Build a threat model for a target codebase. Three modes: "interview" walks an application owner through the four-question framework and produces a threat model from their answers; "bootstrap" derives a threat model from the code plus past vulnerabilities (CVEs, git history, pentest reports) when no owner is available; "bootstrap-then-interview" chains the two when both owner and codebase are…
Install
npx skills add anthropics/defending-code-reference-harness --skill threat-modelnpx skills add anthropics/defending-code-reference-harness --skill threat-model -a claude-code -gnpx skills add anthropics/defending-code-reference-harness --skill threat-model -a codex -ggemini skills install https://github.com/anthropics/defending-code-reference-harness.git --path .claude/skills/threat-modelgh skill install anthropics/defending-code-reference-harness threat-modelgit clone --depth 1 https://github.com/anthropics/defending-code-reference-harness /tmp/anthropics__defending-code-reference-harness
mkdir -p ~/.claude/skills ~/.agents/skills
cp -R /tmp/anthropics__defending-code-reference-harness/.claude/skills/threat-model ~/.claude/skills/threat-model # Claude Code
cp -R /tmp/anthropics__defending-code-reference-harness/.claude/skills/threat-model ~/.agents/skills/threat-model # Codex, Cursor, Gemini CLI, Copilot, OpenCode