threat-modelinglisted

Produces structured threat models for software systems using STRIDE on data flow diagrams. Generates DFDs with trust boundaries, identifies threats per element, scores risks, and defines concrete mitigations. Outputs a complete threat model Markdown document through phased, interactive delivery. Use when threat modeling a system, analyzing security threats, identifying attack surfaces, performing STRIDE analysis, assessing security risks in architecture, creating a threat model document, or when the user mentions threat model, attack surface, trust boundaries, STRIDE, or security risk analysis.
msewell/agent-stuff · ★ 0 · AI & Automation · score 70

Install: claude install-skill msewell/agent-stuff

# Threat Modeling Produce a threat model for a user-described system using STRIDE-per-element on a data flow diagram. ## Workflow Deliver in phases, presenting each for user review before proceeding. For "quick" or "draft" requests, produce the full document in one pass. ### Phase 1: Scope and system model 1. Gather from the user: system purpose, components, data flows, actors, deployment context. 2. Ask about: - Trust boundaries (where privilege, network, or ownership changes) - Data classifications (PII, secrets, financial, health, IP) - Threat actors (external attacker, insider, automated, nation-state) 3. Draw a **Level-1 DFD** in ASCII art showing processes (`⬭`), data stores (`▭▭`), external entities (`⬜`), data flows (`→`), and trust boundaries (`┄┄┄`). 4. List **assets** with Confidentiality / Integrity / Availability ratings. Present the DFD and asset list. Ask the user to confirm or correct before proceeding. Trust boundaries to check: - Internet ↔ DMZ / edge - App tier ↔ data tier - Authenticated ↔ admin scope - Your org ↔ vendor / 3rd-party API - Tenant A ↔ Tenant B (multi-tenant) - Host ↔ container / serverless - LLM system prompt ↔ untrusted user or tool input For DFD construction details, see [references/01-foundations-and-system-modeling.md](references/01-foundations-and-system-modeling.md). ### Phase 2: Identify threats Apply **STRIDE-per-element**, starting at trust boundary crossings. | STRIDE | Threat | Violates | Applies to | |---|---