What problem does it solve? Security code reviews find exploitable bugs in existing code, but they cannot answer design-level questions like what an attacker could do to your system architecture, which data flows cross trust boundaries, or which threats deserve mitigation first. This Skill produces a top-down STRIDE threat model that captures deployment topology, actors, and business data value that code alone cannot reveal. ## Core Features & Use Cases - Living threat model document: Builds and maintains docs/threat-model.md via a DFD element table, STRIDE-per-element analysis, a likelihood-by-impact risk grid, and a mitigation map where every threat is VERIFIED-in-code, filed as a [SECURITY] TODO, ACCEPTED, ELIMINATED, or TRANSFERRED. - Update mode: Re-verifies claimed mitigations against current code using ast-grep patterns tiered by risk rank, and re-STRIDEs only changed DFD elements instead of rebuilding from scratch. - Design-review mode: Runs the model against a planning document before code exists, surfacing attack-surface gaps, auth assumptions, and a top-3 mini threat model with a 100/75/50 confidence rubric. - Use Case: Before launching a new HTTP service that stores customer PII, run the skill to enumerate entry points, map trust boundaries, rank threats like spoofing and information disclosure, and file tagged TODOs for every unmitigated High-risk finding. ## Quick Start Ask the AI to threat model this system and build a STRIDE analysis of the current repository.
