Grim Prompter turns a coding agent into a threat modeler

Threat modeling is the security step teams skip. A new MIT-licensed project tries to make it one command inside the coding agent a developer already uses. Grim Prompter is a skill for Claude Code and Codex, written by Jim Manico. The GitHub API reported 92 stars for the repository, which is two days old.

Grim Prompter is listed in the trending repositories feed, which is how the AI News found it. The repository had no open issues on the day of the check. The language field was empty, which means the project is a skill definition (prompts and runbooks) and not application code.

What the command does

The README says a developer runs /threat-model inside Claude Code or $threat-model inside Codex CLI. The repository must be open. The agent reads the code and writes a report into a threat-model/ folder next to it. The review is read-only. Every finding must carry a file-and-line citation. A reviewer can open each cited file and ask two questions. Does the risk apply here? And does the code include the named control?

The project includes 36 architecture templates. These cover web, mobile, API, cloud, data and AI, IoT, identity, and blockchain. It also includes 29 analysis methods. The methods include STRIDE and PASTA for threat discovery. Two LINDDUN variants cover privacy. Four methods cover safety. A quick pass picks one architecture: /threat-model quick api. A deep pass runs six stages. The README names them as scope, system modelling, threat analysis, challenge, treatment planning, and reporting. Each stage reads the file the previous stage wrote.

What the README does not say

The README reports no numbers for how long a pass takes. It does not say how many tokens one pass uses. It does not say how often the output misses a risk a human reviewer would catch. The licence is MIT. The repository had no open issues at the time of the check.

The gap it leaves

A model that reads a repository cannot see what is deployed. It cannot see how secrets are managed. It cannot see how an incident is handled in practice. The threats that depend on those are not in the file-and-line evidence this skill works from. A team that reads a Grim Prompter report as a finished threat model will miss them. Read it as a first draft that a security engineer finishes. The shape is useful. Threat modelling moves from a meeting that waits for everyone, to a review that starts on today's pull request.

Source

Grim Prompter on GitHub by Jim Manico.