threat.model.generate

STRIDE threat modeling systematically identifies security threats by categorizing them into six categories: Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, and Elevation of Privilege. Provide your system architecture description, and the Skill generates a threat model in YAML format with identified threats, CVSS risk scores, and mitigation recommendations for design-time security planning.

A system description is mandatory; optional inputs include data flows, trust boundaries, assets, compliance frameworks, and risk tolerance levels. The Skill outputs a threat model file with threat counts, high-risk threat counts, and a coverage report showing which system components and data flows are analyzed.

Yes. STRIDE threat modeling with CVSS risk scoring supports both design-time threat identification and compliance reviews. You can specify frameworks beyond the default STRIDE approach, set risk tolerance thresholds, and generate mitigation recommendations aligned with your security and compliance requirements.

CVSS (Common Vulnerability Scoring System) risk scores quantify threat severity on a standardized scale, helping prioritize mitigation efforts. The Skill assigns scores to each identified threat, distinguishing high-risk threats from lower-priority ones so you can allocate resources to the most critical security gaps.

Defining trust boundaries and data flows in your system description allows the Skill to identify threats specific to inter-component communication and privilege transitions. This detailed input produces more precise threat coverage and targeted mitigations than architecture description alone.

The Skill generates a threat model in YAML format, which can be saved to a specified output path. The YAML file contains the full threat model structure, threat details with CVSS scores, mitigation suggestions, and a coverage report summarizing analyzed components and data flows.