threat-modeling

Model security threats with PASTA and Shostack methods, producing Mermaid diagrams and risk registers.

99|10|Updated Mar 1, 2026

Search Tags:#threat modeling #security analysis #STRIDE #risk assessment #attack surface #PASTA framework

Ready to run

npx skills add https://github.com/0x0pointer/agent-smith --skill threat-modeling-0x0pointer

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: threat-modeling
Source: https://github.com/0x0pointer/agent-smith/tree/main/skills/threat-modeling
Command: npx skills add https://github.com/0x0pointer/agent-smith --skill threat-modeling-0x0pointer

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This Skill provides a structured approach to identifying and mitigating security risks in applications and systems before they can be exploited.

Core Features & Use Cases

Comprehensive Threat Analysis: Utilizes the PASTA framework and Adam Shostack's 4-question method to systematically uncover vulnerabilities.
Visual Modeling: Generates diagrams (Component Maps, Data Flow Diagrams, Attack Trees) using Mermaid syntax for clear communication.
Actionable Mitigation: Produces prioritized risk registers and concrete mitigation plans.
Use Case: Before launching a new e-commerce feature, use this Skill to model potential threats like payment fraud, data breaches, and denial-of-service attacks, and define how to prevent them.

Quick Start

Use the threat-modeling skill to analyze the security risks of the new user authentication service.

Frequently Asked Questions about threat-modeling

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I perform threat modeling for a new application feature?▼

Threat modeling for new features involves mapping the attack surface, identifying vulnerabilities using the PASTA framework and Adam Shostack's 4-question method, and generating prioritized risk registers with concrete mitigation plans.

What is the best way to map an attack surface and identify security risks?▼

Mapping an attack surface and identifying security risks is best achieved by analyzing component mapping and data flows, then producing visual models like Mermaid diagrams and STRIDE threat tables for clear communication.

How does the PASTA framework work for risk assessment?▼

The PASTA framework works for risk assessment by providing a structured approach to systematically uncover vulnerabilities, assess critical components, identify logic flaws, and build actionable defenses before exploitation occurs.

Can I use STRIDE threat tables and Mermaid diagrams for security analysis?▼

Yes, you can use STRIDE threat tables and Mermaid diagrams for security analysis to visually model component maps, data flows, and attack trees, ensuring clear communication of identified threats and defenses.

When do I need structured threat modeling for my system?▼

You need structured threat modeling for your system before launching new features or applications to proactively identify potential threats like payment fraud, data breaches, and denial-of-service attacks, and to define prevention methods.

Does this security analysis approach generate actionable mitigation plans?▼

Yes, this security analysis approach generates actionable mitigation plans by producing prioritized risk registers that translate identified threats and logic flaws into concrete defensive actions for your application.