skills.rest
sjinks
sjinksCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

security-review-owasp-threat-modeling

Analyze threat models for missing trust boundaries and unmitigated STRIDE risks.

Updated Mar 26, 2026
Search Tags:#architecture#owasp#threat modeling#security review#stride#risk analysis#trust boundaries
One-click install
npx skills add https://github.com/sjinks/ai-owasp-skillset --skill security-review-owasp-threat-modeling
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: security-review-owasp-threat-modeling
Source: https://github.com/sjinks/ai-owasp-skillset/tree/main/.github/skills/security-review-owasp-threat-modeling
Command: npx skills add https://github.com/sjinks/ai-owasp-skillset --skill security-review-owasp-threat-modeling

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This Skill helps security reviewers spot incomplete threat models, missing trust boundaries, and vague mitigations before they create real architectural risk.

Core Features & Use Cases

  • System Model Validation: Checks whether data flows, trust boundaries, external entities, and critical components match the actual implementation.
  • Threat Coverage Review: Evaluates STRIDE coverage across major attack paths and flags omitted threats that could hide high-impact abuse.
  • Mitigation and Ownership Review: Verifies that threats have concrete, testable mitigations with clear ownership and reevaluation triggers.
  • Use Case: Use it when reviewing an architecture diagram, threat model document, or implementation change to confirm that the security model still reflects reality.

Quick Start

Ask the security-review-owasp-threat-modeling skill to review the relevant files or architecture for missing threats, trust-boundary gaps, and unowned mitigations.

Frequently Asked Questions about security-review-owasp-threat-modeling

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I find missing trust boundaries in a threat model?▼

STRIDE coverage review evaluates major attack paths to flag omitted threats that could hide high-impact abuse. It verifies that threats have concrete, testable mitigations with clear ownership and reevaluation triggers tied to architecture changes.

Can I use STRIDE analysis for infrastructure and configuration review?▼

Yes, STRIDE analysis applies to code, configuration, architecture, infrastructure, and operational review scenarios. It validates DFD elements and trust boundaries to confirm the security model reflects the actual implementation.

What is the best way to review threat mitigations for ownership and accountability?▼

The best way is conducting a mitigation and ownership review that verifies threats have concrete, testable mitigations with clear ownership and reevaluation triggers. This ensures accountability rather than leaving mitigations vaguely documented.

When do I need to update a threat model after architecture changes?▼

You need to update a threat model when architecture changes occur, ensuring the security model still reflects reality. Reviews should be scheduled whenever data flows, trust boundaries, or critical components no longer match the implementation.

Why does my threat model have unmitigated STRIDE risks?▼

Unmitigated STRIDE risks typically occur when threat coverage review fails to evaluate major attack paths or omits specific threats. The model likely has incomplete system validation where DFD elements and trust boundaries do not match the actual implementation.

Related Skills

Explore More Software Engineering Skills→
davidrrowleydavidrrowley

threat-modelling

Produce structured STRIDE threat models with DFD diagrams and DREAD scoring.

Community
Advanced
qa-amanqa-aman
19

threat-model

Identify and document security threats using STRIDE and DFD techniques.

Community
Advanced
M-Abdullah07M-Abdullah07
1

security-scanning-security-hardening

Coordinate specialized agents to scan and remediate application security vulnerabilities.

Community
Advanced
nist0nist0

threat-modeling

Automate STRIDE threat modeling to enumerate assets, map trust boundaries, and suggest mitigations.

Community
Advanced