skills.rest
rocklambros
rocklambrosCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

threat-modeling-llm-app

Analyze LLM applications against a threat catalog to produce STRIDE-classified threat models.

2|Updated May 23, 2026
Search Tags:#threat modeling#stride#prompt injection#llm security#rag security#owasp llm
One-click install
npx skills add https://github.com/rocklambros/rcs --skill threat-modeling-llm-app
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: threat-modeling-llm-app
Source: https://github.com/rocklambros/rcs/tree/main/skills/security/threat-modeling-llm-app
Command: npx skills add https://github.com/rocklambros/rcs --skill threat-modeling-llm-app

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This Skill helps you analyze an LLM-powered application before deployment so you can identify threats, trust boundaries, and residual risks instead of discovering them after launch.

Core Features & Use Cases

  • Catalog-driven analysis: Works against a user-supplied threat catalog such as OWASP LLM Top 10, MITRE ATLAS, or a custom internal register.
  • Boundary and component inventory: Maps prompts, retrievers, tools, and output sinks into a clear trust-boundary diagram.
  • Structured threat register: Produces STRIDE-classified findings with likelihood, impact, mitigations, owners, and coverage gaps for review or audit.
  • Use cases: Reviewing a chatbot, RAG system, completion API, summarization pipeline, or any other LLM-backed product before release.

Quick Start

Analyze my LLM application with the catalog I provide and produce a threat register with trust boundaries, STRIDE classifications, mitigations, and top residual risks.

Frequently Asked Questions about threat-modeling-llm-app

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I build a threat model for an LLM application before deployment?▼

Threat modeling an LLM application involves mapping prompts, retrievers, tools, and output sinks into trust boundaries, then classifying threats via STRIDE to produce an auditable register with mitigations and owners.

What is STRIDE classification for LLM security risks?▼

STRIDE classification for LLM security categorizes threats into Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, and Elevation of Privilege to structure risk analysis and required mitigations.

Can I use a custom threat catalog for RAG security analysis?▼

Yes, you can perform RAG security analysis using a user-supplied custom threat catalog, or frameworks like OWASP LLM Top 10 and MITRE ATLAS, to generate structured findings with likelihood and impact ratings.

Does threat modeling cover prompt injection and RAG system vulnerabilities?▼

Threat modeling covers prompt injection and RAG vulnerabilities by mapping user inputs, retrievers, and output sinks across trust boundaries to identify coverage gaps and assign required mitigations.

How do I map trust boundaries for a chatbot or completion API?▼

Mapping trust boundaries for a chatbot or completion API requires inventorying prompts, retrievers, tools, and output sinks, then diagramming these components to visualize where data crosses privilege levels.

Related Skills

Explore More Software Engineering Skills→
smarmen86smarmen86

cso

Automate infrastructure security audits and threat modeling for software projects.

Community
Advanced
riparinoriparino
1

defensive-secure-dev-course

Embed secure coding guidance into development workflows from design to deployment.

Community
Advanced
uphiagouphiago
1.1k

hunt-llm-ai

Identify exploitable LLM/AI vulnerabilities crossing trust boundaries with validation gates.

Community
Advanced
patricio0312revpatricio0312rev
5

threat-model-generator

Generate STRIDE-based threat models with asset tagging and residual risk computation.

Community
Advanced