Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/686f6c61/alfred-dev/threat-modelnpx skills add 686f6c61/alfred-dev --skill threat-modelgit clone --depth 1 https://github.com/686f6c61/alfred-devWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/686f6c61/alfred-dev/threat-model)<a href="https://agentmods.dev/skills/686f6c61/alfred-dev/threat-model"><img src="https://agentmods.dev/badge/skills/686f6c61/alfred-dev/threat-model.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00038 | $0.01108 |
| Opus 5 | $0.00019 | $0.00554 |
| Sonnet 5 | $0.00008 | $0.00222 |
| Haiku 4.5 | $0.00004 | $0.00111 |
Grade A, and why
threat-model scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 5d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 75 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Modelado de amenazas STRIDE
Resumen
Este skill aplica la metodología STRIDE para identificar y clasificar amenazas de seguridad en el sistema. STRIDE es un modelo desarrollado por Microsoft que categoriza las amenazas en seis tipos, proporcionando un framework sistemático para no dejarse nada en el tintero.
El modelado de amenazas se hace idealmente al principio del desarrollo (cuando es más barato corregir), pero también es valioso como ejercicio periódico para sistemas existentes.
Proceso
-
Identificar los componentes del sistema. Listar todos los elementos relevantes:
- Aplicaciones y servicios.
- Bases de datos y almacenes de datos.
- APIs e interfaces externas.
- Infraestructura (servidores, redes, balanceadores).
- Usuarios y roles.
- Flujos de datos entre componentes.
-
Generar diagrama de flujo de datos (DFD). Dibujar con Mermaid los flujos de datos entre componentes, identificando los límites de confianza (trust boundaries). Las amenazas suelen concentrarse en los puntos donde los datos cruzan un límite de confianza.
-
Aplicar STRIDE a cada componente. Para cada elemento del diagrama, evaluar las seis categorías:
Categoría Descripción Pregunta clave Spoofing (suplantación) Un atacante se hace pasar por otro usuario o sistema. Cómo se verifica la identidad en este punto? Tampering (manipulación) Un atacante modifica datos en tránsito o en reposo. Cómo se garantiza la integridad de los datos? Repudiation (repudio) Un usuario niega haber realizado una acción. Hay registro de auditoría fiable? Information Disclosure (fuga de información) Datos sensibles se exponen a quien no debería verlos. Qué datos se exponen y a quién? Denial of Service (denegación de servicio) El sistema se vuelve inaccesible para usuarios legítimos. Qué recursos se pueden agotar? Elevation of Privilege (elevación de privilegios) Un usuario obtiene permisos que no le corresponden. Cómo se aplican los controles de acceso?
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 5d ago First seen · 75 lines · 38 tokens per session scan A df1beefde457
threat-model is a skill published in the GitHub repository 686f6c61/alfred-dev (119 stars, last pushed 20d ago), licensed MIT. It adds 38 tokens to every session and 1,108 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
sdlc-graph-engineering-install
Install graph engineering into a project: take an existing process — skills, a runbook, a README, a CI pipeline, or something the user can only describe out loud — and scaffold it into a working guarded graph with typed nodes, total exit guards, bounded retry loops, a durable run-state file, and a ledger recording…
deprecation-migration
Use when deprecating old code or APIs, migrating to a new system, or upgrading dependencies — staged deprecation paths and migration strategies that preserve behavior across the transition. Triggers on "deprecate", "migrate", "sunset API", "弃用", "迁移", "升级依赖", "更新这个库", "upgrade dependency".
skill-authoring
Use when creating, editing, or evaluating a skill in this collection — writes SKILL.md frontmatter and four sections, generates the Codex adapter, runs the validator, and tunes description triggering. The authoring half of using-skills (which routes/consumes). Triggers on "write a skill", "edit skill", "skill eval"…
brainstorm
Use before creative work, or when the ask is underspecified — one-question-at-a-time dialogue that sharpens a vague idea into a concrete proposal. Triggers on "brainstorm", "grill me", "interview me", "refine this idea", "头脑风暴", "帮我打磨想法", "盘问我".
api-design
Use when designing APIs or interfaces — REST/GraphQL contracts, request/response shapes, versioning, error models, and interface ergonomics. Triggers on "design API", "REST contract", "GraphQL schema", "接口设计", "API 契约", "API 设计".
e2e-testing
Use when writing end-to-end or browser tests — user journeys, form submission, and runtime UI verification through a browser automation tool (Playwright by default, or your framework's equivalent). Triggers on "playwright", "e2e test", "browser test", "end-to-end", "端到端测试", "浏览器测试".