skills.rest
gleeb
gleebCOMMUNITY
Explore all skills by this author →
GitHub

planning-security

Generate STRIDE-based threat models and security controls for SDLC user stories.

Updated Aug 27, 2026
Search Tags:#threat modeling#STRIDE#data protection#risk assessment#security planning#authn authz#compliance controls
One-click install
npx skills add https://github.com/gleeb/ai-registry --skill planning-security
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: planning-security
Source: https://github.com/gleeb/ai-registry/tree/main/systems/sdlc/skills/planning-security
Command: npx skills add https://github.com/gleeb/ai-registry --skill planning-security

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

planning-security helps you design security upfront by turning story and system inputs into clear threat analysis, auth/authz requirements, and data protection controls.

Core Features & Use Cases

  • Dual mode security planning: produces either story-scoped security controls (Phase 3) or a cross-cutting security overview (Phase 4).
  • Threat modeling with STRIDE: applies STRIDE to identify threats, document risk ratings, and map mitigations.
  • Contract-aligned security requirements: defines clear REQUIRE/DENY/ALLOW gates for authentication, authorization, validation, rate limiting, and compliance needs.

Quick Start

Use the planning hub to dispatch Security work for sdlc-planner-security so it generates plan/user-stories/US-NNN-name/security.md in Phase 3 or plan/cross-cutting/security-overview.md in Phase 4.

Frequently Asked Questions about planning-security

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I create a threat model using STRIDE for my user stories?▼

Threat modeling with STRIDE identifies threats across spoofing, tampering, repudiation, information disclosure, denial of service, and elevation of privilege. This Skill maps each threat to specific mitigations, documents risk ratings, and outputs structured security controls per user story.

What is the best way to plan authentication and authorization controls before implementation?▼

Planning authentication and authorization controls upfront involves defining explicit REQUIRE, DENY, and ALLOW gates. This Skill analyzes your auth-model contracts to generate precise authn and authz requirements, ensuring validation and rate limiting are documented before development begins.

How do I generate a cross-cutting security overview across multiple user stories?▼

A cross-cutting security overview aggregates individual story-level threat analyses into a unified security posture. This Skill rolls up STRIDE threat scenarios, data protection controls, and compliance requirements from multiple stories into a comprehensive security overview document.

When do I need security planning in the software development lifecycle?▼

Security planning is needed during the early planning phases before implementation begins. This Skill operates during Planning Hub phases 3 and 4, taking story definitions, system architecture, auth-model contracts, and PRD security non-functional requirements as inputs to produce actionable security controls.

Can I use inputs from my PRD security NFRs to define compliance controls for data protection?▼

Yes, PRD security non-functional requirements serve as direct inputs. This Skill ingests NFRs alongside system architecture and story definitions to produce data protection controls, compliance gates, and STRIDE-based threat scenarios with documented risk ratings.

Does threat modeling work for both per-story security controls and broader system-wide security analysis?▼

Threat modeling applies in dual modes: per-story security control generation and cross-cutting security overview rollup. This Skill produces either scoped security.md files for individual user stories or a consolidated security-overview.md covering all stories.

Related Skills

Explore More Legal & Compliance Skills→
yknothingyknothing
1

security-design

Codify security boundaries, threat models, and controls per architectural layer.

Community
Advanced
Kushal9889Kushal9889

api-security-best-practices

Implements secure API authentication, authorization, input validation, rate limiting, and vulnerability protection.

Community
Advanced
BellaBeBellaBe
37

dialectical

Synthesize opposing positions into a structured thesis-antithesis-synthesis artifact.

Community
Advanced
EngineerWithAIEngineerWithAI
4

stride-analysis-patterns

Apply STRIDE methodology to identify and categorize security threats in software systems.

Official
Advanced