Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add sananthanarayan/skilldrop --skill agent-threat-modelgit clone --depth 1 https://github.com/sananthanarayan/skilldropWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/sananthanarayan/skilldrop/agent-threat-model)<a href="https://agentmods.dev/skills/sananthanarayan/skilldrop/agent-threat-model"><img src="https://agentmods.dev/badge/skills/sananthanarayan/skilldrop/agent-threat-model.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00094 | $0.02021 |
| Opus 5 | $0.00047 | $0.01010 |
| Sonnet 5 | $0.00019 | $0.00404 |
| Haiku 4.5 | $0.00009 | $0.00202 |
Grade A, and why
agent-threat-model scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 7d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 85 lines — stays where its author put it; the contents beside it link to each section on GitHub.
agent-threat-model
Answers one question about an agent deployment: can text the agent reads cause it to send private data somewhere an attacker can see? An LLM cannot reliably separate instructions from data, so any agent holding all three legs of the lethal trifecta — private data, untrusted content, an exfiltration vector — is compromised by construction, not by bug. The output is architectural: which leg gets broken, on which path, by which design change.
Complements threat-model, which runs STRIDE on the system the agent lives in. That model asks how the system is attacked; this one asks what the agent can be talked into doing. Run both on an agent that handles real data.
How to respond
-
Inventory the capability surface before scoring anything. From the input — an agent description, MCP/tool config, system prompt,
agent-loop-designoutput, or repo — extract four lists:- Data reach — everything the agent can read, transitively. A filesystem tool reaches every secret in
.env; a database tool reaches every tenant the credential permits. Reach is what the credential allows, not what the feature intends. - Content sources — everything that puts tokens into the context window: user messages, web fetches, retrieved documents, file contents, tool results, PR comments, email, calendar invites, subagent output.
- Tools — every callable, including the ones that feel inert (
read_file,search,fetch). - Egress paths — every way bytes leave. This is the leg that gets missed; sweep
reference.mdrather than listing the obvious HTTP tool.
Ask at most 2 questions, and spend them on data reach and egress — a wrong boundary there invalidates the matrix. Everything else is tagged
[assumption]. - Data reach — everything the agent can read, transitively. A filesystem tool reaches every secret in
-
Classify each content source trusted or untrusted, defaulting to untrusted. A source is trusted only if every party who can write to it is already authorized to command the agent. A shared team wiki fails this. A support ticket fails this. The agent's own earlier output fails it once untrusted content has entered the context. State the rule's verdict per source in one clause — ✅ "Zendesk ticket body — untrusted; any customer can write it".
What ships with it
6 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 7d ago First seen · 85 lines · 94 tokens per session scan A 92784801385a
agent-threat-model is a skill published in the GitHub repository sananthanarayan/skilldrop (2 stars, last pushed 24d ago), licensed MIT. It adds 94 tokens to every session and 2,021 once invoked, about $0.0005 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
readme
This skill should be used to audit OR elevate the README of a public repository. Trigger with "improve the README", "make the readme high quality", "elevate this readme", "audit the readme", "add badges", "is our README good", or before publishing/releasing a repo. Elevate rebuilds a thin/generic README to a polished…
cairn-attention
Resolve Cairn's pending-attention queue inline (DEC drafts, baseline findings, drift events).
cairn-direction
Spec-tightener + subagent dispatcher. Engage on code-change asks — verbs, bug reports, observations. Pivot-aware on active tasks.
cairn-resync
Operator-initiated re-discovery — resolve config drift, re-cluster topics, re-curate grown areas into DEC/INV drafts.
ship
Execute an approved pitch/spec as a delegated, closed-scope cycle with verification and adversarial review. Invoke it yourself with /ship — a cycle spawns a writer and opens a PR, so it starts when you say so. Enforces the execution playbook: right-size gate, pre-spawn filter, doc-bundle, PR format, review.
adr-new
Create a new Architecture Decision Record with append-only, status-gated supersession, and update the ADR index. Invoke with /adr-new, or let /tdd-author invoke it on approval of an ADR action (this skill stays model-invocable for that reason).