skills.rest
davidrrowley
davidrrowleyCOMMUNITY
Explore all skills by this author →
Website𝕏@davidrrowleyGitHub

threat-modelling

Produce structured STRIDE threat models with DFD diagrams and DREAD scoring.

Updated Apr 12, 2026
Search Tags:#risk-assessment#stride#dread#mitigation#security-architecture#dfd#threat-modelling
One-click install
npx skills add https://github.com/davidrrowley/CortexYouV3 --skill threat-modelling
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: threat-modelling
Source: https://github.com/davidrrowley/CortexYouV3/tree/main/.agents/skills/threat-modelling
Command: npx skills add https://github.com/davidrrowley/CortexYouV3 --skill threat-modelling

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Threat modelling formalizes the identification, classification, and prioritization of security threats against an architecture so teams can design mitigations before systems are built or deployed. It reduces missed trust boundaries, uncovers high-risk data flows, and produces actionable mitigations and residual risk decisions for architecture and security reviews.

Core Features & Use Cases

  • Structured STRIDE Analysis: Systematic threat enumeration across Spoofing, Tampering, Repudiation, Information disclosure, Denial, and Elevation of privilege for processes, data flows, and stores.
  • DFD Guidance & Templates: Level 0/1 DFD guidance and a Mermaid template to visualize trust boundaries and attack surfaces.
  • Prioritization & Mitigations: DREAD scoring for prioritization, mitigation record templates with implementation and verification fields, and residual risk disposition (accept/transfer/avoid/mitigate).
  • Integration: Outputs suitable for architecture review artifacts and ADRs, and guidance for embedding mitigations into design constraints.

Quick Start

Create a threat model for the Payments API including a Level 1 DFD, STRIDE threats for each trust boundary, DREAD scores, and recommended mitigations with residual risk notes.

Frequently Asked Questions about threat-modelling

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I create a STRIDE threat model for an API architecture?▼

A STRIDE threat model systematically enumerates threats across Spoofing, Tampering, Repudiation, Information disclosure, Denial, and Elevation of privilege for system processes, data flows, and stores. It reduces missed trust boundaries and uncovers high-risk data flows during architecture reviews.

How does DREAD scoring work for prioritizing security threats?▼

DREAD scoring prioritizes security threats by evaluating Damage, Reproducibility, Exploitability, Affected users, and Discoverability. It is applied to STRIDE threat entries to rank mitigation urgency and guide residual risk disposition decisions.

Can I generate a data flow diagram with trust boundaries for threat modelling?▼

Yes, you can generate a data flow diagram with trust boundaries using Level 0 and Level 1 DFD guidance and a Mermaid template. Visualizing trust boundaries and attack surfaces is a core feature of structured threat modelling.

What is the best way to document mitigations and residual risk for a threat register?▼

The best way to document mitigations and residual risk is using mitigation record templates with implementation and verification fields, alongside a residual risk disposition of accept, transfer, avoid, or mitigate. This output is suitable for architecture review artifacts and ADRs.

When do I need to perform threat modelling on existing systems?▼

You need to perform threat modelling on existing systems when evaluating attack surfaces, analyzing trust boundaries, or making security design decisions. It formalizes threat identification to uncover high-risk data flows and produce actionable mitigations.

Related Skills

Explore More Software Engineering Skills→
haabehaabe

threat-model

Conduct STRIDE threat modeling on system designs with data flows and trust boundaries.

Community
Advanced
v1bh0rv1bh0r

nw-security-by-design

Apply STRIDE threat modeling and OWASP mitigations to architecture design reviews.

Community
Advanced
TrecekTrecek
1

arch-lens-security

Generate Mermaid-compatible security architecture diagrams with trust boundaries and validation layers.

Community
Advanced
oalansilvaoalansilva

threat-modeling

Enumerate threats and map mitigations for software system risk assessment.

Community
Intermediate