skills.rest
thejordanleopold
thejordanleopoldCOMMUNITY
Explore all skills by this author →
Website𝕏@jordansleopoldGitHub

threat-modeling

Map attack surfaces, trust boundaries, and STRIDE vectors to identify system threats.

4|Updated Apr 9, 2026
Search Tags:#STRIDE#risk-assessment#threat-modeling#dread#trust-boundaries#security-design#data-classification
One-click install
npx skills add https://github.com/thejordanleopold/claude-code-skills-distilled --skill threat-modeling-thejordanleopold
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: threat-modeling
Source: https://github.com/thejordanleopold/claude-code-skills-distilled/tree/main/threat-modeling
Command: npx skills add https://github.com/thejordanleopold/claude-code-skills-distilled --skill threat-modeling-thejordanleopold

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Threat modeling provides a proactive framework to identify and mitigate design-level risks before code is written, enabling you to map entry points, trust boundaries, data flows, and potential attack surfaces.

Core Features & Use Cases

  • Phase 1: System Decomposition to map entry points, trust boundaries, and data classification.
  • Phase 2: STRIDE analysis to evaluate spoofing, tampering, repudiation, information disclosure, denial of service, and elevation of privilege.
  • Phase 3: DREAD scoring to prioritize threats and drive mitigation backlogs.
  • Phase 3b: Purple Team detection validation loop to verify defensive coverage and monitoring.
  • Phase 3c: PTES threat-chain exploration across the attack lifecycle.
  • Phase 4: Agentic AI security considerations when reviewing AI-enabled systems.
  • Threat model document generation to capture scope, architecture, risks, and controls.

Quick Start

Run the threat-modeling workflow on your system to produce a comprehensive threat model document.

Frequently Asked Questions about threat-modeling

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I perform threat modeling using STRIDE for a new software feature?▼

Threat modeling with STRIDE involves decomposing your system to map entry points and trust boundaries, then evaluating spoofing, tampering, repudiation, information disclosure, denial of service, and elevation of privilege vectors to identify design-level risks before coding begins.

What is the DREAD scoring model and when do I need it for risk assessment?▼

The DREAD scoring model is a risk assessment framework used during threat modeling to prioritize identified threats. You need it after mapping attack surfaces and STRIDE vectors to quantify damage, reproducibility, exploitability, affected users, and discoverability for your mitigation backlog.

How do I map trust boundaries and data classification during security design?▼

Mapping trust boundaries and data classification during security design requires system decomposition to explicitly identify where data flows cross privilege levels. This process exposes your attack surface and highlights where defensive controls are needed for sensitive information.

Can I use threat modeling for onboarding to existing codebases or security reviews?▼

Yes, threat modeling applies to onboarding to codebases and security reviews. By decomposing the existing system architecture and evaluating STRIDE vectors, you can produce structured threat insights and identify potential design-level risks in established software.

How do I include agentic AI security considerations in a threat model?▼

Including agentic AI security considerations in a threat model involves evaluating AI-enabled system components during your STRIDE analysis. This phase identifies unique machine learning attack surfaces and designs defensive controls specific to artificial intelligence vulnerabilities.

Related Skills

Explore More Software Engineering Skills→
ncsound919ncsound919

security-threat-model

Identify and document repository-specific threat models for defensive security.

Community
Advanced
ArogyaReddyArogyaReddy

threat-mitigation-mapping

Map identified threats to corresponding security controls for prioritized risk mitigation.

Community
Advanced
protoLabsAIprotoLabsAI
2

Blue Team / Defensive Methodology Skill

Automate defensive security assessments, incident response workflows, and purple team coverage analysis.

Official
Advanced
dandudzidandudzi
2

stride-analysis-patterns

Enumerate STRIDE threats, construct DFDs, score risks with DREAD, and map mitigations.

Community
Advanced