threat-model

Analyze system designs with STRIDE and generate DFD-based threat models.

Updated Aug 23, 2026

Search Tags:#threat modeling #risk-assessment #stride #diagrams #data-flow #security-design #attack-trees

Ready to run

npx skills add https://github.com/curphey/bosun --skill threat-model-curphey

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: threat-model
Source: https://github.com/curphey/bosun/tree/main/skills/threat-model
Command: npx skills add https://github.com/curphey/bosun --skill threat-model-curphey

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

Threat modeling provides a structured approach to identify, evaluate, and mitigate security risks during design, reducing the likelihood of design-level vulnerabilities.

Core Features & Use Cases

STRIDE-per-element threat analysis for data flows and components
Data Flow Diagram (DFD) creation and trust boundary mapping
Threat trees/attack trees with risk scoring (DREAD and CVSS)
Actionable mitigations and remediation tracking across architectures
Security design reviews, risk assessments, and compliance mapping

Quick Start

Define the system boundary, map data flows with a simple DFD, and apply STRIDE across components.

Frequently Asked Questions about threat-model

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

What is threat modeling and when should I apply it during software design?▼

Threat modeling is a structured approach to identify, evaluate, and mitigate security risks early in design. Apply it during feature design, architecture reviews, and security risk assessments across data flows, authentication, and third-party integrations to reduce design-level vulnerabilities.

How do I perform STRIDE per-component analysis on a data flow diagram?▼

To perform STRIDE analysis, first define the system boundary and map data flows using a Data Flow Diagram. Then apply STRIDE across each component to identify threats, document mitigations, and ensure traceable remediation for the identified security issues.

Can I use DREAD and CVSS scoring for threat trees and risk assessments?▼

Yes, threat modeling supports building threat trees and attack trees with risk scoring using both DREAD and CVSS methodologies. This allows you to evaluate and prioritize identified security risks systematically across your architecture components and data flows.

How do I map trust boundaries when creating a data flow diagram for security design?▼

Map trust boundaries by defining the system boundary and mapping data flows with a Data Flow Diagram. This identifies where data crosses between trusted and untrusted zones, allowing targeted STRIDE analysis and documented mitigations for authentication and integration risks.

Does threat modeling support compliance mapping and remediation tracking for architecture reviews?▼

Yes, threat modeling supports security design reviews, risk assessments, and compliance mapping. It provides actionable mitigations and traceable remediation tracking across architectures to systematically manage and document security design compliance.