Guide · Agent skill
How to use the ThreatModel agent skill for your own estate
Updated · written with AI from the project's own documentation and checked against our catalogue data
ThreatModel is an agent skill that helps you think like a defender about systems you own: where sensitive data lives, what would happen if one asset were compromised, where outside text can reach your agent, and which risks should be tracked. This guide explains what the skill does, how to install it, how to trigger it with plain requests, and what it needs and does not do. After reading it you should be able to add the skill, run a first review, and understand the output.
Threat Modeling Your Estatedanielmiessler/LifeOS · MIT Download the skill Quick start
- 1Download the ZIP. Get the ThreatModel ZIP from the skill's page on this directory.
- 2Unzip into a skills folder. Unzip into ~/.claude/skills/ for personal use, or into a project's .claude/skills/ folder for one project.
- 3Or upload it in the Claude apps. If you use the Claude apps, upload the ZIP under Settings → Capabilities → Skills.
- 4Confirm the requirements. Make sure Bun is available and that a LifeOS install provides the TelosRisks and Achilles modules. Atlas is optional.
- 5Ask for a review in plain language. Name an asset or ask a broad question such as how exposed you are, and the agent routes the request to the right intent.
- 6Record risks in the register. Add each real risk through the CLI with a score, scope and review date so it is reviewed later instead of forgotten.
What is an agent skill, and what does ThreatModel make the agent do?
An agent skill is a folder of instructions and optional scripts that an AI agent loads when a request matches the skill's description. ThreatModel is a defensive threat modeling skill for your own estate, meaning your servers, services and AI agent setups.
Its work comes down to three moves: classify where sensitive data lives, simulate compromise of the assets that hold it, and keep the resulting risks in a register that gets reviewed instead of forgotten. The skill is designed to model your setup, not to attack it, and it keeps secret values out of its output.
- Sensitive-data map: which assets hold sensitive data, with unclassified assets listed explicitly.
- Trust boundaries and injection surfaces: where untrusted text can reach the agent and what that text could borrow.
- Compromise scenarios: what happens if a given asset were compromised, including its blast radius.
- Scored risk register: risks recorded with a likelihood, impact, scope and review date, reviewed over time.
Install the ThreatModel skill
You can install the skill in one of three ways. Download the ZIP from the skill's page on this directory first. Then choose the location that fits how you work.
For a personal setup, unzip the download into ~/.claude/skills/. For a single project, unzip it into that project's .claude/skills/ folder. If you use the Claude apps instead of a folder, upload the ZIP under Settings → Capabilities → Skills.
- Personal install: unzip into ~/.claude/skills/
- Project install: unzip into the project's .claude/skills/ folder
- Claude apps: upload the ZIP under Settings → Capabilities → Skills
Check the requirements before you run it
The skill's CLI script is a TypeScript file run with the Bun runtime, so Bun must be available. The CLI also imports TelosRisks and Achilles modules that come with a LifeOS install, so the skill depends on LifeOS being present.
The Atlas asset graph is optional. If your install has it at ~/.claude/LIFEOS/ATLAS/Atlas.ts, the skill uses it for current-state inventory queries. Without Atlas, the skill works from the asset list you give it and from repository and configuration inspection, and it says so in its output. The skill runs scripts but does not use the network, according to its listing.
- Bun runtime
- A LifeOS install providing the LIFEOS/TOOLS modules (TelosRisks, Achilles) that the CLI imports
- Optional: Atlas at ~/.claude/LIFEOS/ATLAS/Atlas.ts for inventory queries
Trigger the skill with natural requests
You do not need special syntax. Ask in plain language, and the agent matches your request to the skill's trigger phrases. The skill routes each request to one of six intents: sensitive-data map, compromise scenario, threat model of a target, injection surface map, risk register, or security audit.
Be specific about the asset or the question. A request that names a system gives the skill something to model. A request about the whole estate triggers a wider review.
- 'Where is our sensitive data? Build a data classification map.' (sensitive-data map)
- 'What if the billing server got hacked? Show the blast radius.' (compromise scenario)
- 'Threat model the deploy pipeline.' (threat model of a target)
- 'Where can untrusted content get into my agent? Map the injection surfaces and trust boundaries.' (injection surface map)
- 'Add a risk: the staging database password is shared in chat.' (risk register)
- 'Run a full security audit. How exposed am I?' (security audit)
Work with the risk register and Atlas queries
Every real risk a run finds should go into the register through the CLI, with a score, a scope and a review date. Scores are computed from likelihood and impact on a 1 to 5 scale each. The levels are Low for 1-4, Medium for 5-9, High for 10-14 and Critical for 15-25.
When Atlas is installed, the skill can run queries such as the ones below. The first shows what relies on an asset. The second shows which credentials an asset would leak, in priority order. Replace the placeholder key with an asset key from your own graph.
- Register entries reference credentials by environment-variable name only, never by value.
- Risks linked to a life risk use --telos-ref Rn; injection risks use --threat 'prompt injection'.
- Each open High or Critical risk should have a named owner and a mitigation.
bun ~/.claude/LIFEOS/ATLAS/Atlas.ts blast <key>
bun ~/.claude/LIFEOS/ATLAS/Atlas.ts exposed <key>Where the files are stored and how to keep secrets out
The skill folder holds code only. Generated artifacts go to a private data directory, which defaults to ~/.claude/LIFEOS/USER/SECURITY/THREATMODEL/. Setting the THREATMODEL_DATA_DIR environment variable changes that location. The RiskRegister script refuses any data directory that resolves inside a skills/ path.
Customizations are read from a PREFERENCES.md file under the customizations folder for skills, inside the config root. The config root is $CLAUDE_CONFIG_DIR when that is set, otherwise ~/.claude.
- Default data directory: ~/.claude/LIFEOS/USER/SECURITY/THREATMODEL/
- Override with THREATMODEL_DATA_DIR
- Do not paste tokens, keys or cookies into requests; the skill is written to keep them out of its output
Safety notes: what the skill will not do
ThreatModel is for defensive review. It does not run penetration tests, exploit anything, or scan systems. Its listing points to a separate offensive skill for that work, and it excludes running incident response. If you have an active breach, use your responders rather than this skill.
Its output is only as good as its inventory. Assets you have not listed can be missed, and a graph query can lag or under-model edges. For a high-stakes decision, confirm the blast radius against the provider's own authority.
- Not for active penetration testing or scanning
- Not a substitute for live incident response
- Not for systems you do not own or have no inventory of
- Unclassified assets are reported as unclassified, not as clean
What people use it for
- Mapping which servers and services hold credentials or customer data before a security review.
- Writing out the blast radius of a compromised deploy server or AI agent worker.
- Listing where outside web pages, tickets or documents can reach an agent that also has publish or repo-write access.
- Keeping a small team's risk register with owners and review dates.
Frequently asked questions
How do I install the ThreatModel agent skill?
Download the ZIP from the skill's page, then unzip it into ~/.claude/skills/ for personal use or into a project's .claude/skills/ folder. In the Claude apps, you can instead upload the ZIP under Settings → Capabilities → Skills.
Is the ThreatModel skill free to use?
The skill is listed under the MIT licence. This page does not state any price, so check the listing for current terms before relying on it.
What does the ThreatModel skill require?
It needs the Bun runtime because its CLI is a TypeScript file run with bun. It also needs a LifeOS install that provides the TelosRisks and Achilles modules. The Atlas asset graph is optional.
Can ThreatModel be used for penetration testing?
No. The skill is defensive and excludes exploitation and scanning. Its listing points to a separate offensive skill, named RedTeam in the description, for that kind of work.
How is a risk score calculated?
Score equals likelihood times impact, with each rated from 1 to 5. Scores of 1-4 are Low, 5-9 Medium, 10-14 High and 15-25 Critical. The CLI computes the score and level from the two inputs.
Does ThreatModel send my data over the network?
The listing says the skill does not use the network and runs scripts. Its output is designed to omit secret values, and register entries reference credentials by environment-variable name only.
New agent skills, repos and AI tools — every week
The best new skills and open-source projects, the fastest-growing repos, and one free prompt. Five minutes to read. Unsubscribe anytime.
Our verdict
ThreatModel suits developers, operators and small teams who run their own servers, services and AI agent setups and want a structured, written security review. It is a poor fit if you need active testing, live incident response, or an assessment of systems you have no inventory for, since those need other tools or responders.
Download the skill