threat-model

name	threat-model
description	Produce a threat model for a targeted open-source repository or package: its implicit security contract (assumptions, guarantees, disclaimed properties, and known misuses), not an audit, pentest, CVE list, or build-hygiene review. USE WHEN asked to produce, write, or generate a threat model, model the security contract, or explain which threats a library accepts. This orchestrator runs the canonical workflow, delegates to threat-model-* specialists, and publishes threat-model.md, threat-model.yaml, and threat-model.json (authority: prose > YAML > JSON). To classify a finding against an existing model, use threat-model-triage. DO NOT USE FOR bug hunting, code review, CVE enumeration, or supply-chain/SDLC hygiene.
argument-hint	<path or name of the repo/package to model>

Threat Model (orchestrator)

Produce the implicit contract between a project and its downstream users. This skill owns the end-to-end procedure and delegates each phase to a specialist. The deliverable is three artifacts, in authority order prose > yaml > json:

• Unstructured — a prose document (threat-model.md) written at the modeled root, beside the YAML and JSON artifacts, using the canonical section structure, with embedded structured tables (per-input-operand trust table, contract-dimension matrix, disposition set).
• Structured — a machine-readable companion (threat-model.yaml) that a triage pipeline can consume.
• Export — a flat threat-model.json conforming to the repo's schema.json, for external consumers. Lossy by design; never a triage input.

Read first: — what a threat model is and is not, the four-question framework, and what to leave out. Do not start producing before internalizing it.