security-prompts-threat-modeling

STRIDE threat modeling systematically identifies six categories of security threats—spoofing, tampering, repudiation, information disclosure, denial of service, and elevation of privilege—across your system architecture. This Skill generates structured prompts that walk through each threat category for your specific application context, producing a comprehensive threat model document that prioritizes risks and mitigation strategies.

Threat modeling applies throughout the development lifecycle: during architecture design to identify foundational security gaps, when developing new features like payment processing to catch feature-specific vulnerabilities, and in code reviews to spot implementation flaws. Running threat models early and often prevents costly security rework and ensures compliance requirements are met proactively.

Yes. This Skill generates threat-model prompts designed to map against OWASP frameworks and compliance requirements, identifying vulnerabilities and gaps systematically. The structured output satisfies functional requirements for compliance documentation and automated security test prompts, making it suitable for both architecture-impact analyses and compliance assessments.

Threat modeling generates structured artifacts including a comprehensive threat model document (typically docs/security/THREAT_MODEL.md), feature-specific threat templates for new capabilities, architecture-impact analyses showing security implications, and automated security test prompts. These outputs provide actionable guidance for developers and stakeholders.

Threat modeling with this Skill is designed to be systematic and templated, reducing the barrier for teams without dedicated security staff. The generated prompts guide you through each threat category with structured reasoning, though understanding your application architecture and typical attack vectors accelerates the process.