aio-threat-modelslisted

# Threat Modeling Framework Advisor > "Threat modeling is analyzing representations of a system to highlight concerns about security and privacy characteristics." > — Threat Modeling Manifesto (2020) ## Workflow: How to Use This Skill When this skill is triggered, follow these five steps. Do NOT just dump framework descriptions — actively guide the user through their specific threat modeling task. ### Step 1: ASK — Understand the System Before selecting frameworks, gather essential context (if not already clear): - What system is being threat modeled? (new design, existing system, specific feature) - Is it primarily a **security**, **privacy**, or **both** concern? - What domain? (web app, mobile, cloud-native, microservices, AI/ML, IoT, cyber-physical) - Who processes the output? (developers, SOC, compliance, regulators, executives) - What lifecycle phase? (requirements, design, implementation, operations, incident review) - Regulatory context? (GDPR, HIPAA, PCI DSS, EU AI Act, SOC 2, etc.) - Team expertise level? (beginners, security-experienced, dedicated security team) If the user's message already contains enough context, proceed directly to Step 2. ### Step 2: SEARCH — Find Relevant Frameworks **First, run semantic search** with the user's problem as the query to find the most relevant frameworks. Then cross-reference with the routing table below. ```bash TM="${CLAUDE_PLUGIN_ROOT}/skills/aio-threat-models/scripts" npx tsx "$TM/search-models.ts" "<user's threat