skills.rest
pvillega
pvillegaCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

threat-modeling

Apply STRIDE threat modeling with data flow diagrams and DREAD risk scores.

23|7|Updated Sep 8, 2025
Search Tags:#security#risk-assessment#threat-modeling#stride#dread#security-audit#dfd
One-click install
npx skills add https://github.com/pvillega/claude-templates --skill threat-modeling-pvillega
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: threat-modeling
Source: https://github.com/pvillega/claude-templates/tree/main/plugins/ct/skills/threat-modeling
Command: npx skills add https://github.com/pvillega/claude-templates --skill threat-modeling-pvillega

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This Skill formalizes threat modeling so teams can systematically discover, prioritize, and remediate security risks introduced by features, integrations, and trust-boundary crossings before release.

Core Features & Use Cases

  • Structured Threat Enumeration: Applies STRIDE across each trust boundary identified in a Data Flow Diagram (DFD) to surface spoofing, tampering, repudiation, information disclosure, denial of service, and elevation of privilege threats.
  • Risk Prioritization & Mitigation: Uses DREAD scoring to rank threats, recommends framework-aware mitigations, and identifies automatable fixes (rate limiting, input validation, headers, webhook verification).
  • Deliverables & Gates: Produces a DFD, per-boundary threat lists, DREAD scores, a SECURITY-ACTIONS.md with manual items, and verification checkpoints to block release on critical findings.

Quick Start

Use the threat-modeling skill to produce a DFD, enumerate STRIDE threats across trust boundaries, score them with DREAD, and generate a SECURITY-ACTIONS.md for the feature.

Frequently Asked Questions about threat-modeling

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I perform STRIDE threat modeling for a new software feature?▼

STRIDE threat modeling is performed by generating a Data Flow Diagram, analyzing trust boundaries, and enumerating spoofing, tampering, repudiation, information disclosure, denial of service, and elevation of privilege threats. This Skill automates that process and outputs prioritized risks with concrete mitigations.

What is the best way to identify and prioritize security threats in a multi-tenant system?▼

Identifying security threats in a multi-tenant system is best done by applying STRIDE across trust boundaries and scoring risks with DREAD. This approach surfaces specific vulnerabilities and ranks them by severity to guide remediation efforts.

How does DREAD scoring work for prioritizing security risks?▼

DREAD scoring works by evaluating threats based on Damage, Reproducibility, Exploitability, Affected users, and Discoverability. The Skill calculates these scores to systematically rank identified threats and recommend framework-aware mitigations.

Can I automate security fixes for OAuth and webhook integrations during threat modeling?▼

Yes, you can automate security fixes for OAuth and webhooks during threat modeling. The process identifies automatable mitigations like rate limiting, input validation, and webhook verification, alongside generating a SECURITY-ACTIONS.md file for manual steps.

Does this threat modeling process support CI/CD pipelines and public APIs?▼

Yes, this threat modeling process fully supports CI/CD pipelines and public APIs. It applies structured threat enumeration and trust boundary analysis specifically tailored for these scenarios, blocking release on critical findings via verification checkpoints.

What deliverables do I get from a systematic security audit of file uploads and payments?▼

A systematic security audit of file uploads and payments yields a Data Flow Diagram, per-boundary STRIDE enumerations, DREAD risk scores, and a SECURITY-ACTIONS.md file. These deliverables provide concrete mitigations and verification checkpoints to ensure release readiness.

Related Skills

Explore More Software Engineering Skills→
castrojocastrojo

architecture-diagram-specification

Generate JSON specifications for component, data flow, and deployment diagrams.

Community
Advanced
ShankulkarniShankulkarni
1

audit-node-api-auth

Audit Node.js API routes for missing authentication and broken JWT verification.

Community
Advanced
not-subhunot-subhu

security-scan

Orchestrate dependency audits, static application security testing, and privacy dataflow analysis.

Community
Advanced
MonumentalSystemsMonumentalSystems
17

threat-modeling

Structure threat discovery and risk prioritization using STRIDE, PASTA, and LINDDUN frameworks.

Official
Intermediate