skills.rest
xalgord
xalgordCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

performing-threat-modeling-with-owasp-threat-dragon

Create data flow diagrams and identify STRIDE and LINDDUN threats with OWASP Threat Dragon.

954|172|Updated Mar 13, 2026
Search Tags:#devsecops#Threat Modeling#secure design#data flow diagram#LINDDUN#Stride#owasp threat dragon
One-click install
npx skills add https://github.com/xalgord/xalgorix --skill performing-threat-modeling-with-owasp-threat-dragon
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: performing-threat-modeling-with-owasp-threat-dragon
Source: https://github.com/xalgord/xalgorix/tree/main/internal/tools/skills/data/devsecops/performing-threat-modeling-with-owasp-threat-dragon
Command: npx skills add https://github.com/xalgord/xalgorix --skill performing-threat-modeling-with-owasp-threat-dragon

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Security teams often skip or poorly execute threat modeling during design reviews, leaving trust boundaries unmapped and threats undiscovered until production. This Skill guides the creation of structured threat models with OWASP Threat Dragon so design-phase risks are identified, classified, and mitigated systematically.

Core Features & Use Cases

  • DFD-Based Threat Modeling: Build data flow diagrams with processes, data stores, external entities, data flows, and trust boundaries using Threat Dragon's drag-and-drop editor.
  • STRIDE and LINDDUN Classification: Apply STRIDE per element type for security threats and LINDDUN for privacy threats affecting GDPR or HIPAA regulated data.
  • Report Generation and SDLC Integration: Produce PDF threat model reports, store JSON models in version control, and track mitigations with owners and priorities.
  • Use Case: A team designing a new checkout flow creates a DFD in Threat Dragon, lets the rule engine suggest threats per element, triages each as Mitigated, Not Applicable, or Open, and exports a PDF report for the security design review.

Quick Start

Use OWASP Threat Dragon to build a data flow diagram of my application architecture and generate a STRIDE-based threat model report.

Frequently Asked Questions about performing-threat-modeling-with-owasp-threat-dragon

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I create a threat model with OWASP Threat Dragon?▼

Install the Threat Dragon desktop app or run the Docker web version, define scope and assets, then build a data flow diagram with processes, data stores, external entities, and trust boundaries. The rule engine suggests threats per element, which you triage as Mitigated, Not Applicable, or Open before generating a PDF report.

What is the difference between STRIDE and LINDDUN threat modeling?▼

STRIDE classifies security threats into Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, and Elevation of Privilege. LINDDUN targets privacy threats like Linkability, Identifiability, and Non-compliance, making it suited for systems handling personal data under GDPR or HIPAA.

Which STRIDE categories apply to each DFD element type?▼

External entities get Spoofing and Repudiation. Processes get all six STRIDE categories. Data stores get Tampering, Information Disclosure, and Denial of Service. Data flows get Tampering, Information Disclosure, and Denial of Service.

Can OWASP Threat Dragon run as a web application with Docker?▼

Yes, Threat Dragon runs as a web app via the owasp/threat-dragon Docker image on port 3000. You must set JWT signing keys and encryption keys as environment variables, with NODE_ENV set to production.

Why does my threat model show no threats for some elements?▼

Missing threats usually mean trust boundaries were not drawn, since the rule engine only fires where data crosses trust levels, or the element was added after threat generation ran. Verify every internet-to-app and app-to-database transition has a boundary and regenerate threats.

What file format does Threat Dragon use for threat models?▼

Threat Dragon stores threat models as JSON files containing summary metadata, contributors, and diagram definitions with cells. This format supports version control alongside code and participates in the CycloneDX TMBOM effort for cross-tool portability.

Related Skills

Explore More Software Engineering Skills→
josemlopezjosemlopez
8

tm-init

Analyze architecture documentation to generate asset inventories, data flows, trust boundaries, and attack surface mappings.

Community
Intermediate
bacocobacoco
67

bmad-security-review

Identify security risks and produce threat models, gap assessments, and remediation backlogs.

Community
Advanced
borgheiborghei
467

senior-security

Identify and mitigate security risks in software systems using expert security engineering practices.

Community
Advanced
jassicsjassics
6

pasta

Execute the seven-stage PASTA threat modeling process aligned to business risk.

Community
Advanced