How do I install the Thinking Threatmodel skill?

Run npx skillmds@latest add carlheath/thinking-threatmodel in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is Thinking Threatmodel safe to use?

This skill has not completed SkillMD's automated safety review yet. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Thinking Threatmodel?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Thinking Threatmodel free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published Thinking Threatmodel?

carlheath (@carlheath) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Thinking Threatmodel by carlheath — Agent Skill

Name: Thinking Threatmodel
Author: carlheath

Thinking Threatmodel

Tests ideas, decisions, and strategies across multiple time horizons and threat scenarios. Inspired by Daniel Miessler's WorldThreatModelHarness. [WHAT] Threat modeling that tests a strategy/idea/decision against 7 time horizons and 5 threat dimensions. Produces a vulnerability matrix and recommendations. [WHEN] Use when: threat model, time horizons, futures analysis, future implications, "how does this hold up over time?", "what happens if..." [EXPERTISE] Threat modeling, scenario analysis, temporal risk assessment, futures thinking

carlheath 1ba213a 2.7 KB Updated Sep 17, 2026

File contents

Threat Model (World Threat Model)

Role: temporal and dimensional threat modeling. Tone: analytical, concrete, honest about uncertainty.

Method

Test the target (strategy/decision/idea) against a matrix of time horizons and threat dimensions.

7 time horizons

Horizon	Timeframe	Perspective
H1	1 week	Immediate operational
H2	1 month	Tactical
H3	6 months	Project cycle
H4	1 year	Strategic
H5	3 years	Policy horizon
H6	10 years	Structural change
H7	25+ years	Generational shift

5 threat dimensions (default — adapt as needed)

Dimension	Examples
Technological disruption	AI breakthroughs, quantum computing, platform collapse
Geopolitical shift	Alliance break-up, trade blocs, conflicts
Institutional erosion	Disinformation, institutional capture, polarization
Regulatory change	EU legislation, data sovereignty, AI Act
Economic stress	Recession, budget cuts, funding drought

Output format

## Threat Model: [The target]

### Vulnerability matrix

|  | Tech | Geopolitical | Institutional | Regulatory | Economic |
|---|---|---|---|---|---|
| H1 (1w) | ○/◐/● | ... | ... | ... | ... |
| H2 (1m) | ... | ... | ... | ... | ... |
| H3 (6m) | ... | ... | ... | ... | ... |
| H4 (1y) | ... | ... | ... | ... | ... |
| H5 (3y) | ... | ... | ... | ... | ... |
| H6 (10y) | ... | ... | ... | ... | ... |
| H7 (25y) | ... | ... | ... | ... | ... |

○ = Robust  ◐ = Vulnerable  ● = Critical vulnerability

### Critical intersections

[Where in the matrix do threats converge? Which combinations are most dangerous?]

### Top 5 threats

1. [H?/Dimension]: [Specific threat, concretely described]
2. ...

### Recommendations

[How to strengthen robustness against the identified threats?]

Rules

Be SPECIFIC per cell. "Tech could disrupt" is worthless. "GPT-6-level AI could automate the manual analysis step, undermining the team's expertise advantage" is valuable.
Not every cell needs to be filled. Focus on ◐ and ● cells.
Threat dimensions can be adapted to the question (e.g. add "Key-person risk" or "Climate").

---name: thinking-threatmodeldescription: Tests ideas, decisions, and strategies across multiple time horizons and threat scenarios. Inspired by Daniel Miessler's WorldThreatModelHarness. [WHAT] Threat modeling that tests a strategy/idea/decision against 7 time horizons and 5 threat dimensions. Produces a vulnerability matrix and recommendations. [WHEN] Use when: threat model, time horizons, futures analysis, future implications, "how does this hold up over time?", "what happens if..." [EXPERTISE] Threat modeling, scenario analysis, temporal risk assessment, futures thinking---# Threat Model (World Threat Model)**Role:** temporal and dimensional threat modeling.**Tone:** analytical, concrete, honest about uncertainty.## MethodTest the target (strategy/decision/idea) against a matrix of time horizons and threat dimensions.### 7 time horizons| Horizon | Timeframe | Perspective ||---|---|---|| H1 | 1 week | Immediate operational || H2 | 1 month | Tactical || H3 | 6 months | Project cycle || H4 | 1 year | Strategic || H5 | 3 years | Policy horizon || H6 | 10 years | Structural change || H7 | 25+ years | Generational shift |### 5 threat dimensions (default — adapt as needed)| Dimension | Examples ||---|---|| **Technological disruption** | AI breakthroughs, quantum computing, platform collapse || **Geopolitical shift** | Alliance break-up, trade blocs, conflicts || **Institutional erosion** | Disinformation, institutional capture, polarization || **Regulatory change** | EU legislation, data sovereignty, AI Act || **Economic stress** | Recession, budget cuts, funding drought |## Output format```markdown## Threat Model: [The target]### Vulnerability matrix| | Tech | Geopolitical | Institutional | Regulatory | Economic ||---|---|---|---|---|---|| H1 (1w) | ○/◐/● | ... | ... | ... | ... || H2 (1m) | ... | ... | ... | ... | ... || H3 (6m) | ... | ... | ... | ... | ... || H4 (1y) | ... | ... | ... | ... | ... || H5 (3y) | ... | ... | ... | ... | ... || H6 (10y) | ... | ... | ... | ... | ... || H7 (25y) | ... | ... | ... | ... | ... |○ = Robust ◐ = Vulnerable ● = Critical vulnerability### Critical intersections[Where in the matrix do threats converge? Which combinations are most dangerous?]### Top 5 threats1. [H?/Dimension]: [Specific threat, concretely described]2. ...### Recommendations[How to strengthen robustness against the identified threats?]```## Rules- Be SPECIFIC per cell. "Tech could disrupt" is worthless. "GPT-6-level AI could automate the manual analysis step, undermining the team's expertise advantage" is valuable.- Not every cell needs to be filled. Focus on ◐ and ● cells.- Threat dimensions can be adapted to the question (e.g. add "Key-person risk" or "Climate").

Frequently asked questions