| name | agentic-threat-modeler |
| description | Threat-model agents as untrusted principals across prompts, tools, MCP, memory, delegation, runtime infrastructure, and external systems. |
| version | 1.0.0 |
| since | 2026-08-29 |
| last_modified | 2026-08-29 |
| authors | ["platform-engineering"] |
| stability | stable |
| min_platform_version | {"codex":"unknown","amazon-q":"unknown","antigravity":"unknown","auggie":"unknown","bob":"unknown","claude-code":"unknown","cline":"unknown","codebuddy":"unknown","continue":"unknown","costrict":"unknown","crush":"unknown","github-copilot":"unknown","gitlab-duo":"unknown","factory":"unknown","forgecode":"unknown","opencode":"unknown","openhands":"unknown","cursor":"unknown","roo-code":"unknown","kiro":"unknown","junie":"unknown","gemini-cli":"unknown","iflow":"unknown","kilocode":"unknown","kimi":"unknown","lingma":"unknown","pi":"unknown","qoder":"unknown","qwen":"unknown","windsurf":"unknown","ollama":"unknown"} |
| deprecated_since | null |
| replaces | null |
| supersedes | [] |
| changelog | [{"version":"1.0.0","date":"2026-08-29","change":"Initial generated production-ready SDLC / DevSecOps skill"}] |
Agentic Threat Modeler
Purpose
Create threat models for agentic systems by treating agents, models, tools, memory, retrieved content, MCP servers, other agents, and runtime infrastructure as distinct and potentially untrusted principals. Translate agent-specific attack paths into Goal, Contract, eval, containment, monitoring, and enforcement requirements.
Goal and behavioral contract
The authoritative Goal and artifact references are defined in descriptor.yaml. Capability boundaries, identity and delegation requirements, tool permissions, data boundaries, invariants, approval requirements, output contract, and operational limits are defined in contract.yaml. MCP/A2A trust boundaries and the reviewed execution closure live in integrations/ and dependencies.yaml; ASPS and assurance requirements live in assurance.yaml.
Treat those declarations as mandatory execution constraints. skcr validates requirements but does not claim verification or enforce them at runtime.
When to use
- A tool-using, autonomous, multi-agent, RAG, MCP, coding, browser, or operational agent is designed or materially changed.
- Agent identities, capabilities, memory, context, tools, approvals, runtime boundaries, or external systems need threat analysis.
- Prompt injection, tool poisoning, excessive agency, sandbox escape, persistence, or cross-agent compromise is plausible.
- A general threat model does not distinguish model behavior from runtime enforcement.
- Goal, contract.yaml, eval scenarios, and infrastructure controls need a common threat basis.
Operating model
- Model the agent as an untrusted principal whose outputs and chosen actions may be adversarial even without a malicious user.
- Inventory assets, identities, Goals, capabilities, tools, memory, data sources, context channels, runtimes, and enforcement points.
- Trace direct and indirect instruction flows plus authority transitions across users, content, agents, tools, and infrastructure.
- Develop abuse cases for compromised models, poisoned context, malicious tools, unsafe autonomy, and infrastructure escape.
- Map each threat to prevention, detection, response, Contract clauses, security invariants, and behavioral evals.
Spec-Driven Change Context
- Treat repository specs, ADRs, runbooks, change proposals, design notes, and task files as durable context that outlives a chat session.
- For non-trivial changes, prefer a checked-in change artifact or equivalent proposal/design/tasks record before implementation begins.
- Capture requirement deltas explicitly: added, modified, removed, deprecated, or unchanged behavior.
