skills.rest
josemlopez
josemlopezCOMMUNITY
Explore all skills by this author →
GitHub

tm-threats

Analyze threats against assets using STRIDE or PASTA to generate a threat catalog, attack trees, abuse cases, and a risk register.

8|1|Updated Jan 20, 2026
Search Tags:#STRIDE#threat-modeling#threat-analysis#risk-register#attack-trees#abuse-cases
One-click install
npx skills add https://github.com/josemlopez/threat-modeling-toolkit --skill tm-threats
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: tm-threats
Source: https://github.com/josemlopez/threat-modeling-toolkit/tree/main/skills/tm-threats
Command: npx skills add https://github.com/josemlopez/threat-modeling-toolkit --skill tm-threats

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This skill helps security teams and developers systematically identify, categorize, and prioritize threats against system assets by applying STRIDE or PASTA. It creates a threat catalog, attack trees, abuse cases, and a risk register to inform design decisions and mitigations.

Core Features & Use Cases

  • Threat modeling: Apply STRIDE or PASTA to assets, data flows, and trust boundaries to surface potential threats.
  • Threat catalog & attack trees: Generate a structured catalog of threats and visualize attack paths.
  • Abuse cases & risk register: Identify abuse cases from legitimate workflows and generate prioritized risk entries for remediation.
  • Use Case: Analyze a software architecture to proactively identify and mitigate security risks before deployment.

Quick Start

Use the tm-threats command to analyze threats for your loaded threat model after initializing with /tm-init.

Frequently Asked Questions about tm-threats

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I perform threat modeling using STRIDE for my software architecture?▼

Threat modeling with STRIDE analyzes threats against your system's assets, data flows, and trust boundaries to generate a threat catalog, attack trees, abuse cases, and a risk register for informed security decisions.

What is the difference between STRIDE and PASTA when generating a risk register?▼

STRIDE categorizes threats by type across assets and trust boundaries, while PASTA applies a risk-centric workflow. Both generate a prioritized risk register and abuse cases, but STRIDE focuses on identifying vulnerabilities and PASTA emphasizes attacker perspectives.

Do I need a threat model initialized before generating attack trees and abuse cases?▼

Yes, an initialized threat model in the .threatmodel directory is required. This setup allows the analysis to accurately map discovered assets and data flows to generate attack trees, abuse cases, and a risk register.

Can I generate abuse cases from legitimate workflows in my system architecture?▼

Yes, abuse cases are generated by analyzing legitimate workflows within your software architecture. The threat modeling process identifies how standard operations can be manipulated to surface potential threats and inform risk prioritization.

How do I prioritize threats in a risk register after identifying them?▼

Threats are prioritized in the risk register by applying STRIDE or PASTA workflows to your discovered assets and attack trees. This systematic categorization surfaces threats across trust boundaries to inform design decisions and remediation efforts.

Related Skills

Explore More Data & Analytics Skills→
josemlopezjosemlopez
8

tm-drift

Compare current threat models against a baseline and generate drift-report.md.

Community
Intermediate
brucesongsbrucesongs
60

insecure-design

Identify insecure design risks in software architectures using STRIDE threat modeling.

Community
Advanced
josemlopezjosemlopez
8

tm-init

Analyze architecture documentation to generate asset inventories, data flows, trust boundaries, and attack surface mappings.

Community
Intermediate
johngutierrez31johngutierrez31

threat-modeling-expert

Apply STRIDE threat analysis to system architecture diagrams.

Community
Advanced