skills.rest
oalansilva
oalansilvaCOMMUNITY
Explore all skills by this author →
GitHub

threat-modeling

Enumerate threats and map mitigations for software system risk assessment.

Updated Dec 28, 2025
Search Tags:#architecture#security#compliance#risk-assessment#threat-modeling#mitigations
One-click install
npx skills add https://github.com/oalansilva/crypto --skill threat-modeling-oalansilva
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: threat-modeling
Source: https://github.com/oalansilva/crypto/tree/main/.codex/skills/security/threat-modeling
Command: npx skills add https://github.com/oalansilva/crypto --skill threat-modeling-oalansilva

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Threat modeling helps teams identify security risks early by systematically analyzing assets, trust boundaries, and attack surfaces.

Core Features & Use Cases

  • Define assets, boundaries, and attack surfaces to build a comprehensive risk profile.
  • Enumerate threats with a structured method, mapping risks to mitigations.
  • Produce a threat model summary that documents residual risks and recommended controls.

Quick Start

Create a threat model for a web application with user authentication and external API access.

Frequently Asked Questions about threat-modeling

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I perform a security risk assessment for a web application architecture?▼

Security risk assessment for a web application architecture requires discovering assets, defining trust boundaries, and enumerating attack surfaces to map threats to mitigations and document residual risks.

What is threat modeling in software engineering?▼

Threat modeling in software engineering is a structured method to identify security risks early by systematically analyzing assets, trust boundaries, and attack surfaces across design, development, and deployment phases.

How do I map mitigations to enumerated threats during system design?▼

Mapping mitigations to enumerated threats involves using a structured method to identify risks across your attack surface and documenting recommended controls alongside residual risks in a threat model summary.

Can I use structured threat modeling for systems with external API access?▼

Yes, structured threat modeling applies to systems with external API access by evaluating the expanded attack surface, defining trust boundaries around the authentication layer, and documenting the associated security risks.

When do I need to document residual risks and recommended controls for compliance?▼

You need to document residual risks and recommended controls for compliance after mapping enumerated threats to mitigations, producing a threat model summary that tracks remaining security vulnerabilities across the architecture.

What is the best way to define trust boundaries and attack surfaces for a new software system?▼

The best way to define trust boundaries and attack surfaces is through structured threat modeling, which builds a comprehensive risk profile by discovering assets and analyzing security vulnerabilities across deployment phases.

Related Skills

Explore More Software Engineering Skills→
balic-AI-ML-R-D-Resourcesbalic-AI-ML-R-D-Resources

security-audit-context-building

Map architecture, trust boundaries, and data flows for security audit scoping.

Official
Advanced
josemlopezjosemlopez
8

tm-tests

Generate security test cases from threat models in Markdown, Jest, Pytest, or Playwright formats.

Community
Intermediate
mbwsimsmbwsims
71

threat-model

Generate STRIDE-based threat models for software features and modules.

Community
Advanced
Ed1s0nZEd1s0nZ
5.6k

network-penetration-testing

Execute network penetration testing phases with Nmap, Nessus, and Metasploit.

Community
Advanced