sdd-threat

What problem does it solve?

This Skill automates the process of identifying security risks in the design phase of a project, ensuring that potential threats are systematically addressed and mitigated before development begins.

Core Features & Use Cases

• STRIDE Threat Identification: Systematically identifies threats across all six STRIDE categories (Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, Elevation of Privilege).
• Risk Scoring & Prioritization: Assigns risk scores based on impact and likelihood, allowing teams to prioritize critical vulnerabilities.
• Security Requirements Derivation: Translates identified mitigation strategies into actionable security requirements (REQ-SEC-xxx) compliant with EARS.
• Use Case: A software architect can use this Skill to analyze the design of a new microservice, automatically generating a threat model that highlights potential vulnerabilities and proposes security requirements for the development team.

Quick Start

Run the sdd-threat skill with the spec-slug 'my-new-api' to generate a threat model for the project.