threat-model

Generate STRIDE-based threat models for software features and modules.

71|7|Updated Apr 4, 2026

Search Tags:#risk-assessment #threat-modeling #stride #software-design #attack-surface #security-analysis

Ready to run

npx skills add https://github.com/mbwsims/claude-universe --skill threat-model-mbwsims

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: threat-model
Source: https://github.com/mbwsims/claude-universe/tree/main/skills/threat-model
Command: npx skills add https://github.com/mbwsims/claude-universe --skill threat-model-mbwsims

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

This skill helps security-conscious teams generate structured threat models for a feature or module using the STRIDE methodology, enabling early identification of assets, threats, and mitigations to reduce risk.

Core Features & Use Cases

Identify the target feature or module and gather context (data handled, actors, trust boundaries).
Map the attack surface by enumerating entry points, data flows, and external interactions, leveraging shieldkit-mcp when available.
Apply STRIDE categories to assess threats, analyze risk with likelihood and impact, and document mitigations and residual risk for actionable guidance.

Quick Start

Provide the target feature or module and I will generate a STRIDE-based threat model for it.

Frequently Asked Questions about threat-model

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I generate a threat model for a web app feature?▼

Generate a threat model for a web app feature by mapping data flows, trust boundaries, and entry points, then applying the STRIDE methodology to document threats, mitigations, and residual risk. The skill structures this assessment for actionable security guidance.

What is STRIDE threat modeling and when should I use it?▼

STRIDE threat modeling is a structured methodology categorizing security risks into Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, and Elevation of Privilege. Use it during software design or pre-release phases to identify assets and mitigate threats early.

How do I identify the attack surface for an API or service?▼

Identify the attack surface for an API or service by enumerating external interactions, entry points, and data flows across trust boundaries. The skill maps these elements to apply STRIDE categories and assess likelihood and impact for each threat.

Can I use this for pre-release security analysis of software designs?▼

Yes, you can use this for pre-release security analysis of software designs. The skill assesses features or modules during the design phase, documenting assets, attack surfaces, and enumerated threats with likelihood, impact, and mitigations to reduce risk before release.

What is the best way to prioritize security risks across services?▼

The best way to prioritize security risks across services is applying STRIDE categories to enumerated threats and analyzing them by likelihood and impact. This skill documents mitigations and residual risk, enabling structured risk prioritization for web apps and APIs.

How do I document trust boundaries and assets for a module?▼

Document trust boundaries and assets for a module by identifying the target context, data handled, and actors. The skill structures this documentation alongside attack surfaces and STRIDE threat enumerations to produce a concise security assessment summary.