threat-modeling

Facilitate STRIDE threat modeling with data flow diagrams and mitigation plans.

68|19|Updated Nov 21, 2025

Search Tags:#architecture #security #vulnerability #threat modeling #risk assessment #stride

Ready to run

npx skills add https://github.com/bobmatnyc/claude-mpm-skills --skill threat-modeling-bobmatnyc

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: threat-modeling
Source: https://github.com/bobmatnyc/claude-mpm-skills/tree/main/universal/security/threat-modeling
Command: npx skills add https://github.com/bobmatnyc/claude-mpm-skills --skill threat-modeling-bobmatnyc

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

This Skill streamlines the process of identifying and mitigating security vulnerabilities in software systems by providing a structured threat modeling workflow.

Core Features & Use Cases

STRIDE Analysis: Systematically identifies threats across Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, and Elevation of Privilege.
Data Flow Diagrams: Guides the creation of visual representations of data flow and trust boundaries.
Mitigation Planning: Translates identified threats into actionable backlog items, tests, and PR checks.
Use Case: When designing a new authentication service, use this Skill to proactively identify potential attack vectors like credential stuffing or session hijacking and define concrete mitigations before development begins.

Quick Start

Run a lightweight threat modeling workshop using the STRIDE methodology for the new user profile service.

Frequently Asked Questions about threat-modeling

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I perform a STRIDE analysis for software architecture security?▼

STRIDE analysis systematically identifies security threats across Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, and Elevation of Privilege. It evaluates your software architecture to pinpoint vulnerabilities and produce actionable mitigation plans.

What's the best way to identify security vulnerabilities before development begins?▼

Threat modeling proactively identifies attack vectors by mapping data flow diagrams and trust boundaries. Conducting risk assessment early translates identified security vulnerabilities into concrete backlog tickets and automated tests before development begins.

How does threat modeling integrate security considerations into the development lifecycle?▼

Threat modeling integrates security by translating risk assessment findings directly into development workflows. It generates actionable backlog tickets, automated tests, and PR checks based on the STRIDE analysis of your data flow diagrams.

Can I use this threat modeling process for designing a new authentication service?▼

Yes, threat modeling is used when designing new authentication services to proactively identify attack vectors like credential stuffing or session hijacking. It defines concrete mitigations through structured STRIDE analysis before development begins.

How do I create data flow diagrams for risk assessment?▼

Data flow diagrams for risk assessment are created by visually representing data movement and trust boundaries within your software system. This threat modeling workflow guides the creation of these diagrams to establish scope before conducting STRIDE analysis.