josemlopez

claude-threatmodel

Automated threat modeling for Claude Code

3 skills • 182 lines • ~2K tokens • Minimal context window impact

What This Does

This plugin adds automatic security assessment to Claude Code. When you approve an implementation plan, it runs a threat analysis before code gets written—not weeks later when fixes are expensive.

The key insight: Security review should happen at the moment of intent, not after deployment.

How It Works

The Trigger

When you're in Claude Code and approve a plan (ExitPlanMode), a hook fires automatically. No commands to remember—security assessment just happens.

The Subagent Architecture

Here's what makes this different: threat analysis runs in a subagent, not in your main conversation.

Why does this matter?

Traditional security tools inject their entire analysis into your conversation, eating up precious context. This plugin spawns a separate agent that:

1. Runs /threatmodel:quick in its own context
2. Scans for vulnerabilities
3. Returns only a brief summary to your main conversation
4. Your context window stays clean for actual work

The Flow

You: "Implement user authentication"
     ↓
Claude: [Creates plan]
     ↓
You: [Approve plan] → ExitPlanMode
     ↓
Hook fires → Subagent spawns
     ↓
Subagent: Runs /threatmodel:quick
          • Scans for hardcoded credentials
          • Checks for injection vulnerabilities
          • Looks for XSS patterns
          • Returns: "Found 2 high risks..."
     ↓
Claude: Continues with security-aware implementation

Risk-Based Escalation

The quick assessment calculates a risk level:

You decide whether to run the full analysis. The plugin doesn't block you—it informs you.

The 3 Skills

What Quick Scans For

• Hardcoded credentials (password.*=.*["'])
• Code injection (eval(, exec()
• SQL injection (query.*+.*req.)
• XSS vulnerabilities (innerHTML.*=)

What Full Analyzes

• Spoofing - Can attackers impersonate?
• Tampering - Can data be modified?
• Repudiation - Can actions be denied?
• Information Disclosure - Can data leak?
• Denial of Service - Can service be disrupted?
• Elevation of Privilege - Can permissions be gained?

Plus: OWASP Top 10 mapping, SOC2/PCI-DSS compliance checks, baseline snapshots for drift detection.

Installation

Option 1: Plugin Marketplace (Recommended)

/plugin marketplace add josemlopez/claude-threatmodel
/plugin install threatmodel@josemlopez

Done. The plugin includes skills and hooks—no configuration needed.

Option 2: Ask Claude

Just say:

Install the threat modeling plugin from https://github.com/josemlopez/claude-threatmodel

Verify It Works

/threatmodel:status

Or: approve any implementation plan and watch the security assessment run.

git clone https://github.com/josemlopez/claude-threatmodel.git
claude --plugin-dir ./claude-threatmodel

cp -r skills/quick ~/.claude/skills/tm-quick
cp -r skills/full ~/.claude/skills/tm-full
cp -r skills/status ~/.claude/skills/tm-status

Technical Details

The Hook

The plugin registers a PostToolUse hook that matches ExitPlanMode: