{
  "schemaVersion": 1,
  "skillId": "openai-security-threat-model",
  "revision": "49f948faa9258a0c61caceaf225e179651397431",
  "runAt": "2026-10-19",
  "mode": "source-review",
  "summary": "Completed 4 bounded source checks on the pinned entrypoint and license. No skill workflow was executed.",
  "sourceManifest": [
    {
      "path": "skills/.curated/security-threat-model/SKILL.md",
      "sha256": "1283c0dd62a8104d9edda4583569b5d8510b4ddaa45120687c999250fd96bad2",
      "sourceUrl": "https://github.com/openai/skills/blob/49f948faa9258a0c61caceaf225e179651397431/skills/.curated/security-threat-model/SKILL.md"
    },
    {
      "path": "skills/.curated/security-threat-model/LICENSE.txt",
      "sha256": "4dd13869245e356246a5b770723247bbb80a8f07a181d1d3d873a1734297cdb9",
      "sourceUrl": "https://github.com/openai/skills/blob/49f948faa9258a0c61caceaf225e179651397431/skills/.curated/security-threat-model/LICENSE.txt"
    }
  ],
  "cases": [
    {
      "id": "evidence-only",
      "method": "source-review; exact source condition checked, no workflow executed",
      "sourceUrl": "https://github.com/openai/skills/blob/49f948faa9258a0c61caceaf225e179651397431/skills/.curated/security-threat-model/SKILL.md",
      "expected": "Do not claim components, flows, or controls without evidence.",
      "observed": "Architectural claims must be grounded in the repository.",
      "passed": true
    },
    {
      "id": "confirm-assumptions",
      "method": "source-review; exact source condition checked, no workflow executed",
      "sourceUrl": "https://github.com/openai/skills/blob/49f948faa9258a0c61caceaf225e179651397431/skills/.curated/security-threat-model/SKILL.md",
      "expected": "Pause and wait for user feedback before producing the final report.",
      "observed": "The agent must confirm assumptions with the user.",
      "passed": true
    },
    {
      "id": "writes-file",
      "method": "source-review; exact source condition checked, no workflow executed",
      "sourceUrl": "https://github.com/openai/skills/blob/49f948faa9258a0c61caceaf225e179651397431/skills/.curated/security-threat-model/SKILL.md",
      "expected": "-threat-model.md",
      "observed": "The final output is written to a Markdown file.",
      "passed": true
    },
    {
      "id": "license",
      "method": "source-review; exact source condition checked, no workflow executed",
      "sourceUrl": "https://github.com/openai/skills/blob/49f948faa9258a0c61caceaf225e179651397431/skills/.curated/security-threat-model/LICENSE.txt",
      "expected": "Apache License",
      "observed": "The per-skill license file is Apache-2.0.",
      "passed": true
    }
  ],
  "results": {
    "passed": 4,
    "failed": 0,
    "total": 4
  },
  "findings": [
    {
      "severity": "attention",
      "title": "Not a security assurance",
      "detail": "The output is a model built from code reading and your answers. It doesn't test anything. Treat high-priority items as things to verify, not as findings."
    },
    {
      "severity": "info",
      "title": "Pauses for your input",
      "detail": "The workflow stops to confirm assumptions before producing the final report."
    }
  ],
  "limitations": [
    "Source review of SKILL.md and the per-skill license only. The reference prompt template and controls list were not reviewed.",
    "No repository was modeled. No accuracy or coverage result is claimed."
  ],
  "methodology": "Each source check records the exact source condition and the scoped observation it supports. Counts measure reviewed conditions, not completed user tasks, security assurance or model effectiveness."
}