threat-model

Identify STRIDE threats in system designs and produce formal threat-model documents.

3|Updated May 28, 2026

Search Tags:#risk-assessment #threat-modeling #stride #security-design #threat-analysis #software-security #design-verification

Ready to run

npx skills add https://github.com/mahg-es/araya --skill threat-model-mahg-es

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: threat-model
Source: https://github.com/mahg-es/araya/tree/main/skills/threat-model
Command: npx skills add https://github.com/mahg-es/araya --skill threat-model-mahg-es

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Threat modeling identifies and mitigates design-time security risks using STRIDE to reduce vulnerabilities.

Core Features & Use Cases

Structured STRIDE-based threat analysis during system design
Risk assessment with mitigation recommendations and an actionable plan
Output-oriented threat-model documentation for security and engineering teams

Quick Start

Draft a STRIDE threat model for a new user management API and outline mitigations.

Frequently Asked Questions about threat-model

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I perform STRIDE threat modeling for a new software design?▼

STRIDE threat modeling identifies Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, and Elevation of Privilege risks in a system design to surface vulnerabilities before implementation begins.

When do I need to create a threat model document for an API?▼

You need a threat model document when designing APIs involving data flows, authentication, and external services to formally capture trust boundaries, threat IDs, risk ratings, and mitigation plans before coding.

What is the best way to assess security risks in data flows and external services?▼

The best way to assess security risks is applying structured threat analysis during the design phase to map trust boundaries across data flows and external services, yielding actionable mitigation recommendations.

How do I generate a formal threat model with risk ratings and mitigations?▼

You generate a formal threat model by analyzing the system architecture using STRIDE to evaluate threats, assign risk ratings, document mitigations, and produce an artifact with an audit-log requirement.

Does threat modeling work for design-phase verification of user management APIs?▼

Yes, threat modeling works for design-phase verification of user management APIs by analyzing authentication mechanisms and data flows to identify security threats and outline mitigations before implementation.