Omh Application Threat Model
[omh] Attack paths into an operated system: turn a system's components and data flows...
Install
npx skills add rlaope/oh-my-hermes --skill omh-application-threat-model -g -a claude-code -y- Repository
- rlaope/oh-my-hermes5k
- Category
- Testing
- Updated
- 3d ago
- License
- MIT
- Context cost
- Mediumabout 2,309 tokens
- Runs scripts
- No, instructions only
What it does
[omh] Attack paths into an operated system: turn a system's components and data flows into assets, trust boundaries, attack scenarios, controls, and the security test that proves each control holds. Use when the user says: application-threat-model, application threat model, threat model, threat modeling, threat modelling, threat modeling session, threat modeling workshop, security threat model.
Application Threat Model
This is an OMH application-threat-model workflow skill, projected for Agent Skills hosts (Claude Code, Codex, Cursor, opencode, OpenClaw, pi).
Why This Exists
application-threat-model exists because the nearest neighbour does not merely miss this request. security-safety-review maps the agent's own prompt, tool, credential, and dependency surface, so an application threat-model request came back as an agent tool inventory under a near-identical name, a confident wrong artifact rather than a miss, in the one domain where that costs most.
Do Not Use When
- The subject is the agent's own prompts, tools, files, credentials, dependencies, or destructive actions; use
omh-security-safety-review, which maps that runtime surface. - The user wants defects found in a diff or a file; use
omh-code-review. - The user asks whether a release is ready across rollout, rollback, and observability; use
omh-production-audit. - The user asks which commands prove a merge is safe; use
omh-verification-gate. - The user asks for a contractual or regulatory obligation rather than an attacker; use
omh-legal-compliance-review.
Examples
Good example:
- Prompt: build a threat model for our payment service architecture
- Expected behavior: Prepare application_threat_model/v1: ask for the component map and data flows, register card data and settlement records as assets, mark the merchant API edge and the PSP callback as trust boundaries, derive scenarios per boundary, decide a control for each, and name the test that fails when the control is removed.
- Why: The subject is an application the user operates, and the goal needs assets, boundaries, scenarios, controls, and tests.
Bad example:
