skills.rest
UnitOneAI
UnitOneAIOFFICIAL
Explore all skills by this author →
WebsiteGitHub

threat-modeling

Run structured STRIDE threat modeling and produce a prioritized threat register.

44|128|Updated Mar 6, 2026
Search Tags:#threat modeling#stride#api security#risk register#mitre att&ck#trust boundaries#architecture security
One-click install
npx skills add https://github.com/UnitOneAI/SecuritySkills --skill threat-modeling-unitoneai
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: threat-modeling
Source: https://github.com/UnitOneAI/SecuritySkills/tree/main/skills/appsec/threat-modeling
Command: npx skills add https://github.com/UnitOneAI/SecuritySkills --skill threat-modeling-unitoneai

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

It turns vague “what could go wrong?” architecture discussions into a structured, auditable threat model mapped to STRIDE categories and ATT&CK techniques, so security findings are consistent across runs.

Core Features & Use Cases

  • Structured STRIDE threat modeling: Produces assets/entry points, threat actor profiles, a component-threat matrix, and a prioritized threat register.
  • Trust boundary and data-flow clarification: Guides the agent to document data flows, authentication mechanisms, data classification, encryption, and failure modes across boundaries.
  • Framework-grounded mitigation mapping: Derives mitigations prioritized by risk and links findings to MITRE ATT&CK techniques for standardized tracking.

Quick Start

Provide the target system design or repository path and ask the agent to run a STRIDE threat model with prioritized mitigations mapped to MITRE ATT&CK.

Frequently Asked Questions about threat-modeling

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I run a STRIDE threat model on my system architecture?▼

To run a STRIDE threat model, provide your target system design or codebase to the agent, which will inventory inputs, map data flows and trust boundaries, analyze each element for STRIDE threats, and output a prioritized threat register with MITRE ATT&CK mappings.

What is STRIDE threat modeling and when should I use it?▼

STRIDE threat modeling is a structured method to analyze system designs for Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, and Elevation of Privilege risks. Use it for architecture reviews, pre-launch security checks, incident post-mortems, or new API endpoint definition.

Can I map API security threats to MITRE ATT&CK techniques?▼

Yes, you can map API security threats to MITRE ATT&CK techniques. The threat modeling process analyzes API specifications to identify risks across trust boundaries and links the discovered threats to standardized MITRE ATT&CK techniques for consistent tracking.

How do I document trust boundaries and data flows for a security review?▼

Document trust boundaries and data flows by guiding the analysis to clarify authentication mechanisms, data classification, encryption states, and failure modes across system boundaries, ensuring all component interactions are mapped before STRIDE analysis.

Does threat modeling work for existing codebases or only new service designs?▼

Threat modeling works for both existing codebases and new service designs. The process accepts repository paths or system design documents as input to produce a component-threat matrix and a risk-prioritized mitigation register for either scenario.

What is the best way to prioritize security mitigations from a threat register?▼

The best way to prioritize security mitigations is through a risk-based approach that evaluates threats identified during STRIDE analysis and maps them to MITRE ATT&CK techniques, producing a prioritized threat register for auditable tracking.

Related Skills

Explore More Software Engineering Skills→
balic-AI-ML-R-D-Resourcesbalic-AI-ML-R-D-Resources

security-audit-context-building

Map architecture, trust boundaries, and data flows for security audit scoping.

Official
Advanced
coreymaypraycoreymaypray
1

threat-intel-analyst

Profile threat actors and produce intelligence with MITRE ATT&CK mappings.

Community
Advanced
48Nauts-Operator48Nauts-Operator
3

threat-mitigation-mapping

Map identified threats to security controls and mitigation coverage gaps.

Community
Advanced
devkenidevkeni
1

threat-modeling

Identify and analyze security threats in software architectures using STRIDE, PASTA, and Attack Trees.

Community
Advanced