Menú
Compare two threat-model.yaml revisions and report what changed — added or
Instalar con Codex o Claude Copia este prompt, pégalo en Codex, Claude u otro asistente, y deja que revise la página de la skill y la instale por ti.
Basado en la clasificación ocupacional SOC
Big-Sleep variant analysis. Given a recently-fixed bug shape (the lines added/removed in a patch), find more code in the repository that has the same shape and is likely to carry the same defect. Reports variants linked to their seed. Deny-by-default: only the allowed_tools below are permitted.
Review a code diff or corpus for security vulnerabilities grounded in the supplied threat model. Reads code semantically, forms hypotheses, verifies them, and emits scored findings as a single JSON code block. Deny-by-default: only the allowed_tools below are permitted.
Given an architecture description or diagram, produce a STRIDE threat model plus attack trees as YAML. Use when the user asks to threat model a system.
Triage a candidate finding by deciding whether the vulnerable code is reachable from an untrusted entry point, producing the reachability axis (0-1) that feeds asec-confidence. Use when the user asks to triage a finding or assess exploitability.
Review a git diff for vulnerabilities by running Semgrep and CodeQL, then emit structured findings. Use when the user asks for a security review of a diff/PR.
Given an architecture description, diagram, or repo, produce a Phase-Zero STRIDE threat model plus attack trees as YAML conforming to asec-threat-model schema. Use when the user asks to bootstrap or create a threat model for a system.
| name | threat-model-diff |
| description | Compare two threat-model.yaml revisions and report what changed — added or |
uv run python -c "from asec_threat_model import load, diff; \ d = diff(load('$ARGUMENTS[0]'), load('$ARGUMENTS[1]')); print(d.model_dump_json(indent=2))"
to get a ThreatModelDiff. The models are frozen and serialization is round-trip
stable, so the diff is deterministic.id.Emit a markdown table (change, location, before → after) and a short narrative of net risk movement. End with a PASS/FAIL gate (FAIL if any risk regression is unmitigated). Do not modify either file. Report only.