How to use the Threat Mitigation Mapping agent skill

What is an agent skill and what does this one do?

An agent skill is a folder containing a SKILL.md file of instructions that an AI agent loads when a request matches the skill's description. This skill, from the wshobson/agents collection under plugins/security-scanning/skills/threat-mitigation-mapping, is licensed under MIT.

Once installed, the agent organises security work around threats. It helps pair each identified threat with suitable controls such as firewalls, input validation, encryption, monitoring or incident response. It also frames advice around defense in depth, so no single control is relied on.

• Groups controls by type: preventive (stop attacks before they occur), detective (identify attacks in progress) and corrective (respond and recover).
• Groups controls by layer: network, application, data, endpoint and process.
• Points to a reference file with templates for executive summaries, gap reports, roadmaps and control results.

How do you install the skill?

Download the ZIP of the skill from this page and unzip it. You can install it for yourself or for a single project.

For a personal install, unzip the folder into ~/.claude/skills/. For a project install, unzip it into the project's .claude/skills/ folder. Alternatively, upload the ZIP in the Claude apps under Settings → Capabilities → Skills.

• Personal: ~/.claude/skills/
• Project: .claude/skills/ inside your project
• Claude apps: Settings → Capabilities → Skills, then upload the ZIP

How do you trigger the skill with a natural request?

You do not need a special command. The skill's description tells the agent when to use it: prioritizing security investments, creating remediation plans, or validating control effectiveness. Describe your situation in plain language and mention the threats you have identified.

Good requests name the threats and your goal, for example asking the agent to map a list of threats to controls and show gaps, or to draft a remediation roadmap from those mappings.

• Map these identified threats to preventive, detective and corrective controls, and flag any threat with no control.
• Help me prioritise our security budget across these risks.
• Create a remediation roadmap from this list of threats and current controls.
• Check whether our controls cover every threat in this register.

What output should you expect?

The skill guides the agent to structure its answer around threats, controls, control types and layers, and defense in depth. For detailed formats, the agent can read references/details.md, which contains templates for a mitigation model, defense in depth scoring, an executive summary, critical gaps reporting, recommendations, an implementation roadmap and results by control.

The templates are scaffolding. You still need to supply your own threat list, your own control inventory and your own judgement about effectiveness and cost.

What do you need before you start?

The skill lists no requirements. It does not run scripts and does not use the network, so it works only on the text you provide and the instructions it contains. You do need your own threat list and details of the controls you have or are considering.

• Requires: nothing listed
• Runs scripts: no
• Uses network: no

What are the safety limits and tips?

This skill organises and plans. It does not scan systems or perform hands-on testing, and it is not a replacement for a qualified risk assessment or compliance audit. The guidance is generic and has not been checked against your environment, so validate recommendations before acting on them.

The skill's own best practices are to map every threat, layer controls, mix control types, track effectiveness, review regularly, avoid single controls, consider cost, test controls and address people and process.

• Give the agent a complete threat list so it can confirm nothing is unmapped.
• Treat the output as a draft to check against your real systems and risk owners.
• Re-run the mapping when controls change, since the skill itself says controls degrade over time.
• Remember that the skill cannot verify whether a control actually works in your environment.