ca-threat-model
Opt-in lightweight STRIDE pass for a sensitive feature before implementation. Not a routine gate — invoke it when a change warrants security thought.
npx skills add arbiterForge/codeArbiter --skill ca-threat-model --agent codex
Same command for any agent — swap --agent for claude-code, cursor, copilot.
Weekly change comes from our own snapshots, not the repository page — it measures attention, not adoption.
# $ca-threat-model — STRIDE pass (opt-in) Optional, lightweight pre-implementation security review for a sensitive change — new external endpoints, new secrets-handling paths, new auth/authz flows. **Opt-in, not a routine gate**: nothing routes here automatically. Invoke it when a change warrants the thought; skip it otherwise. Read-only — modifies no file. Describe what the component does, what data it handles, and which actors interact with it. ## Routes to `security-architecture` (`${CLAUDE_PLUGIN_ROOT}/routines/security-architecture/SKILL.md`). The skill reads: - `<project-root>/.codearbiter/security-controls.md` — compliance requirements. - `<project-root>/.codearbiter/decisions/` — existing security-relevant ADRs. ## Output ``` ## Scope <what is being analyzed> ## STRIDE findings | Threat | Category | Likelihood | Impact | Control | |--------|-------------|------------|--------|------------------------------| | ... | S/T/R/I/D/E | H/M/L | H/M/L | <control or NONE — needs one> | ## Recommended controls before implementation - <control 1> ## Clearance CLEAR TO IMPLEMENT | BLOCKED — resolve findings first ``` ## When NOT to use - Reviewing already-written code → `$ca-review`. -
- Routes to
- Output
- When NOT to use
- Hard gate
What does the ca-threat-model skill do?
Opt-in lightweight STRIDE pass for a sensitive feature before implementation. Not a routine gate — invoke it when a change warrants security thought.
How do I install it?
Run `npx skills add arbiterForge/codeArbiter --skill ca-threat-model --agent claude-code` — it drops the skill into your project so the agent can pick it up. Swap the --agent value for codex, cursor or copilot if you use one of those.
Where does this skill come from?
From arbiterForge/codeArbiter, a repository with 138 stars. We read it straight from the repository tree rather than a submitted listing, so what you see here is what is actually published.
Is a popular skill a good skill?
Not necessarily. Stars measure attention, not adoption — a repository can trend for a week and be abandoned. That is why we show the weekly change from our own snapshots next to the total, instead of a single flattering number.