How to Do Threat Modeling for AI Coding Agents: grim-prompter Setup and Prompts
TL;DR
- Time to complete: 25–40 minutes
- Difficulty: Intermediate
- You will need:
| Item | Details |
|---|---|
| OS | macOS or Linux. grim-prompter is documented as working **only in a local macOS/Linux shell** |
| Shell | bash or zsh |
| Coding agent | Claude Code or Codex CLI (any agent that reads `AGENTS.md` also works) |
| `git` | Any recent version |
| Repo to audit | A local clone of the project you want to threat-model |
| grim-prompter | Prompt set from GitHub, MIT license, ships 36 architecture scenarios and 29 methodologies |
Threat modeling — writing down what can go wrong with a system, who can cause it, and what stops it — normally takes a security architect a week. grim-prompter turns it into a prompt set your coding agent runs against the repository itself.
Requirements and setup
- [ ] macOS or Linux host with a local shell. Windows without a Linux/macOS host is out of scope — the tool is documented as local-shell-only.
- [ ]
gitonPATH - [ ] Claude Code or Codex CLI installed and authenticated,
claudeorcodexreachable from the shell - [ ] Write access to your home directory (the install creates
~/.claude/skillsor~/.agents/skills) - [ ] A local clone of the repository under audit, on the same machine
- [ ] The grim-prompter repository URL — the post does not print it, so open the GitHub page and copy the clone URL (verify it in the project README)
Check the toolchain before anything else:
git --version
command -v claude || command -v codex
echo $SHELLExample: command -v claude prints /Users/<you>/.local/bin/claude. If it prints nothing, the agent CLI is not on your PATH and the skill will never be picked up.
Why it works: grim-prompter is not a binary you execute — it is a folder of prompts that a coding agent loads as a *skill* (a directory the agent scans for instructions on demand). Everything therefore depends on two paths existing: the skill directory and the agent's skill search path.
Data flow you are building:
1. Your repo (local) → 2. Coding agent session → 3. skills/threat-model loaded from grim-prompter → 4. Agent picks 1 of 36 architecture scenarios + 1 of 29 methodologies → 5. Report written into a threat… folder inside the repo.
Step 1. Clone grim-prompter and inventory the skill contents
What to do: clone the repository into a stable location and confirm the skills/threat-model folder is there.
mkdir -p ~/tools && cd ~/tools
git clone <grim-prompter-repo-url> grim-prompter
cd grim-prompter
ls
find skills -maxdepth 2 -type dExample: find skills -maxdepth 2 -type d should list skills/threat-model. That exact path is what you symlink in Step 2 — if the folder is named differently, adapt the next command, not the other way round.
Why: the symlink target must exist *before* the link is created; a typo here produces a broken link that the agent silently ignores.
How to check: run git -C ~/tools/grim-prompter log -1 --oneline — you get one commit line. Then open the folder and read which scenarios and methodologies are shipped, since their exact names are not listed in our source — check the repository documentation and note 3–4 names that match your stack (for example an agent with tool calling, or an API service).
Step 2. Wire the skill into your agent and run the threat-model prompts
What to do: create the skill directory and link grim-prompter into it. Use ~/.claude/skills for Claude Code, ~/.agents/skills for Codex-style agents.
mkdir -p ~/.claude/skills
ln -s ~/tools/grim-prompter/skills/threat-model ~/.claude/skills/threat-model
ls -l ~/.claude/skills/threat-modelExample output:
lrwxr-xr-x 1 <you> staff 62 Nov 12 10:14 /Users/<you>/.claude/skills/threat-model -> /Users/<you>/tools/grim-prompter/skills/threat-modelFor any other agent, skip the symlink and put the instruction in the repo's AGENTS.md instead:
## Threat modeling
When asked for a threat model, use the prompt set in `~/tools/grim-prompter/skills/threat-model`.
It contains 36 architecture scenarios and 29 methodologies. Pick the scenario that matches
this repository, pick one methodology, and write the report to the skill's output folder.Now start the agent inside your project repository (not inside grim-prompter) and run the prompts below in order.
Prompt 1 — scenario triage (no report yet):
Read this repository first: manifests, Dockerfiles, IaC, API routes, and any agent/tool
definitions. Then, using the threat-model skill, list the 3 architecture scenarios out of
the 36 that best match this codebase. One line of justification each. Do not write the
report yet.Prompt 2 — full model:
Build the threat model with the threat-model skill.
Architecture scenario: <name from Prompt 1>
Methodology: <one of the 29 methodologies in the skill>
For every finding give: component and file, threat, ordered attack path, severity,
and a mitigation naming the file or config key to change.
Write the report to the skill output folder and print the absolute path.Prompt 3 — agent-specific pass (run it when the repo runs an LLM agent):
Add a second pass focused on the agent loop: user prompt input, tool invocation,
tool output returned to the model, memory/context, and every credential a tool can reach.
Map each finding to the methodology you already selected.Why: the two-pass order matters. Prompt 1 forces the agent to read the code before choosing a scenario, which is what stops it from producing a generic checklist; Prompt 2 then commits to one of the 29 methodologies so severities are comparable between runs.
How to check: the agent prints an absolute path at the end of Prompt 2. Confirm the folder appeared:
cd ~/<your-project>
find . -maxdepth 2 -type f -newermt '-30 minutes' | headExample: you see ./threat-model/report.md — the folder name starts with threat but the exact spelling is not given in our source, so check the repository documentation and use the path the agent printed.
Step 3. Verify the report is usable, not decorative
What to do: grade the output against four hard checks before you hand it to anyone.
REPORT=<path printed by the agent>
wc -l "$REPORT"
grep -ci "severity" "$REPORT"
grep -ci "mitigation" "$REPORT"Example: a report that passes shows a non-zero count for both severity and mitigation, and every hit is on a line naming a file or config key — not a sentence like “apply security best practices”.
Checklist for a report you can act on:
- [ ] Top of the file names the chosen architecture scenario and the chosen methodology
- [ ] Every finding names a real file, route, or container from *your* repo
- [ ] Attack paths are ordered steps, not a single sentence
- [ ] Each mitigation points to a file, config key, or command
- [ ] Agent-specific section covers tool permissions and reachable credentials
Why: a threat model is only worth the triage it enables. A finding without a file path cannot be assigned to anyone, and a mitigation without a config key cannot be verified after the fix.
How to check the coverage claim: ask the agent *“list the 36 scenarios you rejected and why, one line each”*. You should get a list, which proves the whole set was considered rather than the first plausible one. Pair the result with the jailbreak testing methodology if the agent accepts untrusted input — threat modeling finds the paths, jailbreak testing proves which ones are open.
Troubleshooting
Problem. The symlink command fails with “No such file or directory”
- Error:
ln: failed to create symbolic link '/Users/<you>/.claude/skills/threat-model': No such file or directory - Cause: the parent directory
~/.claude/skillsdoes not exist yet;lndoes not create intermediate directories. - Solution:
mkdir -p ~/.claude/skills && ln -s ~/tools/grim-prompter/skills/threat-model ~/.claude/skills/threat-model
Problem. Re-running the install fails because the link already exists
- Error:
ln: failed to create symbolic link '/Users/<you>/.claude/skills/threat-model': File exists - Cause: a previous install left a link, possibly pointing at a moved folder.
- Solution:
rm ~/.claude/skills/threat-modeland re-create the link, then confirm withreadlink ~/.claude/skills/threat-model.
Problem. The agent ignores the skill and prints a generic checklist
- Error: no error at all — the answer just never mentions the 36 scenarios or the 29 methodologies.
- Cause: either the agent CLI is not on
PATHin this shell, or you launched the session outside the audited repository, or you used an agent that needs theAGENTS.mdsnippet. - Solution:
command -v claude || command -v codex, restart the session from the repo root, and if the agent is not Claude Code or Codex CLI, add theAGENTS.mdblock from Step 2. If you have not built the agent itself yet, start with turning an LLM chat into a full agent.
Summary and next steps
You cloned grim-prompter, linked its skills/threat-model folder into your agent, and produced a report that names real files and concrete mitigations. Next, turn each mitigation into a ticket and re-run Prompt 2 after the fixes so the diff between the two reports shows what actually closed.
FAQ
Which coding agents does grim-prompter support?
Claude Code and Codex CLI directly; any other coding agent that reads an AGENTS.md snippet.
How many architecture scenarios and methodologies are included?
36 architecture scenarios and 29 methodologies, under the MIT license.
Does it work on Windows?
No — the project is documented as working only in a local macOS/Linux shell, so use a Linux or macOS host.
Where is the report written?
Into a threat… folder inside the audited repository; the exact folder name is not listed in our source, so check the repository documentation or use the absolute path the agent prints.
🤖 AI summary
- Updated: 2026-10-29
- Topics: grim-prompter, threat modeling ии-агента, модель угроз для ai-агента, безопасность coding-агента
- Summary: Пошагово подключаем grim-prompter к Claude Code или Cursor, строим модель угроз для репозитория и разбираем результаты анализа рисков агента.
- Key facts:
- TL;DR Time to complete: 25–40 minutes Difficulty: Intermediate You will need: Item Details OS macOS or Linux.
- grim-prompter is documented as working only in a local macOS/Linux shell Shell bash or zsh Coding agent Claude Code or Codex CLI (any agent that reads AGENTS.md also works) git Any recent version Repo to audit A local clone of the project you want to threat-model grim-prompter Prompt set from GitHub, MIT license, ships 36 architecture scenarios and 29 methodologies Threat modeling — writing down what can go wrong with a system, who can cause it, and what stops it — normally takes a security architect a week.
- grim-prompter turns it into a prompt set your coding agent runs against the repository itself.
- Requirements and setup Illustration: Requirements and setup [ ] macOS or Linux host with a local shell.
- Windows without a Linux/macOS host is out of scope — the tool is documented as local-shell-only.
- [ ] git on PATH [ ] Claude Code or Codex CLI installed and authenticated, claude or codex reachable from the shell [ ] Write access to your home directory (the install creates ~/.claude/skills or ~/.agents/skills ) [ ] A local clone of the repository under audit, on the same machine [ ] The grim-prompter repository URL — the post does not print it, so open the GitHub page and copy the clone URL (verify it in the project README) Check the toolchain before anything else: git --version command -v claude || command -v codex echo $SHELL Example: command -v claude prints /Users/<you>/.local/bin/claude .