The problem: when an AI coding agent writes your client's app, who checks that the design itself is safe? Tests catch broken code, but a wrong trust boundary (e.g., an admin panel reachable with a customer token) passes every test. Doing threat modeling by hand takes hours a solo vibe coder doesn't have, and asking a plain agent "is this secure?" produces confident guesses, not evidence.
The solution in today's radar: jmanico/grim-prompter turns your existing coding agent into a structured security analyst. You point Claude Code, Codex, or any agent at a repo, and it walks a professional threat-modeling method (STRIDE, LINDDUN, PASTA and more), producing a threat model where every claim must cite a file and line in your code. It's prompts and a runbook — no new runtime, no new subscription beyond the agent you already pay for — and it was published yesterday by Jim Manico, a well-known application-security educator.
Format note: single-featured-factory layout (standing focus set Oct 25, 2026); the Ethiopia business-opportunity section remains removed. Prior reports were available through Oct 28 (most recently coleam00/ai-software-factory; earlier: obra/superpowers, SkillSpector, vercel-labs/skills, OMA, Strivy, agent-device, Trivy, OSV-Scanner, Playwright, OpenCode 2.0, promptfoo, Codex CLI, dzhng/skills, cve-lite-cli, QA Wolf CLI, paperclip, Astryx). Today's pick is not a repeat. Other projects verified active today but not full factories: herdr (Apache-2.0, Windows beta, commits Oct 29), stablyai/orca (MIT, updated today), microsoft/agent-framework (MIT, releases Oct 22–23, security-hardening commits today), seleniumbase/SeleniumBase (MIT, v4.56.5 released today), sadmann7/tablecn (MIT, data-grid undo/redo commits today) — all untested here.
/threat-model quick api) gives a fast model; deep mode runs a six-stage pipeline — scope → system modeling → threat analysis → challenge → treatment planning → reporting — where each stage reads the previous stage's file, so nothing advances without the prior artifact.git clone works, and the README's "use with any agent" route (an AGENTS.md/CLAUDE.md snippet pointing at your clone) is fully applicable. Copying skills/threat-model into your agent's skills folder instead of symlinking should work on Windows but is plausible–untested.All workflow names, artifacts and behaviors below are VERIFIED from the repo README and file listing today.
| Agency OS stage | Factory module | Artifact it produces | Which gate consumes it |
|---|---|---|---|
| LEAD / PROPOSAL / SPECIFICATION | — not covered | — | — |
| DISCOVERY | helpers/evidence-guide.md | SYSTEM_UNDER_REVIEW.md bundle (scope, evidence, assumptions, missing info) | Discovery-style rule: gathered from the repo without running analysis — findings verified before use |
| ARCHITECTURE | Architecture selector + 36 architecture prompts (web, API, mobile, desktop, CLI, microservices, serverless, multi-tenant SaaS, RAG, agentic AI…) | System model with trust boundaries | Feeds the SECURITY review; also a second-opinion check on your ARCHITECTURE decisions |
| DEVELOPMENT | — not covered (no code generation) | — | — |
| QA | — not covered | — | — |
| SECURITY | Quick/deep threat model; 29 methods (STRIDE, LINDDUN, PASTA, attack trees, MITRE ATT&CK/ATLAS enrichment, CVSS…); MCP tool→credential mapping, shared-token blast radius, tool-description poisoning analysis | report.md (findings, mitigations, verification plans) + JSON model and stage handoffs under threat-model/ | SECURITY gate input: evidence-traced findings, each with prerequisites, affected assets, existing controls |
| CEO_REVIEW | The README's own review rules (check scope, challenge each threat, prioritize, verify fixes) | Human-reviewed, prioritized mitigation list | Matches Agency OS human-approval rule: the agent must not invent ratings or approvals |
| RELEASE | — not covered | — | — |
| MAINTENANCE | /threat-model change main...feature change reviewer | Updated model vs saved JSON baseline | Escaped threats update the model like Agency OS incident lessons |
| REUSABLE_COMPONENT | Partial — saved JSON models become baselines reused across reviews | Reusable threat-model baselines | Not a component library |
.gitignore only covers its own checkout).git clone https://github.com/jmanico/grim-prompter.git (e.g., to C:\tools\grim-prompter). Then use the README's any-agent route: add its threat-modeling snippet to your project's AGENTS.md/CLAUDE.md with your clone path, telling the agent to read runbook.md, inspect read-only, and write only under threat-model/./threat-model quick web in Claude Code, or "threat model this project read-only" per the snippet).threat-model/ folder with SYSTEM_UNDER_REVIEW.md (scope, evidence, assumptions, missing info), report.md (threats with citations, mitigations, verification plans), and JSON artifacts — and zero changes to your source files.SYSTEM_UNDER_REVIEW.md, report.md, JSON baseline stored as gate evidence.