Skip to content

Threat Model

Build a THREAT_MODEL.md by interviewing the owner or reading the code and past CVEs.

Official Anthropicby AnthropicChecked October 18, 2026

Part of Anthropic's defending code reference harness, a public toolkit for finding and fixing vulnerabilities with Claude. This skill maps what an attacker would target, either through a guided interview or by bootstrapping from code and history.

Who it is for

  • Security engineers
  • Tech leads
  • CTOs

Prompts to try

Once the skill is installed, ask for the result in plain words. Claude picks the skill up on its own.

Prompt 1
Threat model this codebase
Prompt 2
Map the attack surface of our payments service
Prompt 3
What should we be worried about in this repo?

How to install it

In Claude Code

  1. git clone https://github.com/anthropics/defending-code-reference-harness

  2. cd defending-code-reference-harness and run claude,

  3. /threat-model

In Claude.ai

Not practical in Claude.ai because it runs inside a cloned repository in Claude Code.

Good to know

Start with /quickstart for a guided tour. The harness also includes scanning, triage, patching and verification skills.

Unlock the install steps

Free. Leave your email once to open the install steps for all 149 skills, and get the best new skills each month.

No spam. One click to unsubscribe. We use your email to send you the course and AI tips.

How we checked it

Confirmed SKILL.md at .claude/skills/threat-model/SKILL.md in anthropics/defending-code-reference-harness via the GitHub API; skill folder last changed 2026-07-16, repo has 7,597 stars and was pushed 2026-08-06; the repo LICENSE file is Apache 2.0 even though GitHub shows no detected license.

Source: github.com/anthropics/defending-code-reference-harness/tree/main/.claude/skills/threat-model

More security skills