Articles tagged "Threat Modeling"

SkillAI · RedTeam × SRC Hunter：把红队手法转成可提交的 SRC 战果

2026-10-30 Big Model Skills 红队渗透 SRC众测 Threat Modeling JS接口提取漏洞报告

面向授权渗透测试、补天、厂商SRC及众测平台的一体化挖洞工具链「砺刃」，由逢俞科技发布。融合pentest-lyan工程化渗透方法论与src-vuln-hunting提交规范，内置12维威胁建模覆盖业务Web常见攻击面，JS多源解析从六大渠道提取后端接口，三层确认校验门闩机制依次校验访问可达性、漏洞存在性、可利用性，三项全过才标记confirmed，规避返回200即判漏洞的误报；报告按补天风格自动整理原始数据包、危害证明和不少于2条修复建议，可直接报送；支持本地持久化断点续测，并可联动src-6k白盒审计还原利用链路。仅可在书面授权范围内使用，恪守最小验证原则。

Audit Context Building: Build the Audit Context Before Vulnerability Hunting

2026-10-19 Big Model Skills Agent Skills code audit Trail of Bits Threat Modeling 安全工程

Trail of Bits' audit-context-building Skill begins the audit and threat modeling process by documenting assumptions, guarantees, and dependencies on a per-function basis. It generates a DOSSIER and function-level records, marking “nothing found” results and open questions, and does not name vulnerabilities. It is compatible with Claude Code, Codex, and similar tools, and can be installed via the trailofbits/skills marketplace.

DSH Threat Modeling: Threat Modeling, Attack Trees, and STRIDE Skills

2026-09-19 DeepSeek Harness plugin DeepSeek DSH Threat Modeling STRIDE Attack Tree

The DeepSeek Harness (DSH) plugin satan9394/dsh-threat-modeling is designed to assist agents in performing structured threat analysis. It integrates the STRIDE threat model with attack trees, helping developers identify potential security vulnerabilities early in the system design phase. The plugin runs with the permissions of the current DSH process and is suitable for developers who need to conduct security assessments. No official installation command is currently provided; please visit the GitHub repository for specific installation instructions and source code.

DeepSeek Harness Plugin: dsh-security-hardening

2026-09-19 DeepSeek Harness plugin DeepSeek DSH Security Hardening Threat Modeling STRIDE

The DeepSeek Harness (DSH) plugin `dsh-security-hardening` is designed to address security pain points in agent development through a modular approach. Developed by maintainer `satan9394` and classified under security hardening, its core features include implementing the STRIDE threat modeling framework and constructing a three-tier boundary system model, providing agents with a structured security protection approach. Since the documentation does not provide specific installation commands or operational details, users must visit the directory page or GitHub repository to obtain the relevant information. When using it, attention should be paid to permission control and source-code review, ensuring that it runs with the current process's privileges and complies with security standards.

# 翻译结果： security-threat-model: Let Agent perform threat modeling based on code repositories

2026-08-11 Big Model Skills Agent Skill Threat Modeling Application Security Safe Left Shift AppSec

### Official Translation: This article introduces OpenAI's curated Skill **security-threat-model**: it enumerates trust boundaries, assets, attacker capabilities and abuse paths based on repository evidence, and outputs a structured Markdown threat model. The article verifies the official workflow, reporting contract, installation and activation methods of Codex/Cursor/Claude Code (including the Trail of Bits plugin), as well as typical prompt words and usage boundaries.