Grim Prompter: threat modelling for coding agents

Type /threat-model in a repo and Grim Prompter has the agent map trust boundaries, list threats, check which controls already exist and propose fixes, citing a file and line for each. Jim Manico of Manicode Security wrote it and releases it under the MIT license. Anthropic doesn't publish it. For how a skill gets loaded, see what Claude skills are.

What's in the library

There are 36 architecture workflows and 29 method and analysis prompts. Architectures range from web, API and mobile apps to RAG, agentic AI, CI/CD pipelines, embedded firmware and smart contracts, and each one has a quick prompt and a deep one. On the methods side you'll find STRIDE per element, PASTA, LINDDUN GO for privacy, STPA, attack trees, CVSS, DREAD and MITRE ATLAS. Each method saves a JSON result that a later review can pick up.

A deep run has six stages: scope, system model, threat analysis, challenge, treatment planning and report. Each stage reads the previous stage's file, so you can stop partway and continue by naming the run folder. Output goes to a new folder under threat-model/: SYSTEM_UNDER_REVIEW.md holds scope, evidence and gaps, report.md holds findings and verification plans, and the JSON files are the baseline for the next review.

MCP servers and agent tools get specific attention. The review maps each tool to the backend credentials it can reach and looks at how far a shared token's damage would spread. A grant it can't confirm is recorded as a gap.

The rules it runs under

Every prompt follows a runbook that keeps the agent read-only. No builds, tests, installs, package scripts or network calls happen unless you authorise that exact command. Git runs with flags that stop project-supplied filters and helpers from executing. The agent won't open .env files or key stores, and a secret it does come across is written as a placeholder like [REDACTED:api-key]. It may not invent owners, dates, ratings, approvals or test results either.

How to install it

git clone https://github.com/jmanico/grim-prompter.git ~/grim-prompter
mkdir -p ~/.claude/skills && ln -s ~/grim-prompter/skills/threat-model ~/.claude/skills/threat-model

The skill is a symlink back into the clone, where its prompts live, so don't move ~/grim-prompter afterwards. For Codex CLI, link it into ~/.agents/skills instead. Open a new session when you're done. Any other agent can use a short snippet in AGENTS.md that points it at the runbook.

Example request

/threat-model deep [web | api | agentic-ai]. This review decides [whether we can ship the new billing service]. Inspect [services/billing and services/auth]; [the admin panel] is out of scope. Our design doc is [docs/architecture.md].

To check what a branch changes, name the earlier model as the baseline: /threat-model change main...feature using threat-model/[run-folder]/quick-report.json as the baseline. Without it, the agent asks.

Limits

• A draft, not a certificate. The README calls the prompts drafts and says a threat model doesn't certify a system as secure. Risk criteria, chosen fixes and owners come from you.
• Planned tests stay unrun. Verification plans are marked not_run until you authorise them and record the results.
• Reports are sensitive. Keep them out of version control until you've read them; the library's own .gitignore only covers runs inside its checkout.
• The boundary is behavioural. The runbook says its rules aren't a sandbox, so set your agent's permissions to enforce them as well.
• The README sells something separate. Its author section points to paid secure-coding prompts at manicode.ai. Those aren't part of this skill.

When to use it

Run it before a launch, a customer's security questionnaire or a design review where someone will ask what could go wrong. For correctness bugs in a specific diff, use Claude Code's review skill.