skills.rest
kalilurrahman
kalilurrahmanCOMMUNITY
Explore all skills by this author →
Website𝕏@krahmanGitHub

threat-modeling

Design threat models using STRIDE, attack trees, and data flow diagrams with DREAD risk scoring.

1|Updated Mar 21, 2026
Search Tags:#security#threat modeling#risk assessment#stride#dread#data flow diagram#attack trees
One-click install
npx skills add https://github.com/kalilurrahman/kr-claudiator-skills-original-prompts --skill threat-modeling-kalilurrahman
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: threat-modeling
Source: https://github.com/kalilurrahman/kr-claudiator-skills-original-prompts/tree/main/05-security/threat-modeling
Command: npx skills add https://github.com/kalilurrahman/kr-claudiator-skills-original-prompts --skill threat-modeling-kalilurrahman

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Security reviews are often ad-hoc and miss systematic coverage of attack surfaces. This Skill structures threat analysis using STRIDE methodology, attack trees, and data flow diagrams so teams identify, rate, and mitigate threats before design is finalized. ## Core Features & Use Cases - STRIDE Analysis: Systematically evaluate Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, and Elevation of Privilege threats per component. - Attack Trees & DFDs: Map attack paths from threat actors to assets and visualize trust boundaries across system components. - DREAD Risk Scoring: Rate threats by Damage, Reproducibility, Exploitability, Affected users, and Discoverability to prioritize mitigations. - Use Case: Before launching a new user login API, generate a threat model identifying credential stuffing, session hijacking, and SQL injection risks, then produce a threat register with prioritized mitigations and owners. ## Quick Start Create a threat model for my web application with a Node.js API, PostgreSQL database, and JWT authentication using STRIDE analysis.

Frequently Asked Questions about threat-modeling

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I create a threat model using STRIDE?▼

Define scope and trust boundaries, build a data flow diagram of components and data flows, then apply each STRIDE category (Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, Elevation of Privilege) to every component. Rate findings with DREAD scoring and document mitigations in a threat register.

What is the difference between STRIDE and DREAD in threat modeling?▼

STRIDE is a threat categorization framework identifying six threat types per component. DREAD is a risk scoring model rating each threat on Damage, Reproducibility, Exploitability, Affected users, and Discoverability to prioritize which threats to mitigate first.

What tools can I use for threat modeling diagrams?▼

Microsoft Threat Modeling Tool provides visual DFD building with automated STRIDE analysis and report generation. OWASP Threat Dragon is an open-source web-based alternative with DFD diagrams, STRIDE analysis, and GitHub integration.

When should threat modeling be done in the SDLC?▼

Threat modeling should start in the design phase before architecture is finalized, when fixes are cheapest. Update the model during development, validate mitigations in testing, and review it quarterly or whenever architecture changes introduce new attack surface.

How do I prioritize which threats to fix first?▼

Use DREAD scoring to rate each threat from 1-10 across five dimensions and sum the totals. Threats scoring Critical or High, such as SQL injection or hardcoded secrets, should be mitigated first with preventive controls before lower-risk items.

Related Skills

Explore More Software Engineering Skills→
haabehaabe

threat-model

Conduct STRIDE threat modeling on system designs with data flows and trust boundaries.

Community
Advanced
firstsun-devfirstsun-dev
3

owasp-security

Implement OWASP Top 10 secure coding patterns for web applications.

Official
Intermediate
DxTaDxTa

Security Test Scanner

Scans applications for OWASP Top 10 and other security vulnerabilities via static and dynamic analysis, dependency scanning, and CI/CD integration.

Community
Intermediate
rfxlamiarfxlamia
100

red-teaming

Plan and execute red team operations against cybersecurity and AI/LLM systems.

Community
Advanced