security boundaries, modeling threat actors, or generating threat scenarios.
Threat Model — Attack Surface Analysis
Iron Law
Every system has an attack surface. If you haven't identified it, you haven't secured it.
Process
Step 0: Load Engagement Context
Check for .harness/engagement.md in the project root. If present, load the scope (in-scope/out-of-scope) and constraints. Skip threat modeling for explicitly out-of-scope components.
Without engagement context, proceed with full-surface analysis.
Step 1: Identify Trust Boundaries
Map every boundary where data crosses a trust level:
- External → Internal: API endpoints, webhooks, file uploads, user input
- Internal → Privileged: DB queries, file system access, shell execution
- Service → Service: Inter-service communication, message queues, shared state
- Client → Server: Auth tokens, session state, CORS origins
For each boundary, document:
- Data flow direction
- Input validation present (yes/no/partial)
- Authentication required (yes/no)
- Encryption in transit (yes/no)
Step 2: Enumerate Threat Actors
| Actor | Motivation | Capability | Target |
|---|---|---|---|
| Anonymous user | Exploration | Low | Public endpoints |
| Authenticated user | Data access | Medium | Own data + IDOR targets |
| Malicious insider | Data exfiltration | High | All internal systems |
| Compromised dependency | Supply chain | Variable | Build/deploy pipeline |
Step 3: Generate Threat Scenarios
For each trust boundary × threat actor combination, generate:
- Attack vector: How the boundary is crossed maliciously
- Impact: What is compromised (CIA triad — Confidentiality, Integrity, Availability)
- Likelihood: High/Medium/Low based on exposure and complexity
- Existing mitigations: What already prevents this
- Gap: What is missing
Step 4: Produce Output
Write THREAT_MODEL.md:
# Threat Model — {project}
## Scope
- In-scope: {from engagement.md or full codebase}
- Out-of-scope: {from engagement.md or none}
- Date: {ISO date}
## Trust Boundaries
| # | Boundary | Direction | Validation | Auth | Encryption |
|---|----------|-----------|------------|------|------------|
| 1 | ... | ... | ... | ... | ... |
## Threat Scenarios
| ID | Boundary | Actor | Vector | Impact | Likelihood | Mitigated | Gap |
|----|----------|-------|--------|--------|------------|-----------|-----|
| T1 | ... | ... | ... | ... | ... | Partial | ... |
## Priority Remediation
1. [CRITICAL] {highest risk gap}
2. [HIGH] {next gap}
3. [MEDIUM] {remaining gaps}
## Assumptions
- {list all assumptions made during analysis}Step 5: Feed into vuln-scan
After producing the threat model, suggest:
"Run /vuln-scan to validate threat scenarios against the codebase."
Show full SKILL.md (178 more words)Show less
Anti-Rationalization
| Excuse | Rebuttal | What to do instead |
|---|---|---|
| "We don't have any external-facing components" | Internal trust boundaries are attack surfaces too. Lateral movement starts inside. | Model internal boundaries with the same rigor. |
| "Threat modeling is overkill for a small project" | Small projects get breached too. The model is proportional to the codebase. | Run the process. It takes 10 minutes. A breach takes months. |
| "We already have a threat model" | Threat models expire. Every code change can invalidate assumptions. | Update the model when significant changes land. |
| "The framework handles security" | Frameworks don't model YOUR business logic threats. | Add application-layer threat scenarios on top of framework defaults. |
Evidence Required
- Every trust boundary in the codebase identified
- At least 2 threat scenarios per boundary
- Each scenario has impact, likelihood, and gap assessment
- Priority remediation list ordered by risk
- Assumptions explicitly listed (not hidden)
Red Flags
- Skipping boundaries because they're "internal"
- Listing only one threat scenario per boundary
- Marking all scenarios as "already mitigated" without evidence
- No assumptions section — means assumptions are hidden, not absent
- Threat model that doesn't reference actual code paths
© hashgraph-online, Apache-2.0. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file
Files
Just SKILL.md in plugins/epicsagas/epic-harness/skills/threat-model of hashgraph-online/awesome-codex-plugins.
Open the folder on GitHubat commit 9e7b281
Compare with similar skills
Threat Model next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.
| Skill | Stars | Used in | Tokens | Auto-check | Licence | Repo updated |
|---|---|---|---|---|---|---|
| Threat Model this skillhashgraph-online/awesome-codex-plugins | 1.3k | — | ~1.1k | Automated safety check: Pass | Apache-2.0 | |
| Fla Ascend Performancefla-org/flash-linear-attention | 5.8k | — | ~6.3k | Automated safety check: Pass | MIT | |
| Forensifyalexgreensh/repo-forensics | 188 | — | ~2.5k | Automated safety check: Notes | Custom licence | |
| Create Rulecartography-cncf/cartography | 4.1k | — | ~3k | Automated safety check: Pass | Apache-2.0 | |
| Commit Security Scancodexstar69/bug-hunter | 519 | — | ~629 | Automated safety check: Pass | MIT | |
| Auditing Code For Vulnerabilitiestrilwu/secskills | 157 | — | ~3.2k | Automated safety check: Pass | MIT |
Similar skills
Forensify
alexgreensh/repo-forensics
Cross-agent self-inspection of your AI-agent stack. An agent skill from alexgreensh/repo-forensics.
Create Rule
cartography-cncf/cartography
Author a Cartography security rule (one or more Cypher Facts plus a Pydantic Finding output model) under cartography/rules/data/rules/.
Commit Security Scan
codexstar69/bug-hunter
Scan code changes for security vulnerabilities using Bug Hunter-native artifacts and STRIDE context.
Auditing Code For Vulnerabilities
trilwu/secskills
Audit source code for exploitable vulnerabilities using threat-model-driven review, taint tracing, invariant checking, and variant analysis.
Threat Mitigation Mapping
wshobson/agents
Match identified threats to preventive, detective and corrective controls across network, application, data, endpoint and process layers to plan remediation.
More from hashgraph-online/awesome-codex-plugins
All 714 skills in this repoAnime Reaction Gif
hashgraph-online/awesome-codex-plugins
Create original anime-style reaction stickers as looping GIFs and MP4 previews, using generated character pose sheets and timed key poses.
Calibredb
hashgraph-online/awesome-codex-plugins
Manage and query Calibre libraries with the calibredb CLI (local paths or Calibre Content server URLs).
Rust API Test Harness
hashgraph-online/awesome-codex-plugins
A skill your agent uses when adding, changing, testing, or debugging Rust HTTP APIs and services, especially when Codex needs black-box integration tests, random-port app startup, real database test…
Art
hashgraph-online/awesome-codex-plugins
Make a studio's game look like something at build time — a cover from a real frame of the game (free), painted covers, backdrops, textures and character plates from image models through the…
Calle
hashgraph-online/awesome-codex-plugins
Use CALL-E from Codex through the calle CLI. An agent skill from hashgraph-online/awesome-codex-plugins.
Game Balance Economy
hashgraph-online/awesome-codex-plugins
Balance game difficulty, resources, rewards, probability, progression, economies, and dominant strategies.
Related
Categories
Questions about Threat Model
What does Threat Model do?
Threat modeling and attack surface analysis. An agent skill from hashgraph-online/awesome-codex-plugins. Threat Model is an agent skill from hashgraph-online/awesome-codex-plugins. Threat modeling and attack surface analysis.
When should I use Threat Model?
Threat Model fits situations like: assessing security boundaries; modeling threat actors; generating threat scenarios.
How do I install Threat Model in Claude Code?
Run `npx skills add hashgraph-online/awesome-codex-plugins --skill threat-model -a claude-code`. Or copy the skill folder (plugins/epicsagas/epic-harness/skills/threat-model in hashgraph-online/awesome-codex-plugins) into .claude/skills/threat-model in your project. Claude Code loads it when a task matches its description.
How do I install Threat Model in Codex?
Run `npx skills add hashgraph-online/awesome-codex-plugins --skill threat-model -a codex`. Or copy the skill folder (plugins/epicsagas/epic-harness/skills/threat-model in hashgraph-online/awesome-codex-plugins) into .agents/skills/threat-model in your project. Codex loads it when a task matches its description.
Can I use Threat Model in Cursor, Gemini CLI or GitHub Copilot?
Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add hashgraph-online/awesome-codex-plugins --skill threat-model -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/threat-model, .gemini/skills/threat-model, .github/skills/threat-model and .opencode/skills/threat-model in your project.
What does Threat Model need to run?
SKILL.md names no scripts, command-line tools or credentials: Threat Model is instructions for the agent only.
Does Threat Model access the network?
SKILL.md contains no URLs. Any network use would come from the scripts or tools the agent runs. This is read from the text; nothing was executed.
Is Threat Model safe to install?
Our automated static check of SKILL.md found no risky patterns, such as piping downloads into a shell, reading credential files or hidden Unicode. It is not a guarantee. Review the folder before installing.
What licence does Threat Model use?
Threat Model is published under the Apache-2.0 licence (the repository's licence). It allows redistribution, so the full SKILL.md is shown on this page.
How many tokens does Threat Model use?
About 1.1k tokens (SKILL.md is roughly 4.3k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full.
What are the alternatives to Threat Model?
Skills that share tags, products or a category with Threat Model: Fla Ascend Performance (fla-org/flash-linear-attention, 5.8k stars), Forensify (alexgreensh/repo-forensics, 188 stars), Create Rule (cartography-cncf/cartography, 4.1k stars) and Commit Security Scan (codexstar69/bug-hunter, 519 stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.
Who maintains Threat Model?
hashgraph-online (a GitHub organization) maintains it in hashgraph-online/awesome-codex-plugins, which has 1,255 GitHub stars. The repository holds 714 skills in this directory. The repository was last updated on October 9, 2026.
Source: hashgraph-online/awesome-codex-plugins on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.