Threat Mitigation Mapping Skill (wshobson): Match Threats to Controls

threat-mitigation-mapping helps Claude link each known security threat to controls and write a prioritized remediation plan.

Installs: 20.6K; on skills.sh
Stars: 42.1K; on GitHub
Files: 1; besides SKILL.md
Updated: Oct 2026; last repo commit

The skill loads when you ask Claude to prioritize security investments, build a remediation plan or check control coverage. SKILL.md gives the ground rules: three control types (preventive, detective, corrective), five layers (network, application, data, endpoint, process) and a defense-in-depth diagram.

The templates are in references/details.md. It holds four Python templates: a mitigation model, a control library, a mitigation analysis and a control-effectiveness test. It also holds Markdown report outlines for an executive summary, critical gaps, recommendations and an implementation roadmap.

It starts from threats you already identified. It does not find them, so pair it with a threat model. The SKILL.md has no scripts to run, only code the assistant can adapt.

Good for

Security engineers turning a threat model into a remediation roadmap
Architects reviewing whether controls are layered and mixed
Team leads deciding where to spend security budget

Install threat-mitigation-mapping

Claude Code

Copy this prompt.

Install the threat-mitigation-mapping skill in Claude Code. Run this command:

npx skills add https://github.com/wshobson/agents --skill threat-mitigation-mapping

Then check that it loaded and tell me how to use it.

2
Paste it into Claude Code. It shows the change and asks before running it.

Requires Node.js.

From its listing on skills.sh. Source.

What's in the skill

When it loads

Map identified threats to appropriate security controls and mitigations. Use when prioritizing security investments, creating remediation plans, or validating control effectiveness.

Sections in SKILL.md

When to Use This Skill
Core Concepts
1. Control Categories
2. Control Layers
3. Defense in Depth
Templates and detailed worked examples
Best Practices
Do's
Don'ts

Key facts

Author: wshobson (GitHub: wshobson)
Repo: wshobson/agents
Installs on skills.sh: 20,637 as of 2026-11-02
GitHub stars (whole repo): 42,081 as of 2026-11-02
License: MIT
Last repo commit: 2026-10-30
Files in the skill folder: 2 files including SKILL.md
skills.sh audits: Gen Agent Trust Hub pass, Socket pass, Snyk pass

What it includes

Preventive, detective and corrective controls
Each threat should get a mix of control types, such as input validation, log monitoring and backup restore.
Control categories
Network, application, data, endpoint, process
Five layers with examples, used to check that no single layer carries the defense.
Control layers
Nested diagram from perimeter to data
A reference picture for layering controls: firewall and WAF, segmentation, EDR, authentication and encryption.
Defense in depth
Python dataclasses for threats, controls and mappings
In references/details.md. Includes a coverage score and checks for defense in depth and control diversity.
Template 1: Mitigation model
A library of standard controls with IDs
In references/details.md, for example AUTH-001 Multi-Factor Authentication, with type, layer, effectiveness and cost.
Template 2: Control library
Risk reduction, gaps and an executive report
In references/details.md. Produces Executive Summary, Critical Gaps, Recommendations and Implementation Roadmap sections.
Template 3: Mitigation analysis
Run named tests against controls and report results
In references/details.md. Defines control tests with an expected result and a "Results by Control" report.
Template 4: Control effectiveness testing
Map all threats, layer controls, test them, review often
Includes: no single controls, count cost, do not skip testing, include people and process.
Do and do not list

From the official docs

Questions

What does the threat-mitigation-mapping skill do?

It guides Claude to match each identified threat to preventive, detective and corrective controls, check layering, and produce a prioritized plan. Python templates for the model and reports are in a bundled reference file.

How do I install it in Claude Code or Codex?

Use the install box above. The skills CLI command installs only this skill. The wshobson/agents README also documents gh skill install wshobson/agents threat-mitigation-mapping, which needs GitHub CLI 2.90 or later, and plugin installs for Claude Code and Codex.

Does it find threats for me?

No. It starts from threats you have already identified. Its description says to use it for prioritizing investments, remediation plans and validating control effectiveness.

Does it need an API key or scanner?

No key is named in SKILL.md or details.md. It bundles two files, SKILL.md and one reference file, and no scripts.

Is it safe to install?

It is two markdown files with no bundled scripts. The Python in details.md is template code for Claude to adapt, so read it before you run anything it generates.

Is this an official security standard?

No. It comes from the community wshobson/agents collection. Treat its control library and scores as starting templates, and check them against your own framework.

Information

updated Nov 2, 2026

Repository: wshobson/agents
Folder: plugins/security-scanning/skills/threat-mitigation-mapping

wshobson/agents skills.sh

Sources

Docs, issue trackers and discussions this page is built from.

Show all 3

threat-mitigation-mapping SKILL.md · github.com
threat-mitigation-mapping details.md · github.com
wshobson/agents README · github.com