New: 98,000+ skills indexed from GitHub repos with 100+ stars · every skill safety-checkedBrowse top skillsTop skills
Esc to closeBrowse all skills
Submit a skillBrowse skills
Submit a skillBrowse skills

Agent skill

Threat Mitigation Mapping

by wshobson in wshobson/agents

Match identified threats to preventive, detective and corrective controls across network, application, data, endpoint and process layers to plan remediation.

MITAuto-check passedSecurity

Install Threat Mitigation Mapping

skills CLI
$ npx skills add wshobson/agents --skill threat-mitigation-mapping -a claude-code

Project install by default; add -g for ~/.claude/skills/.

GitHub CLI
$ gh skill install wshobson/agents threat-mitigation-mapping --agent claude-code

Project scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).

Manual copy
$ git clone --depth 1 https://github.com/wshobson/agents.git skills-src && mkdir -p .claude/skills && cp -r skills-src/plugins/security-scanning/skills/threat-mitigation-mapping .claude/skills/threat-mitigation-mapping && rm -rf skills-src

Use ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.

Claude Code skills documentation · loads skills from .claude/skills/

Facts

Skill name
threat-mitigation-mapping
GitHub stars
40k
Used in
8 other repos
Token cost
~742 tokens
SKILL.md length
182 words
Files
2 (incl. references)
Skills in repo
142
Repo updated
First seen
Licence
MIT

At a glance

Match identified threats to preventive, detective and corrective controls across network, application, data, endpoint and process layers to plan remediation.

  • Works in 3 steps: Control Categories → Control Layers → Defense in Depth
  • Turning a threat model into a prioritized remediation plan
  • SKILL.md covers When to Use This Skill, Core Concepts, Templates and detailed worked… and Best Practices
  • Instructions only: no scripts, shell commands, URLs or credentials in SKILL.md

What it does

The skill connects a list of known threats to the controls that address them. Controls are sorted into preventive, detective and corrective types and into five layers: network, application, data, endpoint and process, with examples such as firewalls, WAF, input validation, encryption, EDR and security training. A nested defense-in-depth diagram starts at the perimeter.

Its guidance asks for every threat to be mapped, controls to be layered and mixed, effectiveness to be tracked and reviewed regularly, cost to be weighed, and single or untested controls to be avoided. Templates in references/details.md cover a mitigation model, defense-in-depth scoring, an executive summary, critical gaps, recommendations, an implementation roadmap and results by control.

When your agent uses it

  • Turning a threat model into a prioritized remediation plan
  • Checking whether existing controls cover every identified threat
  • Reviewing a security architecture for defense in depth
  • Justifying security spending with a control coverage summary

Example prompts

  • “Map the threats from our STRIDE session to controls and flag any that have none.”
  • “Score our defense in depth across the network, application, data, endpoint and process layers.”
  • “Draft an executive summary of critical control gaps with a remediation roadmap.”

Workflow steps

3 steps, taken from the step headings in SKILL.md.

  1. Control Categories
  2. Control Layers
  3. Defense in Depth

What it can do on your machine

Read from SKILL.md and the folder at commit 46891e7. It shows what the files ask for, not the result of running them.

  • Tool permissions

    Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.

    From allowed-tools in the SKILL.md frontmatter.

  • Runs code

    No scripts in the folder and no shell commands in SKILL.md.

    From the folder's file list and the shell code blocks in SKILL.md.

  • Network

    No URLs in SKILL.md.

    From URLs in SKILL.md, links to its own repository left out.

  • Credentials

    Names no API keys, tokens, secrets or passwords.

    From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.

Context cost

Threat Mitigation Mapping loads about 742 tokens when it runs, and up to ~6.6k if it reads all its reference files. Until then it costs about 52 tokens; SKILL.md has 182 words of instructions outside code blocks.

Always · name and description, kept in context so the agent knows when to use it
~52
When it runs · the whole SKILL.md, loaded when a task matches
~742
With references · SKILL.md plus every file in references/, read only if the agent opens them
~6.6k

Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.

Safety

Auto-check passed

The automated check found no risky patterns in SKILL.md.

Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); files beside SKILL.md are not scanned.

SKILL.md

The full file from wshobson/agents at commit 46891e7, republished under its MIT licence (© wshobson). 182 words, ~742 tokens.

Download SKILL.mdSave it as .claude/skills/threat-mitigation-mapping/SKILL.md (or your agent's skills folder). This skill also uses 1 other file; get the full folder from GitHub.
name
threat-mitigation-mapping
description
Map identified threats to appropriate security controls and mitigations. Use when prioritizing security investments, creating remediation plans, or validating control effectiveness.

Threat Mitigation Mapping

Connect threats to controls for effective security planning.

When to Use This Skill

  • Prioritizing security investments
  • Creating remediation roadmaps
  • Validating control coverage
  • Designing defense-in-depth
  • Security architecture review
  • Risk treatment planning

Core Concepts

1. Control Categories
Preventive ────► Stop attacks before they occur
   │              (Firewall, Input validation)
   │
Detective ─────► Identify attacks in progress
   │              (IDS, Log monitoring)
   │
Corrective ────► Respond and recover from attacks
                  (Incident response, Backup restore)
2. Control Layers
LayerExamples
NetworkFirewall, WAF, DDoS protection
ApplicationInput validation, authentication
DataEncryption, access controls
EndpointEDR, patch management
ProcessSecurity training, incident response
3. Defense in Depth
                    ┌──────────────────────┐
                    │      Perimeter       │ ← Firewall, WAF
                    │   ┌──────────────┐   │
                    │   │   Network    │   │ ← Segmentation, IDS
                    │   │  ┌────────┐  │   │
                    │   │  │  Host  │  │   │ ← EDR, Hardening
                    │   │  │ ┌────┐ │  │   │
                    │   │  │ │App │ │  │   │ ← Auth, Validation
                    │   │  │ │Data│ │  │   │ ← Encryption
                    │   │  │ └────┘ │  │   │
                    │   │  └────────┘  │   │
                    │   └──────────────┘   │
                    └──────────────────────┘

Templates and detailed worked examples

Full template library and detailed mitigation/control mappings live in references/details.md. Read that file when you need the concrete templates for: Mitigation Model, Defense in Depth scoring, Executive Summary scaffolding, Critical Gaps reporting, Recommendations, Implementation Roadmap, Results by Control.

Best Practices

Do's
  • Map all threats - No threat should be unmapped
  • Layer controls - Defense in depth is essential
  • Mix control types - Preventive, detective, corrective
  • Track effectiveness - Measure and improve
  • Review regularly - Controls degrade over time
Don'ts
  • Don't rely on single controls - Single points of failure
  • Don't ignore cost - ROI matters
  • Don't skip testing - Untested controls may fail
  • Don't set and forget - Continuous improvement
  • Don't ignore people/process - Technology alone isn't enough

© wshobson, MIT. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file

Files

SKILL.md and 1 other file (references) in plugins/security-scanning/skills/threat-mitigation-mapping of wshobson/agents.

  • SKILL.md
  • references/details.md

Open the folder on GitHubat commit 46891e7

Used in 8 other repositories

We found 18 copies of this SKILL.md (exact, near-identical or edited) in other folders, from 8 other GitHub owners. This page covers the copy in wshobson/agents, which our catalogue first saw on October 7, 2026.

Compare with similar skills

Threat Mitigation Mapping next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.

Threat Mitigation Mapping compared with similar skills
SkillStarsUsed inTokensAuto-checkLicenceRepo updated
Threat Mitigation Mapping this skillwshobson/agents40k8 repos~742Automated safety check: PassMIT
Commit Security Scancodexstar69/bug-hunter519—~629Automated safety check: PassMIT
Auditing Code For Vulnerabilitiestrilwu/secskills157—~3.2kAutomated safety check: PassMIT
Audit Browser Security Boundariesnordstjernen-web/northstar-browser124—~920Automated safety check: PassGPL-3.0
Security Auditblueberrycongee/termcanvas406—~966Automated safety check: NotesMIT
Security Reviewcodexstar69/bug-hunter519—~567Automated safety check: PassMIT

Similar skills

  • Commit Security Scan

    codexstar69/bug-hunter

    Scan code changes for security vulnerabilities using Bug Hunter-native artifacts and STRIDE context.

    519 GitHub stars~629 tokensUpdated 1 mo ago
    SecurityAuto-check passed

  • Auditing Code For Vulnerabilities

    trilwu/secskills

    Audit source code for exploitable vulnerabilities using threat-model-driven review, taint tracing, invariant checking, and variant analysis.

    157 GitHub stars~3.2k tokensUpdated 1 mo ago
    SecurityAuto-check passed

  • Audit Browser Security Boundaries

    nordstjernen-web/northstar-browser

    Audit browser-engine changes that process untrusted content or cross native-memory, origin, network, storage, extension, decoder, sandbox, or operating-system boundaries.

    124 GitHub stars~920 tokensUpdated yesterday
    SecurityAuto-check passed

  • Security Audit

    blueberrycongee/termcanvas

    Security audit skill. An agent skill from blueberrycongee/termcanvas.

    406 GitHub stars~966 tokensUpdated 4 mo ago
    SecurityAuto-check: notes

  • Security Review

    codexstar69/bug-hunter

    Run a focused STRIDE-based security review using Bug Hunter-native artifacts.

    519 GitHub stars~567 tokensUpdated 1 mo ago
    SecurityAuto-check passed

  • Commit Security Scan

    Factory-AI/factory-plugins

    Analyze code changes for security vulnerabilities using LLM reasoning and threat model patterns.

    111 GitHub stars~2.3k tokensUpdated 2 days ago
    SecurityAuto-check passed

More from wshobson/agents

All 142 skills in this repo

  • Cloud Cost Optimization

    wshobson/agents

    Cuts cloud spend across AWS, Azure, GCP and OCI with cost tagging, rightsizing, commitment and spot pricing models, and architecture changes.

    40k GitHub starsUsed in 14 repos~1.7k tokens
    Auto-check passed

  • Billing Automation

    wshobson/agents

    Covers building subscription billing: billing cycles, subscription states, invoice generation, proration, tax handling and dunning for failed payments.

    40k GitHub starsUsed in 13 repos~473 tokens
    Auto-check passed

  • Python Performance Optimization

    wshobson/agents

    Profiles slow Python code with cProfile and memory profilers, then applies targeted fixes for CPU, memory, I/O and query bottlenecks.

    40k GitHub starsUsed in 13 repos~814 tokens
    Auto-check passed

  • Bats Shell Testing Patterns

    wshobson/agents

    Writes unit tests for shell scripts with Bats: error-condition tests, fixtures and mocks, cross-shell checks, parallel runs, helper files and CI integration.

    40k GitHub starsUsed in 12 repos~1.3k tokens
    Auto-check passed

  • Distributed Tracing

    wshobson/agents

    Implement distributed tracing with Jaeger and Tempo to track requests across microservices and identify performance bottlenecks.

    40k GitHub starsUsed in 12 repos~527 tokens
    Auto-check passed

  • Prompt Engineering Patterns

    wshobson/agents

    Reference for designing and tuning production LLM prompts: few-shot examples, chain-of-thought, structured outputs, templates and system prompts.

    40k GitHub stars~1.3k tokensUpdated 4 days ago
    Auto-check passed

Categories

Questions about Threat Mitigation Mapping

What does Threat Mitigation Mapping do?

Match identified threats to preventive, detective and corrective controls across network, application, data, endpoint and process layers to plan remediation. The skill connects a list of known threats to the controls that address them. Controls are sorted into preventive, detective and corrective types and into five layers: network, application, data, endpoint and process, with examples such as firewalls, WAF, input validation, encryption, EDR and security training.

When should I use Threat Mitigation Mapping?

Threat Mitigation Mapping fits situations like: turning a threat model into a prioritized remediation plan; checking whether existing controls cover every identified threat; reviewing a security architecture for defense in depth; justifying security spending with a control coverage summary.

How do I install Threat Mitigation Mapping in Claude Code?

Run `npx skills add wshobson/agents --skill threat-mitigation-mapping -a claude-code`. Or copy the skill folder (plugins/security-scanning/skills/threat-mitigation-mapping in wshobson/agents) into .claude/skills/threat-mitigation-mapping in your project. Claude Code loads it when a task matches its description.

How do I install Threat Mitigation Mapping in Codex?

Run `npx skills add wshobson/agents --skill threat-mitigation-mapping -a codex`. Or copy the skill folder (plugins/security-scanning/skills/threat-mitigation-mapping in wshobson/agents) into .agents/skills/threat-mitigation-mapping in your project. Codex loads it when a task matches its description.

Can I use Threat Mitigation Mapping in Cursor, Gemini CLI or GitHub Copilot?

Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add wshobson/agents --skill threat-mitigation-mapping -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/threat-mitigation-mapping, .gemini/skills/threat-mitigation-mapping, .github/skills/threat-mitigation-mapping and .opencode/skills/threat-mitigation-mapping in your project.

What does Threat Mitigation Mapping need to run?

SKILL.md names no scripts, command-line tools or credentials: Threat Mitigation Mapping is instructions for the agent only.

Does Threat Mitigation Mapping access the network?

SKILL.md contains no URLs. Any network use would come from the scripts or tools the agent runs. This is read from the text; nothing was executed.

Is Threat Mitigation Mapping safe to install?

Our automated static check of SKILL.md found no risky patterns, such as piping downloads into a shell, reading credential files or hidden Unicode. It is not a guarantee. Review the folder before installing.

What licence does Threat Mitigation Mapping use?

Threat Mitigation Mapping is published under the MIT licence (the repository's licence). It allows redistribution, so the full SKILL.md is shown on this page.

How many tokens does Threat Mitigation Mapping use?

About 742 tokens (SKILL.md is roughly 3k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full. Its references folder adds about 5.9k tokens, read only when the agent opens those files.

What are the alternatives to Threat Mitigation Mapping?

Skills that share tags, products or a category with Threat Mitigation Mapping: Commit Security Scan (codexstar69/bug-hunter, 519 stars), Auditing Code For Vulnerabilities (trilwu/secskills, 157 stars), Audit Browser Security Boundaries (nordstjernen-web/northstar-browser, 124 stars) and Security Audit (blueberrycongee/termcanvas, 406 stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.

Who maintains Threat Mitigation Mapping?

wshobson (a GitHub user) maintains it in wshobson/agents, which has 40,305 GitHub stars. The repository holds 142 skills in this directory. The repository was last updated on October 5, 2026.

Source: wshobson/agents on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.