threat-modeling-agent

Automated threat modeling is achieved by running the 'generate-threat-model' command with your repository name and assessment type. It applies STRIDE and DREAD methodologies to analyze code and generate threat models, significantly reducing manual security assessment effort.

Yes, threat modeling supports custom scopes including full repository, feature-specific, and component-level assessments. You can specify the desired scope when running 'generate-threat-model' to focus your security analysis on targeted areas of your codebase.

STRIDE methodology categorizes threats into Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, and Elevation of Privilege. This Skill applies STRIDE during code analysis to identify potential vulnerabilities, then uses DREAD to assess and prioritize their risk levels.

Yes, the threat modeling process integrates with SAST, 0-Day Scanner, Phoenix Database, and Knowledge Graph. These integration points combine extracted threats with CVE attack vectors to synthesize comprehensive attack scenarios for enhanced vulnerability analysis.

System architecture is extracted automatically from knowledge graph clusters, call chains, and public APIs. This architectural extraction feeds directly into the threat modeling process, providing the structural context needed to identify potential security vulnerabilities accurately.

No external dependencies are required to run the threat-modeling-agent. However, to maximize the depth of your vulnerability analysis, you can connect it to available security tools like SAST, 0-Day Scanner, and the Phoenix Database for comprehensive attack scenario synthesis.