20 OpenAI security-threat-model alternatives
OpenAI security-threat-model: OpenAI's skill for repository-grounded threat modelling: derive trust boundaries, assets and attacker capabilities from the actual code, rank abuse paths by likelihood and impact, and write a reviewable Markdown threat model. 20 agent skills do similar work, most sharing Security, Architecture and Documentation, ranked by how much they have in common with OpenAI security-threat-model.
Back to OpenAI security-threat-model
-
by Trail of Bits
Trail of Bits' security review skill for PRs, commits, and diffs: risk-first analysis with git history, blast radius, and honest coverage limits.
Also: AppSec, Code Review, Security
-
by OpenAI
OpenAI's skill for language- and framework-specific secure coding: detect the stack, load the matching reference guidance, then write secure-by-default code, flag critical issues passively, or produce a prioritised vulnerability report with fixes.
Also: AppSec, Code Review, Security
-
by Aryan Utkarsh
Turn a short JSON spec into animated, explorable diagrams in 45 types, exported as HTML, SVG, PNG, GIF or MP4.
Also: Architecture, Documentation
-
by Cathryn Lavery
Agent skill that draws 40+ editorial diagram types as self-contained HTML and SVG, matched to your brand, with no Mermaid look.
Also: Architecture, Documentation
-
by tt-a1i
Turns plain-language requirements or pasted Mermaid into validated architecture, workflow, sequence, data-flow and lifecycle diagrams as self-contained interactive HTML.
Also: Architecture, Documentation
-
by Trail of Bits
Finds secrets left in memory in C, C++ and Rust — including wipes the compiler deleted — and requires IR or assembly evidence before calling one optimized away.
-
by Trail of Bits
Audits npm, PyPI and Go dependencies for advisories, abandoned upstreams, publisher concentration and install-time scripts — measured by scripts, not estimated.
-
by Trail of Bits
Compiles cryptographic code and reads the emitted assembly for variable-time instructions, then triages which flagged operations actually touch secrets.
-
by Google
Google's official Well-Architected Framework skill for the security pillar — turns an architecture review into a structured interview, gap analysis and prioritised recommendations.
Also: Architecture, Security
-
by Vercel
Vercel's official skill for reviewing documentation and prose against its writing handbook — voice, structure, code samples and typography, reported as file:line findings.
Also: Code Review, Documentation
-
by Trail of Bits
CodeQL, Semgrep and SARIF static-analysis toolkit from Trail of Bits: taint tracking, fast pattern scans and merged, deduplicated security findings for coding agents.
Also: Code Review, Security
-
by OpenQodex
Open source pre-push AI code review for Claude Code and Codex: scanners plus a separate reviewer that verifies every finding.
Also: Code Review, Security
-
by Sentry
Review pull requests against a real engineering practice — security, performance, testing, and design, in that order.
Also: Code Review, Security
-
by Twilio
Planning skill that interrogates your use case before any code is written, then recommends the right Twilio Conversations stack — ConversationRelay, Memory, Intelligence, Orchestrator, TaskRouter — and the implementation skills to follow.
Also: Architecture
-
by Microsoft
Microsoft's official skill that turns an agent into an Azure solution architect — 10 design principles, 6 architecture styles, 44 design patterns and a Well-Architected review workflow.
Also: Architecture
-
by Flutter
The Flutter team's official skill for structuring an app in the recommended UI / Logic / Data layers, with MVVM view-models and the repository pattern.
Also: Architecture
-
by Agents365-ai
Generates .drawio XML from natural language — UML, ERD, BPMN, SysML, network and cloud topology — and exports PNG, SVG, PDF or JPG through the native draw.io desktop CLI.
Also: Architecture
-
by Senzing
Drives the Senzing MCP server through the real entity-resolution jobs: map a messy CSV to Senzing's format, scaffold SDK code in five languages, decode error codes, migrate V3 to V4.
Also: Documentation
-
by Matt Pocock
Compress the current Claude Code session into a portable handoff document so a fresh agent can continue the work without re-reading the whole conversation.
Also: Documentation
-
by Google Labs (Stitch)
Google's official Stitch skill for distilling a project into a DESIGN.md — a semantic design system agents can read before they generate anything.
Also: Documentation
