skills.rest
woohyun212
woohyun212COMMUNITY
Explore all skills by this author →
WebsiteGitHub

threat-model

Generates STRIDE-classified threat catalog and prioritized mitigation roadmap from system architecture artifacts.

21|1|Updated Apr 12, 2026
Search Tags:#threat modeling#risk assessment#stride#dread#threat catalog#mitre attack#mitigation roadmap
One-click install
npx skills add https://github.com/woohyun212/security-skill --skill threat-model-woohyun212
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: threat-model
Source: https://github.com/woohyun212/security-skill/tree/main/threat-model
Command: npx skills add https://github.com/woohyun212/security-skill --skill threat-model-woohyun212

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Helps teams move from ad-hoc, inconsistent security assessments to a repeatable, auditable threat modeling process that identifies, scores, and prioritizes threats so remediation effort is focused on the highest-risk issues.

Core Features & Use Cases

  • Structured Decomposition: Guide system decomposition into assets, trust boundaries, and entry points to define scope and attack surface.
  • STRIDE Threat Identification: Systematically enumerate threats across processes, data flows, data stores, and external entities.
  • DREAD Prioritization & MITRE Mapping: Score each threat with DREAD, map techniques to MITRE ATT&CK, and produce a 5x5 risk matrix.
  • Actionable Mitigation Roadmap: Produce prioritized, time-bound remediation tasks with defense-in-depth recommendations.
  • Use Case Example: During an architecture review for a payment API, generate T-001..T-NNN entries, DREAD scores, and a sprint-ready mitigation plan for HIGH/CRITICAL items.

Quick Start

Run a structured threat modeling review for Payment API v3: decompose assets and data flows, apply STRIDE to each element, score findings with DREAD, and produce a prioritized mitigation roadmap.

Frequently Asked Questions about threat-model

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
What is structured threat modeling for a software system?▼

Structured threat modeling systematically decomposes a system into assets and trust boundaries to identify threats. It applies frameworks like STRIDE to enumerate vulnerabilities and DREAD to score risk, producing a prioritized mitigation roadmap.

How do I perform a STRIDE threat analysis on my web API?▼

To perform STRIDE threat analysis on a web API, decompose its architecture into data flows and external entities. Apply STRIDE categories to each element to identify threats, then score them with DREAD to generate a prioritized mitigation roadmap.

Can I map identified threats to the MITRE ATT&CK framework?▼

Yes, you can map identified threats to the MITRE ATT&CK framework. During threat modeling, each enumerated threat entry is correlated with MITRE ATT&CK techniques to provide standardized context and produce a comprehensive risk matrix.

What artifacts do I need to generate a threat catalog and risk matrix?▼

You need system architecture artifacts like data flow diagrams and asset inventories to generate a threat catalog. These inputs define the scope and attack surface, enabling the creation of DREAD-scored threat entries and a 5x5 risk matrix.

How do I prioritize security remediation tasks for my infrastructure?▼

Prioritize security remediation tasks by scoring identified threats using the DREAD methodology. This generates a risk matrix that highlights HIGH and CRITICAL items, allowing you to produce a time-bound, sprint-ready mitigation roadmap.

Does this threat modeling approach work for both APIs and infrastructure components?▼

Yes, this threat modeling approach works for APIs and infrastructure components. It analyzes processes, data flows, and trust boundaries across web applications, APIs, and infrastructure to identify threats and produce actionable mitigation plans.

Related Skills

Explore More Software Engineering Skills→
josemlopezjosemlopez
8

tm-init

Analyze architecture documentation to generate asset inventories, data flows, trust boundaries, and attack surface mappings.

Community
Intermediate
haxlyshaxlys

threat-mitigation-mapping

Map identified threats to security controls for prioritized mitigation planning.

Community
Advanced
hypnguyen1209hypnguyen1209
338

threat-hunting

Hunt threats across infrastructure and extract IOC data mapped to MITRE ATT&CK.

Community
Advanced
NickCrewNickCrew
29

threat-modeling-techniques

Identify and analyze security threats using STRIDE, attack trees, and risk assessment.

Community
Advanced