security-review

Perform STRIDE-based threat modeling on codebases and output prioritized security findings.

1.0k|92|Updated May 22, 2026
One-click install
npx skills add https://github.com/open-gsd/gsd-pi --skill security-review-open-gsd
Or copy as Structured Prompt for Agent
Please help me install this Agent Skill.
Skill: security-review
Source: https://github.com/open-gsd/gsd-pi/tree/main/src/resources/skills/security-review
Command: npx skills add https://github.com/open-gsd/gsd-pi --skill security-review-open-gsd

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Threat-model-driven security reviews help teams identify and document security flaws by performing a STRIDE-based threat model on the actual codebase, producing a prioritized set of actionable findings with precise context and remediation guidance.

Core Features & Use Cases

  • STRIDE-based threat modeling tailored to the actual code paths and data flows.
  • Actionable findings that include where the issue lives, threat category, concrete exploit scenarios, severity, and remediation steps.
  • Read-only analysis that does not modify code, suitable for pre-release audits and security reviews.

Quick Start

Run a targeted threat-model review on the requested change to generate an actionable, prioritized finding list.

Frequently Asked Questions about security-review

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I perform a STRIDE-based threat model on my codebase?

Perform a STRIDE-based threat model by analyzing code paths and data flows in authentication, input handling, and external surfaces to generate a prioritized security finding report.

What is threat-model-driven security review for code?

Threat-model-driven security review identifies and documents security flaws by applying the STRIDE methodology to actual code paths, producing actionable findings with exploit scenarios and remediation guidance.

Can I run a security audit on code changes without modifying the repository?

You can run a read-only security audit that analyzes code changes touching authentication and data access without modifying the target repository, outputting prioritized findings with severity and location.

How does a STRIDE threat model identify vulnerabilities in code?

A STRIDE threat model identifies vulnerabilities by systematically evaluating code paths against threat categories, documenting concrete exploit scenarios, severity, and specific remediation steps for each finding.

When do I need a threat-model-driven security review for my codebase?

You need a threat-model-driven security review for pre-release audits and security assessments of changes touching authentication, input handling, data access, and external surfaces.

What is included in a STRIDE-based security audit report?

A STRIDE-based security audit report includes the issue location, threat category, concrete exploit scenario, severity rating, and remediation steps for each identified security flaw.