---
title: "ThreatModel - Air Market"
description: "You have accounts, machines and data spread around, and no clear picture of what a break-in would reach. This maps where the sensitive things live, runs through what a compromised asset would expose…"
canonical: "https://airmarket.ai/app/threatmodel"
---

[Air Market](/) / [Security](/category/security) / ThreatModel

Skill by [Daniel Miessler 🛡️](/@danielmiessler)

# ThreatModel

Know what breaks if one of your accounts is taken

## What this does

You have accounts, machines and data spread around, and no clear picture of what a break-in would reach. This maps where the sensitive things live, runs through what a compromised asset would expose and how you would respond, and keeps a register of risks with owners and review dates. Your real data stays in your own private tree.

### Top 3 things it does for you

- Map where your sensitive data actually lives
- Play out what a hacked asset would expose
- Keep a running register of risks and who owns them

## Information

**ThreatModel at a glance**

|  |  |
| --- | --- |
| Kind | Skill |
| Publisher | [Daniel Miessler 🛡️](/@danielmiessler) |
| Category | [Security](/category/security) |
| Works with | Agent Skills - an open standard supported by 40+ agents |
| Version | 1.0.1 |
| Size | 33 KB |
| Licence | MIT |
| Repository | [danielmiessler/LifeOS](https://github.com/danielmiessler/LifeOS/tree/47df8eebf08d78a3ef5851ec2f9b751bae6558fb/LifeOS/install/skills/ThreatModel) |
| GitHub stars | 18,706 (as of Nov 2026) |

## Security report

**Verified.** AIR scanned this exact version of ThreatModel and flagged nothing. AIR's verdict: **safe**.

**What ThreatModel's check was run against**

|  |  |
| --- | --- |
| Commit | 47df8eebf08d78a3ef5851ec2f9b751bae6558fb |
| Content hash | 23a5757fe3b15c79d91f1d612e911298e4f4a090aabf862824f095f964f3b2d2 |
| Files read | [Browse the files at this exact commit](https://github.com/danielmiessler/LifeOS/blob/47df8eebf08d78a3ef5851ec2f9b751bae6558fb/LifeOS/install/skills/ThreatModel/SKILL.md) |

A scan is named by the exact content it read, not by a version number. A different version is a different artifact, and nothing here applies to a version AIR has not scanned.

[Read the full security report for ThreatModel](/security/threatmodel)

## About ThreatModel

This is defensive threat modeling and risk management for your own estate. It maps where sensitive data lives across your asset graph, runs compromise scenarios - what a hacked asset exposes, its blast radius, how you would respond - and maintains a persistent risk register with likelihood by impact scoring, owners, mitigations and a review cadence, all through a deterministic CLI.

All real data stays in your private USER tree; the skill itself is code only.

It fits adding a risk, accepting a risk, classifying data, asking where our sensitive data is, or reviewing security posture. Its own notes rule out active pentesting or exploitation, world-scale futures stress-testing of ideas, and actually executing incident response - it plans those runbooks rather than running them.

## What's inside

- SKILL.md - instructions
- Tools/RiskRegister.ts - script
- Workflows/CompromiseScenario.md - reference
- Workflows/RiskRegister.md - reference
- Workflows/SensitiveDataMap.md - reference
- Workflows/ThreatModelTarget.md - reference

## Questions

### Is ThreatModel safe to install?

AIR scanned this exact version of ThreatModel and flagged nothing. AIR's verdict: safe. The verdict is named by the content that was read, at commit 47df8eebf08d, so it cannot drift onto a version nobody scanned. The full report is at https://airmarket.ai/security/threatmodel.

### How do I install ThreatModel?

Open https://airmarket.ai/app/threatmodel on Air Market and use the install action: Air Market hands Claude a prompt naming this exact skill, and Claude sets it up. Source, pinned to the exact commit this listing describes: https://github.com/danielmiessler/LifeOS/tree/47df8eebf08d78a3ef5851ec2f9b751bae6558fb/LifeOS/install/skills/ThreatModel. Install from that link, not the branch.

## Related on Air Market

- [More Security listings](/category/security)
- [Everything by Daniel Miessler 🛡️](/@danielmiessler)

---

Canonical URL: <https://airmarket.ai/app/threatmodel>