agentic-security:threat-model-first

Document STRIDE security risks before editing code across trust boundaries.

73|15|Updated May 6, 2026

Search Tags:#risk-assessment #threat-modeling #stride #security-design #code-security

Ready to run

npx skills add https://github.com/Clear-Capabilities/agentic-security --skill agentic-security-threat-model-first

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: agentic-security:threat-model-first
Source: https://github.com/Clear-Capabilities/agentic-security/tree/main/skills/threat-model-first
Command: npx skills add https://github.com/Clear-Capabilities/agentic-security --skill agentic-security-threat-model-first

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Activates before you add or edit code that crosses a security trust boundary. The cheapest place to fix a security bug is the moment before you write it. This skill front-loads the threat modeling so the implementation that follows is informed.

Core Features & Use Cases

Pause before the Edit. Don't write the code yet. Tell the user you're going to threat-model first.
Generate a session id if one doesn't exist for this conversation.
Walk STRIDE per touch-point. For the specific construct the user is about to introduce, work through: S (Spoofing), T (Tampering), R (Repudiation), I (Information disclosure), D (Denial of service), E (Elevation of privilege) etc., and document one sentence per category.
Write the result to the scratchpad via MCP and store the threat model artifact.
Propose defensive measures and annotate code comments to show mapping to STRIDE rows.
Commit-as-you-go: reference each defense in code comments as you implement it.

Quick Start

Before you write code that touches a security trust boundary, run threat-modeling to generate a TM.md that captures STRIDE questions and mitigations.

Frequently Asked Questions about agentic-security:threat-model-first

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I perform threat modeling before writing code that crosses trust boundaries?▼

Threat modeling before writing code involves identifying security risks at trust boundaries using the STRIDE framework. You pause implementation to document spoofing, tampering, and elevation of privilege risks upfront, generating a TM.md artifact to guide secure development.

What is STRIDE coverage and when do I need it for security design?▼

STRIDE coverage is a structured threat modeling process evaluating Spoofing, Tampering, Repudiation, Information disclosure, Denial of service, and Elevation of privilege. You need it before editing code that handles authentication, authorization, secrets, or external API calls to prevent design flaws.

How do I document security risks for authentication and external API calls?▼

You document security risks by creating a session, walking through STRIDE categories for each touch-point, and writing the results to a TM.md file. This artifact captures the identified threats and proposes defensive measures with code comment annotations.

Can I map STRIDE threat modeling results directly into code comments?▼

Yes, you can map STRIDE threat modeling results directly into code comments. As you implement defensive measures against identified threats, you reference each defense in the code comments to show the mapping to specific STRIDE rows.

What's the best way to front-load security design when adding new features?▼

The best way to front-load security design is to pause before editing code, generate a threat model session, and perform a STRIDE walkthrough for the specific construct. This pre-write risk assessment ensures the implementation is informed by documented mitigations.

Do I need a dedicated environment to run STRIDE threat modeling for software engineering?▼

No dedicated environment is needed beyond your standard development setup and MCP scratchpad access. The threat modeling process runs within your conversation, generating a session ID and storing the TM.md documentation artifact directly through the MCP integration.