# How to Do Threat Modeling for AI Coding Agents: grim-prompter Setup and Prompts > AI Release · @ai_release1 · https://ai-release.org/guides/kak-provesti-threat-modeling-dlya-ii-agenta-nastroyka-g_en.html ## TL;DR - **Time to complete:** 25–40 minutes - **Difficulty:** Intermediate - **You will need:** | Item | Details | |---|---| | OS | macOS or Linux. grim-prompter is documented as working **only in a local macOS/Linux shell** | | Shell | bash or zsh | | Coding agent | Claude Code or Codex CLI (any agent that reads `AGENTS.md` also works) | | `git` | Any recent version | | Repo to audit | A local clone of the project you want to threat-model | | grim-prompter | Prompt set from GitHub, MIT license, ships 36 architecture scenarios and 29 methodologies | Threat modeling — writing down what can go wrong with a system, who can cause it, and what stops it — normally takes a security architect a week. grim-prompter turns it into a prompt set your coding agent runs against the repository itself. ## Requirements and setup ![Illustration: Requirements and setup](https://ai-release.org/guides/img/kak-provesti-threat-modeling-dlya-ii-agenta-nastroyka-g-en-1.jpg?v=1793263818) - [ ] macOS or Linux host with a local shell. Windows without a Linux/macOS host is out of scope — the tool is documented as local-shell-only. - [ ] `git` on `PATH` - [ ] Claude Code **or** Codex CLI installed and authenticated, `claude` or `codex` reachable from the shell - [ ] Write access to your home directory (the install creates `~/.claude/skills` or `~/.agents/skills`) - [ ] A local clone of the repository under audit, on the same machine - [ ] The grim-prompter repository URL — the post does not print it, so open the GitHub page and copy the clone URL (verify it in the project README) Check the toolchain before anything else: ```bash git --version command -v claude || command -v codex echo $SHELL ``` **Example:** `command -v claude` prints `/Users//.local/bin/claude`. If it prints nothing, the agent CLI is not on your `PATH` and the skill will never be picked up. **Why it works:** grim-prompter is not a binary you execute — it is a folder of prompts that a coding agent loads as a *skill* (a directory the agent scans for instructions on demand). Everything therefore depends on two paths existing: the skill directory and the agent's skill search path. **Data flow you are building:** 1. Your repo (local) → 2. Coding agent session → 3. `skills/threat-model` loaded from grim-prompter → 4. Agent picks 1 of 36 architecture scenarios + 1 of 29 methodologies → 5. Report written into a `threat…` folder inside the repo. ## Step 1. Clone grim-prompter and inventory the skill contents **What to do:** clone the repository into a stable location and confirm the `skills/threat-model` folder is there. ```bash mkdir -p ~/tools && cd ~/tools git clone grim-prompter cd grim-prompter ls find skills -maxdepth 2 -type d ``` **Example:** `find skills -maxdepth 2 -type d` should list `skills/threat-model`. That exact path is what you symlink in Step 2 — if the folder is named differently, adapt the next command, not the other way round. **Why:** the symlink target must exist *before* the link is created; a typo here produces a broken link that the agent silently ignores. **How to check:** run `git -C ~/tools/grim-prompter log -1 --oneline` — you get one commit line. Then open the folder and read which scenarios and methodologies are shipped, since their exact names are not listed in our source — **check the repository documentation** and note 3–4 names that match your stack (for example an agent with tool calling, or an API service). ## Step 2. Wire the skill into your agent and run the threat-model prompts **What to do:** create the skill directory and link grim-prompter into it. Use `~/.claude/skills` for Claude Code, `~/.agents/skills` for Codex-style agents. ```bash mkdir -p ~/.claude/skills ln -s ~/tools/grim-prompter/skills/threat-model ~/.claude/skills/threat-model ls -l ~/.claude/skills/threat-model ``` **Example output:** ``` lrwxr-xr-x 1 staff 62 Nov 12 10:14 /Users//.claude/skills/threat-model -> /Users//tools/grim-prompter/skills/threat-model ``` For any other agent, skip the symlink and put the instruction in the repo's `AGENTS.md` instead: ```markdown ## Threat modeling ![Illustration: Threat modeling](https://ai-release.org/guides/img/kak-provesti-threat-modeling-dlya-ii-agenta-nastroyka-g-en-2.jpg?v=1793263822) When asked for a threat model, use the prompt set in `~/tools/grim-prompter/skills/threat-model`. It contains 36 architecture scenarios and 29 methodologies. Pick the scenario that matches this repository, pick one methodology, and write the report to the skill's output folder. ``` Now start the agent **inside your project repository** (not inside grim-prompter) and run the prompts below in order. **Prompt 1 — scenario triage (no report yet):** ``` Read this repository first: manifests, Dockerfiles, IaC, API routes, and any agent/tool definitions. Then, using the threat-model skill, list the 3 architecture scenarios out of the 36 that best match this codebase. One line of justification each. Do not write the report yet. ``` **Prompt 2 — full model:** ``` Build the threat model with the threat-model skill. Architecture scenario: Methodology: For every finding give: component and file, threat, ordered attack path, severity, and a mitigation naming the file or config key to change. Write the report to the skill output folder and print the absolute path. ``` **Prompt 3 — agent-specific pass (run it when the repo runs an LLM agent):** ``` Add a second pass focused on the agent loop: user prompt input, tool invocation, tool output returned to the model, memory/context, and every credential a tool can reach. Map each finding to the methodology you already selected. ``` **Why:** the two-pass order matters. Prompt 1 forces the agent to read the code before choosing a scenario, which is what stops it from producing a generic checklist; Prompt 2 then commits to one of the 29 methodologies so severities are comparable between runs. **How to check:** the agent prints an absolute path at the end of Prompt 2. Confirm the folder appeared: ```bash cd ~/ find . -maxdepth 2 -type f -newermt '-30 minutes' | head ``` **Example:** you see `./threat-model/report.md` — the folder name starts with `threat` but the exact spelling is not given in our source, so **check the repository documentation** and use the path the agent printed. ## Step 3. Verify the report is usable, not decorative ![Illustration: Step 3. Verify the report is usable, not decorative](https://ai-release.org/guides/img/kak-provesti-threat-modeling-dlya-ii-agenta-nastroyka-g-en-3.jpg?v=1793263829) **What to do:** grade the output against four hard checks before you hand it to anyone. ```bash REPORT= wc -l "$REPORT" grep -ci "severity" "$REPORT" grep -ci "mitigation" "$REPORT" ``` **Example:** a report that passes shows a non-zero count for both `severity` and `mitigation`, and every hit is on a line naming a file or config key — not a sentence like “apply security best practices”. Checklist for a report you can act on: - [ ] Top of the file names the chosen architecture scenario and the chosen methodology - [ ] Every finding names a real file, route, or container from *your* repo - [ ] Attack paths are ordered steps, not a single sentence - [ ] Each mitigation points to a file, config key, or command - [ ] Agent-specific section covers tool permissions and reachable credentials **Why:** a threat model is only worth the triage it enables. A finding without a file path cannot be assigned to anyone, and a mitigation without a config key cannot be verified after the fix. **How to check the coverage claim:** ask the agent *“list the 36 scenarios you rejected and why, one line each”*. You should get a list, which proves the whole set was considered rather than the first plausible one. Pair the result with the [jailbreak testing methodology](https://ai-release.org/guides/kak-proverit-llm-prilozhenie-na-dzheylbreyki-metodika-t.html?utm_source=tg&utm_medium=channel&utm_campaign=guide_inline&utm_content=guide_to_guide) if the agent accepts untrusted input — threat modeling finds the paths, jailbreak testing proves which ones are open. ## Troubleshooting **Problem. The symlink command fails with “No such file or directory”** - Error: `ln: failed to create symbolic link '/Users//.claude/skills/threat-model': No such file or directory` - Cause: the parent directory `~/.claude/skills` does not exist yet; `ln` does not create intermediate directories. - Solution: `mkdir -p ~/.claude/skills && ln -s ~/tools/grim-prompter/skills/threat-model ~/.claude/skills/threat-model` **Problem. Re-running the install fails because the link already exists** - Error: `ln: failed to create symbolic link '/Users//.claude/skills/threat-model': File exists` - Cause: a previous install left a link, possibly pointing at a moved folder. - Solution: `rm ~/.claude/skills/threat-model` and re-create the link, then confirm with `readlink ~/.claude/skills/threat-model`. **Problem. The agent ignores the skill and prints a generic checklist** - Error: no error at all — the answer just never mentions the 36 scenarios or the 29 methodologies. - Cause: either the agent CLI is not on `PATH` in this shell, or you launched the session outside the audited repository, or you used an agent that needs the `AGENTS.md` snippet. - Solution: `command -v claude || command -v codex`, restart the session from the repo root, and if the agent is not Claude Code or Codex CLI, add the `AGENTS.md` block from Step 2. If you have not built the agent itself yet, start with [turning an LLM chat into a full agent](https://ai-release.org/guides/kak-prevratit-obychnyy-chat-s-llm-v-polnotsennogo-ai-ag.html?utm_source=tg&utm_medium=channel&utm_campaign=guide_inline&utm_content=guide_to_guide). ## Summary and next steps You cloned grim-prompter, linked its `skills/threat-model` folder into your agent, and produced a report that names real files and concrete mitigations. Next, turn each mitigation into a ticket and re-run Prompt 2 after the fixes so the diff between the two reports shows what actually closed. ## FAQ **Which coding agents does grim-prompter support?** Claude Code and Codex CLI directly; any other coding agent that reads an `AGENTS.md` snippet. **How many architecture scenarios and methodologies are included?** 36 architecture scenarios and 29 methodologies, under the MIT license. **Does it work on Windows?** No — the project is documented as working only in a local macOS/Linux shell, so use a Linux or macOS host. **Where is the report written?** Into a `threat…` folder inside the audited repository; the exact folder name is not listed in our source, so check the repository documentation or use the absolute path the agent prints.