skills.rest
ToanPV90
ToanPV90COMMUNITY
Explore all skills by this author →
GitHub

threat-modeling

Conduct STRIDE threat analysis and produce structured risk-scored worksheets.

Updated Apr 15, 2026
Search Tags:#threat modeling#security audit#risk assessment#stride#security controls#data flow diagram#threat library
One-click install
npx skills add https://github.com/ToanPV90/dotfiles --skill threat-modeling-toanpv90
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: threat-modeling
Source: https://github.com/ToanPV90/dotfiles/tree/main/agents/.agents/skills/threat-modeling
Command: npx skills add https://github.com/ToanPV90/dotfiles --skill threat-modeling-toanpv90

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

This Skill helps you systematically uncover security threats in a system design, quantify risk using STRIDE, and translate findings into actionable security controls before implementation.

Core Features & Use Cases

  • STRIDE threat identification: Organizes threats into Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, and Elevation of Privilege, mapped to violated security properties and mitigations.
  • Risk scoring and prioritization: Uses a likelihood/impact matrix to compute risk levels and supports treatment decisions (e.g., immediate remediation for critical items).
  • Reusable artifacts: Provides a STRIDE worksheet template, a reusable threat library, and example DFD/Threat Dragon model structures to speed consistent documentation.
  • Use Case: Model the threat landscape for a new API gateway and trust boundaries, then produce a review-ready threat record with owners, gaps, and recommended mitigations.

Quick Start

Use the threat-modeling skill to produce a STRIDE worksheet for your API gateway, including threats, risk scores, existing controls, gaps, and recommended mitigations.

Frequently Asked Questions about threat-modeling

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I conduct a STRIDE threat analysis for an API gateway?▼

STRIDE threat analysis identifies spoofing, tampering, repudiation, information disclosure, denial of service, and elevation of privilege threats. It maps threats to violated security properties and produces a structured worksheet with risk scoring and recommended mitigations.

What is the best way to document security controls and open risks across components?▼

Documenting security controls requires a structured STRIDE worksheet output that includes likelihood and impact risk scoring, treatment decisions, ownership, and identified gaps across system components.

How does risk scoring work when preparing for a security audit?▼

Risk scoring for security audits uses a likelihood and impact matrix to compute risk levels for identified threats. This supports treatment decisions, prioritizing immediate remediation for critical security items.

Can I use a data flow diagram to model trust boundaries for threat modeling?▼

Data flow diagrams model trust boundaries by mapping how information moves between system components. This visual model accelerates threat modeling by clarifying where security controls and trust boundaries apply.

When do I need to use a reusable threat library for risk assessment?▼

A reusable threat library is needed during risk assessment to speed up consistent documentation of known threats. It organizes threats into categories and maps them directly to mitigating security controls.

Related Skills

Explore More Legal & Compliance Skills→
johngutierrez31johngutierrez31

threat-modeling-expert

Apply STRIDE threat analysis to system architecture diagrams.

Community
Advanced
Axel-DaMageAxel-DaMage
2

security-reviewer

Identify security vulnerabilities in code and infrastructure and generate audit reports.

Community
Advanced
me2reshme2resh
489

dfd

Generate Data Flow Diagrams with trust boundaries and data classifications from codebases.

Community
Advanced
jmaglyjmagly
175

security-assessment

Perform security assessments with STRIDE threat modeling and CVSS scoring.

Community
Advanced