security-threat-model은(는) 무엇을 하나요?
저장소 기반 위협 모델링으로 신뢰 경계, 자산, 공격자 역량, 남용 경로 및 완화 방안을 열거하고 간결한 Markdown 위협 모델을 작성합니다. 사용자가 명시적으로 코드베이스나 경로에 대한 위협 모델링, 위협/남용 경로 열거, 또는 AppSec 위협 모델링을 요청할 때만 트리거됩니다. 일반 아키텍처 요약, 코드 리뷰 또는 비보안 설계 작업에는 트리거되지 않습니다.
저장소 기반 위협 모델링으로 신뢰 경계, 자산, 공격자 역량, 남용 경로 및 완화 방안을 열거하고 간결한 Markdown 위협 모델을 작성합니다. 사용자가 명시적으로 코드베이스나 경로에 대한 위협 모델링, 위협/남용 경로 열거, 또는 AppSec 위협 모델링을 요청할 때만 트리거됩니다. 일반 아키텍처 요약, 코드 리뷰 또는 비보안 설계 작업에는 트리거되지 않습니다.
이 스킬은 `openai/security-threat-model`로, 저장소 기반 위협 모델링을 수행하는 AI 에이전트 도구입니다. 주요 기능은 코드베이스의 신뢰 경계(Trust Boundaries), 자산(Assets), 공격자 역량(Attacker Capabilities), 남용 경로(Abuse Paths), 그리고 완화 방안(Mitigations)을 체계적으로 열거하여 간결한 Markdown 형식의 위협 모델 문서를 생성하는 것입니다. 이 스킬은 Claude Code, Cursor, Codex 등 다양한 AI 코딩 에이전트 플랫폼에서 사용할 수 있으며, 사용자가 명시적으로 '위협 모델링' 또는 'AppSec 위협 모델링'을 요청할 때만 활성화됩니다. 일반적인 아키텍처 요약이나 코드 리뷰, 비보안 설계 작업에서는 자동으로 트리거되지 않도록 설계되어 있어, 보안 관련 작업에만 집중할 수 있습니다. SKILL.md 문서를 기반으로 동작하며, 저장소 구조와 코드 분석을 통해 실제 취약점과 공격 표면을 식별하여 실용적인 보안 개선 방안을 제공합니다.
npx skills add https://github.com/openai/skills/tree/main/skills/security-threat-model저장소 기반 위협 모델링으로 신뢰 경계, 자산, 공격자 역량, 남용 경로 및 완화 방안을 열거하고 간결한 Markdown 위협 모델을 작성합니다. 사용자가 명시적으로 코드베이스나 경로에 대한 위협 모델링, 위협/남용 경로 열거, 또는 AppSec 위협 모델링을 요청할 때만 트리거됩니다. 일반 아키텍처 요약, 코드 리뷰 또는 비보안 설계 작업에는 트리거되지 않습니다.
This repo contains 20 individual skills — each has its own dedicated page.
Build, review, refactor, or architect ASP.NET Core web applications using current official guidance for .NET web development. Use when working on Blazor Web Apps, Razor Pages, MVC, Minimal APIs, controller-based Web APIs, SignalR, gRPC, middleware, dependency injection, configuration, authentication, authorization, testing, performance, deployment, or ASP.NET Core upgrades.
Build, scaffold, refactor, and troubleshoot ChatGPT Apps SDK applications that combine an MCP server and widget UI. Use when Codex needs to design tools, register UI resources, wire the MCP Apps bridge or ChatGPT compatibility APIs, apply Apps SDK metadata or CSP or domain settings, or produce a docs-aligned project scaffold. Prefer a docs-first workflow by invoking the openai-docs skill or OpenAI developer docs MCP tools before generating code.
Build a composable CLI for Codex from API docs, an OpenAPI spec, existing curl examples, an SDK, a web app, an admin tool, or a local script. Use when the user wants Codex to create a command-line tool that can run from any repo, expose composable read/write commands, return stable JSON, manage auth, and pair with a companion skill.
Deploy applications and infrastructure to Cloudflare using Workers, Pages, and related platform services. Use when the user asks to deploy, host, publish, or set up a project on Cloudflare.
Use when Codex is building or iterating on a web game (HTML/JS) and needs a reliable development + testing loop: implement small changes, run a Playwright-based test script with short input bursts and intentional pauses, inspect screenshots/text, and review console errors with render_game_to_text.
Use when the task involves reading, creating, or editing `.docx` documents, especially when formatting or layout fidelity matters; prefer `python-docx` plus the bundled `scripts/render_docx.py` for visual checks.
Use the Figma MCP server to fetch design context, screenshots, variables, and assets from Figma, and to translate Figma nodes into production code. Trigger when a task involves Figma URLs, node IDs, design-to-code implementation, or Figma MCP setup and troubleshooting.
Connects Figma design components to code components using Code Connect mapping tools. Use when user says "code connect", "connect this component to code", "map this component", "link component to code", "create code connect mapping", or wants to establish mappings between Figma designs and code implementations. For canvas writes via `use_figma`, use `figma-use`.
Generates custom design system rules for the user's codebase. Use when user says "create design system rules", "generate rules for my project", "set up design rules", "customize design system guidelines", or wants to establish project-specific conventions for Figma-to-code workflows. Requires Figma MCP server connection.
Create a new blank Figma file. Use when the user wants to create a new Figma design or FigJam file, or when you need a new file before calling use_figma. Handles plan resolution via whoami if needed. Usage — /figma-create-new-file [editorType] [fileName] (e.g. /figma-create-new-file figjam My Whiteboard)
Use this skill alongside figma-use when the task involves translating an application page, view, or multi-section layout into Figma. Triggers: 'write to Figma', 'create in Figma from code', 'push page to Figma', 'take this app/page and build it in Figma', 'create a screen', 'build a landing page in Figma', 'update the Figma screen to match code'. This is the preferred workflow skill whenever the user wants to build or update a full page, screen, or view in Figma from code or a description. Discovers design system components, variables, and styles via search_design_system, imports them, and assembles screens incrementally section-by-section using design system tokens instead of hardcoded values.
Build or update a professional-grade design system in Figma from a codebase. Use when the user wants to create variables/tokens, build component libraries, set up theming (light/dark modes), document foundations, or reconcile gaps between code and Figma. This skill teaches WHAT to build and in WHAT ORDER — it complements the `figma-use` skill which teaches HOW to call the Plugin API. Both skills should be loaded together.
Translates Figma designs into production-ready application code with 1:1 visual fidelity. Use when implementing UI code from Figma files, when user mentions "implement design", "generate code", "implement component", provides Figma URLs, or asks to build components matching Figma specs. For Figma canvas writes via `use_figma`, use `figma-use`.
**MANDATORY prerequisite** — you MUST invoke this skill BEFORE every `use_figma` tool call. NEVER call `use_figma` directly without loading this skill first. Skipping it causes common, hard-to-debug failures. Trigger whenever the user wants to perform a write action or a unique read action that requires JavaScript execution in the Figma file context — e.g. create/edit/delete nodes, set up variables or tokens, build components and variants, modify auto-layout or fills, bind variables to properties, or inspect file structure programmatically.
Use when the task asks for a visually strong landing page, website, app, prototype, demo, or game UI. This skill enforces restrained composition, image-led hierarchy, cohesive content structure, and tasteful motion while avoiding generic cards, weak branding, and UI clutter.
Help address review/issue comments on the open GitHub PR for the current branch using gh CLI; verify gh auth first and prompt the user to authenticate if not logged in.
Use when a user asks to debug or fix failing GitHub PR checks that run in GitHub Actions; use `gh` to inspect checks and logs, summarize failure context, draft a fix plan, and implement only after explicit approval. Treat external providers (for example Buildkite) as out of scope and report only the details URL.
Create, repair, validate, visually QA, and package Codex-compatible animated pets and pet spritesheets from character art, generated images, company or prospect brand cues, or visual references. Use when a user wants a lightweight-worker Codex pet workflow, a non-pixel custom pet style, a prospect or company mascot pet, or a full 8x9 animated pet atlas with transparent unused cells, QA contact sheets, and pet.json packaging. This skill composes the installed $imagegen system skill for visual generation and uses bundled scripts for deterministic spritesheet assembly.
Generate or edit raster images when the task benefits from AI-created bitmap visuals such as photos, illustrations, textures, sprites, mockups, or transparent-background cutouts. Use when Codex should create a brand-new image, transform an existing image, or derive visual variants from references, and the output should be a bitmap asset rather than repo-native code or vector. Do not use when the task is better handled by editing existing SVG/vector/code-native assets, extending an established icon or logo system, or building the visual directly in HTML/CSS/canvas.
Use when the user asks to create, scaffold, or edit Jupyter notebooks (`.ipynb`) for experiments, explorations, or tutorials; prefer the bundled templates and run the helper script `new_notebook.py` to generate a clean starting notebook.
ElevenLabs text-to-speech with mac-style say UX.
Oracle CLI second-model review/debug/refactor/design with selected files, dry-run token checks, API or browser engine.
Capture and automate macOS UI with the Peekaboo CLI.
Generate multiple radically different interface designs for a module using parallel sub-agents. Use when user wants to design an API, explore interface options, compare module shapes, or mentions "design it twice".
Build a throwaway prototype to flesh out a design — a runnable terminal app for state/business-logic questions, or several radically different UI variations toggleable from one route.
Interview the user relentlessly about a plan or design until reaching shared understanding, resolving each branch of the decision tree. Use when user wants to stress-test a plan, get grilled on their design, or mentions "grill me".