Use when Codex is already in the threat-modeling phase of a security scan, the user explicitly invokes $threat-model, or the user explicitly asks to create, update, or persist a repository threat model. Do not use as the primary trigger for full PR, commit, branch, patch, or repository scans.
Install
npx skills add openai/plugins --skill threat-modelnpx skills add openai/plugins --skill threat-model -a claude-code -gnpx skills add openai/plugins --skill threat-model -a codex -ggemini skills install https://github.com/openai/plugins.git --path plugins/codex-security/skills/threat-modelgh skill install openai/plugins threat-modelgit clone --depth 1 https://github.com/openai/plugins /tmp/openai__plugins
mkdir -p ~/.claude/skills ~/.agents/skills
cp -R /tmp/openai__plugins/plugins/codex-security/skills/threat-model ~/.claude/skills/threat-model # Claude Code
cp -R /tmp/openai__plugins/plugins/codex-security/skills/threat-model ~/.agents/skills/threat-model # Codex, Cursor, Gemini CLI, Copilot, OpenCode