skills.rest
Omar-Obando
Omar-ObandoCOMMUNITY
Explore all skills by this author →
GitHub

threat-modeling

Generate STRIDE and DREAD threat models with attack trees and mitigations.

44|9|Updated May 7, 2026
Search Tags:#owasp#threat modeling#stride#dread#security requirements#attack trees
One-click install
npx skills add https://github.com/Omar-Obando/qwen-orchestrator --skill threat-modeling-omar-obando
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: threat-modeling
Source: https://github.com/Omar-Obando/qwen-orchestrator/tree/main/skills/threat-modeling
Command: npx skills add https://github.com/Omar-Obando/qwen-orchestrator --skill threat-modeling-omar-obando

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

Threat modeling helps identify security threats early so teams can design mitigations proactively instead of discovering vulnerabilities after deployment.

Core Features & Use Cases

  • Framework-driven threat identification (STRIDE): Categorizes threats as Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, and Elevation of Privilege.
  • Risk prioritization (DREAD): Scores threats using Damage, Reproducibility, Exploitability, Affected Users, and Discoverability to focus remediation effort.
  • Practical threat artifacts: Produces attack trees, data-flow-oriented threat views, and a mitigation plan aligned to OWASP threat modeling guidance.
  • Use case examples: Create a threat model for an API that handles authentication, or model a microservice’s attack paths and insider/supply-chain risks.

Quick Start

Ask the AI to generate a STRIDE + DREAD threat model for your system and output recommended mitigations for each prioritized threat.

Frequently Asked Questions about threat-modeling

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I perform threat modeling for an API that handles authentication?▼

Threat modeling for an API identifies security threats and required mitigations by producing structured artifacts like attack trees and data-flow views. It applies STRIDE to categorize threats and DREAD to prioritize risk, generating actionable security control recommendations for your system.

What is the best way to prioritize security risks using DREAD?▼

DREAD prioritizes security risks by scoring threats based on Damage, Reproducibility, Exploitability, Affected Users, and Discoverability. This framework focuses your remediation effort on the most critical attack vectors identified during the threat modeling process.

How does STRIDE analysis categorize threats during a security review?▼

STRIDE analysis categorizes security threats into Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, and Elevation of Privilege. It identifies attack vectors and required mitigations for defined systems during software design and security reviews.

Can I use threat modeling for microservice attack paths and insider risks?▼

Threat modeling applies to microservice attack paths and insider risks by mapping data flows and generating structured threat artifacts. It covers software, cloud, mobile, IoT, web, database, and supply-chain scenarios to produce actionable mitigation plans.

When do I need to generate attack trees for my system's security requirements?▼

You need to generate attack trees during the design phase to proactively identify security threats and required mitigations. This structured threat artifact maps attack vectors and data flows, helping teams discover vulnerabilities before deployment.

Does threat modeling work for cloud and IoT security scenarios?▼

Threat modeling works for cloud and IoT security scenarios by identifying attack vectors and producing structured threat artifacts. It applies STRIDE and DREAD frameworks to analyze risks across software, cloud, mobile, IoT, web, database, and supply-chain contexts.

Related Skills

Explore More Software Engineering Skills→
johngutierrez31johngutierrez31

threat-modeling-expert

Apply STRIDE threat analysis to system architecture diagrams.

Community
Advanced
hardw00thardw00t
90

threat-modeling

Identify threats using STRIDE, PASTA, Attack Trees, and DREAD.

Community
Basic
josemlopezjosemlopez
8

tm-drift

Compare current threat models against a baseline and generate drift-report.md.

Community
Intermediate
brenordvbrenordv

security

Audit software systems for security vulnerabilities and regulatory compliance.

Community
Advanced