Live survey304 models · 14 providers · 22,792 auditsAudited grill-with-docs · SAFE →What changedHow we verifyllms.txt

Agent skill · Audited from source

Threat Model Generation

skill · codexstar69/bug-hunterMIT licenceAudited 16 Oct 2026 · source 206587dd9725

★ 524pushed 60 days ago
✓SAFEGrade B · 89/100 · 16 Oct 2026 · 206587d
524repo stars · whole codexstar69/bug-hunter
InstallView source on GitHub ↗

Is it safe? Yes — SAFE, grade B (89/100). We read this skill's source at commit 206587dd9725 and found no filesystem, network or shell access and no hard-coded secrets. What it does: Generate or refresh a STRIDE-based threat model for the current repository using Bug Hunter-native artifacts. Use whenever the repository has no threat model yet, the architecture changed materially, a security review…

Ask an AI about this pageGChatGPTCClaudePPerplexityGeGeminiXGrok
More
CoCopilotAIGoogle AI Mode
Cite

Cite this page

ModelsAtlas. “Threat Model Generation (codexstar69/bug-hunter)”. Retrieved 16 Oct 2026. https://modelsatlas.com/skills/codexstar69/threat-model-generation

Trust audit

Audit 0.4.1 · source read 16 Oct 2026

Trust score89/100✓SAFE B
0 critical0 high0 medium0 low0 info

SAFE means nothing in the source contradicts what the skill says it does. Grade B is shared by 16,667 of 17,602 audited skills.

What the source does

  • FilesystemNone observedNo reads or writes in the source
  • NetworkNone observedNo outbound calls in the source
  • ShellNone observedNo commands run in the source
  • DependenciesPinnedNothing floats
  • SecretsNone foundNo keys in source

Five audit layers

LayerWhat we checkResultFindings
L0 ProvenanceRepo owner, licence, archive status, activityPASS0
L1 Static sourceSecrets, path traversal, supply chain, hidden codeNA0
L2 InstructionsPrompt injection, authority framing, hidden directivesPASS0
L3 InventoryThe files and declarations match the sourcePASS0
L4 SandboxRun in isolation and watch behaviourSKIPPED why0

Gates applied: no behavioural pass.

Findings (0)

No findings at any severity. We re-audit when the source changes.

Audit 0.4.1 · source sha 206587dd9725 · 16 Oct 2026Report an issue or request a re-scan

Provenance

Who published it, and what the verdict is pinned to

  • Publishercodexstar69 GitHub userOwner of the repository this skill is read from
  • Source foldercodexstar69/bug-hunter/skills/threat-model-generationThe exact folder we audited
  • LicenceMITAs the repository states it
  • Commit pinned for this verdict206587dd9725A new audit runs when the source changes
  • Repository statusNot archivedLast push 60 days ago
  • Sandboxed runNot runSkills are read, not executed; layer L4 is skipped

What it tells the agent

Full source on GitHub ↗

Its description: Generate or refresh a STRIDE-based threat model for the current repository using Bug Hunter-native artifacts. Use whenever the repository has no threat model yet, the architecture changed materially, a security review…

---
name: threat-model-generation
description: Generate or refresh a STRIDE-based threat model for the current repository using Bug Hunter-native artifacts. Use whenever the repository has no threat model yet, the architecture changed materially, a security review needs fresh trust-boundary context, or the user explicitly asks for a threat model.
---

# Threat Model Generation

This is a bundled local Bug Hunter companion skill. It generates portable threat-model artifacts under `.bug-hunter/`.

## Purpose

Create the security context that the other security skills depend on:
- trust boundaries
- major components
- STRIDE threats
- vulnerability pattern library
- severity/config defaults

## Required outputs

Write:
- `.bug-hunter/threat-model.md`
- `.bug-hunter/security-config.json`

## Workflow

1. Read `.bug-hunter/triage.json` if available for file structure and domain hints.
2. Inspect the repository to identify:
   - languages and frameworks
   - public/authenticated/internal entry points
   - data stores and external integrations
   - sensitive assets and trust boundaries
3. Generate a concise STRIDE threat model.
4. Generate a matching security config with thresholds and tech-stack metadata.

## Compatibility

`prompts/threat-model.md` is generated from this skill for older clients. This
skill is the canonical source and must be edited instead of the generated
compatibility prompt.

## Output rules

- Keep the threat model short enough for downstream agents to consume.
- Be specific about trust boundaries and vulnerable code patterns.
- Keep all artifacts under `.bug-hunter/`, never `.factory/`.

Excerpt, first 1,630 characters of SKILL.md, verbatim from the audited commit. It is text from someone else’s repository, quoted so you can judge it before your agent reads it.

Install

Pinned to the audited commit 206587d

Download folder ↗
git clone https://github.com/codexstar69/bug-hunter
git -C bug-hunter checkout 206587dd9725

The author documents no install command, so this uses the repository directly. Our verdict covers commit 206587dd9725 only.

Works in

The author has not said which agents this skill supports, and we have not tested it in any.

Audit history

Every audit, every source change

  1. ✓SAFE B 89 / 100

    first audit · source 206587dd9725

Similar skills

All coding & review skills →
bug-hunter!CAUTION

codexstar69/bug-hunter

Precision-first adversarial bug hunting for runtime, logic, data, concurrency, and security defects. Uses deterministic risk triage, evidence-bounded retrieval, Hunter/Skeptic/Referee review, optional hybrid…

★ 524Grade B
Commit Security Scan✓SAFE

codexstar69/bug-hunter

Scan code changes for security vulnerabilities using Bug Hunter-native artifacts and STRIDE context. Use whenever the user asks for PR security review, commit-diff scanning, staged-change security checks,…

★ 524Grade B
Doc Lookup✓SAFE

codexstar69/bug-hunter

Unified documentation lookup for Bug Hunter agents. Uses Context Hub (chub) as primary source with Context7 API fallback. Provides verified library/framework documentation to prevent false positives and ensure correct…

★ 524Grade B
Fixer✓SAFE

codexstar69/bug-hunter

Surgical code fixer for Bug Hunter. Implements minimal, precise fixes for verified bugs. Uses doc-lookup (Context Hub + Context7) to verify correct API usage in patches. Respects fix strategy classifications…

★ 524Grade B
Hunter✓SAFE

codexstar69/bug-hunter

Deep behavioral code analysis agent for Bug Hunter. Performs multi-phase scanning to find logic errors, security vulnerabilities, race conditions, and runtime bugs. Uses doc-lookup (Context Hub + Context7) for framework…

★ 524Grade B
Recon✓SAFE

codexstar69/bug-hunter

Codebase reconnaissance agent for Bug Hunter. Maps architecture, identifies trust boundaries, classifies files by risk priority, and detects service boundaries. Does NOT find bugs — finds where bugs hide.

★ 524Grade B

Questions about Threat Model Generation

What does the Threat Model Generation skill do?
Adversarial AI bug hunter with auto-fix skill for Claude Code, Cursor, Codex CLI, GitHub Copilot CLI, Kiro CLI, Opencode, Pi Coding Agent, and more. Multi-agent pipeline finds security vulnerabilities, logic errors, and runtime bugs — then fixes them autonomously on a safe branch.
Is Threat Model Generation safe to install?
The audit found nothing in the source that contradicts what it says it does, and graded it B (89/100). Grade A is held back for packages that have also passed a sandboxed behavioural run, which is why a clean skill reads B.
What can Threat Model Generation access on my machine?
The audit observed no filesystem, network or shell use at all in its source.
How current is this page?
The grade is for one exact copy of the source (206587dd9725), read on 2026-10-16. The repository is watched, and a new audit runs when it changes — this is the first audit.

Sources

Spotted something wrong? Report a correction · Methodology

Keep going in your AI

Opens with this page as the source. We add nothing else to the prompt.