skills.rest
bpcakes
bpcakesOFFICIAL
Explore all skills by this author →
WebsiteGitHub

threat-model-and-dataflow-builder

Builds audit-grade threat models and data-flow inventories using STRIDE and LINDDUN.

2|Updated May 6, 2026
Search Tags:#threat modeling#security review#stride#trust boundaries#data flow diagram#linddun#privacy audit
One-click install
npx skills add https://github.com/bpcakes/jig-skills --skill threat-model-and-dataflow-builder-bpcakes
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: threat-model-and-dataflow-builder
Source: https://github.com/bpcakes/jig-skills/tree/main/plugins/jig-privacy-audit/skills/threat-model-and-dataflow-builder
Command: npx skills add https://github.com/bpcakes/jig-skills --skill threat-model-and-dataflow-builder-bpcakes

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Security and privacy reviews often lack a structured system model, making it hard to identify threats, missing trust boundaries, and data-protection gaps consistently. This Skill turns code, configs, docs, and runtime artifacts into an audit-grade threat model and data-flow inventory. ## Core Features & Use Cases - System Modeling: Inventories actors, assets, components, data stores, entry points, trust boundaries, and data flows, with optional Mermaid diagrams. - Threat Enumeration: Applies STRIDE for security threats and LINDDUN for privacy threats, separating confirmed findings from hypotheses, assumptions, and gaps. - Structured Output: Produces a human-readable Markdown report or schema-validated JSON with stable IDs, severity, confidence, controls, and a retest plan. - Use Case: Before a privacy audit of an E2EE messaging app, feed architecture docs, API specs, and HAR traces into this Skill to map cross-boundary flows and enumerate LINDDUN threats against telemetry and metadata handling. ## Quick Start Build a threat model and data-flow inventory for this system using the architecture docs and configs in the current repository, reporting STRIDE and LINDDUN threats with evidence levels.

Frequently Asked Questions about threat-model-and-dataflow-builder

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I create a threat model from existing code and documentation?▼

Collect architecture docs, API specs, configs, and runtime artifacts like HAR files or logs, then inventory actors, assets, components, data stores, entry points, trust boundaries, and data flows. Apply STRIDE to each element and LINDDUN to personal-data hotspots to enumerate concrete threats.

What is the difference between STRIDE and LINDDUN threat modeling?▼

STRIDE covers security threats: spoofing, tampering, repudiation, information disclosure, denial of service, and elevation of privilege. LINDDUN covers privacy threats: linking, identifying, non-repudiation, detecting, data disclosure, unawareness, and non-compliance. This workflow applies both.

What inputs are needed to build a data-flow diagram for a privacy audit?▼

Useful inputs include architecture docs, sequence diagrams, API specs, infrastructure-as-code, deployment configs, and runtime artifacts like proxy traces, logs, and message payload samples. If inputs are missing, the workflow continues with a labeled assumption list and evidence gaps.

Can a threat model prove a system is zero-knowledge or compliant?▼

No. A threat model alone cannot establish that a system is compliant, zero knowledge, secure, or cryptographically sound. It identifies threats, control gaps, and evidence needs; claims require separate verification with supporting evidence.

What output formats does the threat model report support?▼

The workflow produces a human-readable Markdown report from a template, or structured JSON validated against a provided JSON Schema for downstream processing. Both include scope, threats, controls, findings, and a retest plan with stable IDs.

Related Skills

Explore More Software Engineering Skills→
L3DigitalNetL3DigitalNet
6

design-draft

Guides users through a structured process to create design documents.

Official
Intermediate
oalansilvaoalansilva

compliance-readiness

Identify policy gaps against required controls and generate a prioritized remediation plan.

Community
Intermediate
loveconnorloveconnor

security-privacy

Model security threats and privacy risks across the data lifecycle.

Community
Advanced
xijunwwxijunww
1

recon

Automate penetration testing reconnaissance to discover assets and attack surfaces.

Community
Advanced