skills.rest
qa-aman
qa-amanCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

threat-model

Identify and document security threats using STRIDE and DFD techniques.

19|3|Updated Feb 28, 2026
Search Tags:#risk-assessment#threat-modeling#stride#security-design#threat-analysis#adversarial-thinking#dfd
One-click install
npx skills add https://github.com/qa-aman/claude-skills --skill threat-model-qa-aman
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: threat-model
Source: https://github.com/qa-aman/claude-skills/tree/main/skills/by-role/security/threat-model
Command: npx skills add https://github.com/qa-aman/claude-skills --skill threat-model-qa-aman

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Threat modeling structures adversarial thinking early in the design process to identify and document potential threats before code ships. It helps teams reason about security risks and prioritize mitigations.

Core Features & Use Cases

  • Step 1: Define scope
  • Step 2: Draw the data flow diagram (DFD)
  • Step 3: Apply STRIDE per component
  • Step 4: Rate and prioritize threats
  • Step 5: Document mitigations and residual risk
  • Step 6: Out-of-scope and assumptions

Quick Start

Define the system scope and assets, then sketch a simple DFD and enumerate STRIDE threats for each component.

Frequently Asked Questions about threat-model

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
What is threat modeling and how does STRIDE help identify security risks?▼

Threat modeling structures adversarial thinking during software design to identify and document potential threats before code ships. STRIDE helps by systematically categorizing threats per component to prioritize security mitigations.

How do I conduct a threat modeling workshop for a new API?▼

To conduct threat modeling for an API, define the system scope and assets, sketch a Data Flow Diagram (DFD), enumerate STRIDE threats for each component, and document the prioritized mitigations and residual risks.

When should I start threat modeling during software design?▼

You should start threat modeling during the early design phases for software systems, APIs, and data flows. Applying threat analysis early helps teams reason about security risks and prioritize mitigations before code ships.

What steps are needed to document security threats using a DFD?▼

Documenting security threats using a DFD requires defining scope, drawing the data flow diagram, applying STRIDE per component, rating and prioritizing threats, and documenting mitigations alongside out-of-scope assumptions and residual risk.

Does threat modeling work for assessing risks in complex data flows?▼

Yes, threat modeling is applicable for assessing risks in complex data flows. By creating a DFD and applying STRIDE adversarial thinking per component, teams can systematically identify, rank, and document security threats.

What is the best way to rate and prioritize threats found during threat analysis?▼

The best way to rate threats during threat analysis is to apply STRIDE per DFD component, then systematically rank the identified security threats to guide and document the required mitigations and residual risk.

Related Skills

Explore More Software Engineering Skills→
jwm-axonijwm-axoni
3

threat-model

Define system scope, assets, entry points, and STRIDE threats for a threat model document.

Community
Advanced
patricio0312revpatricio0312rev
5

threat-model-generator

Generate STRIDE-based threat models with asset tagging and residual risk computation.

Community
Advanced
bacocobacoco
67

bmad-security-review

Identify security risks and produce threat models, gap assessments, and remediation backlogs.

Community
Advanced
KbWenKbWen
121

red-team-adversarial

Analyze code changes for exploitable weaknesses and generate attack surface assessments.

Community
Advanced