mcpField
T
threat-modeling-expert

threat-modeling-expert

github.com/sickn33Security48.7k386 installsUpdated today
Repository

About threat-modeling-expert

A threat-modeling skill for teams designing systems or reviewing security architecture. It applies methods such as STRIDE and attack trees to identify, prioritize, and mitigate risks.

Key features

  1. 01STRIDE threat analysis
  2. 02Attack tree construction
  3. 03Data flow review
  4. 04Security requirement extraction
  5. 05Risk scoring and prioritization
  6. 06Mitigation planning

Use cases

  1. 01Reviewing a system design for threats
  2. 02Preparing security architecture documentation
  3. 03Prioritizing risks and mitigations

Install

Copy the command and run it in a terminal.

$npx skills add https://github.com/sickn33/agentic-awesome-skills --skill threat-modeling-expert

After installing, type/threat-modeling-expertin Claude Code to confirm it loaded.

Details

From the project README

Threat Modeling Expert

Expert in threat modeling methodologies, security architecture review, and risk assessment. Masters STRIDE, PASTA, attack trees, and security requirement extraction. Use PROACTIVELY for security architecture reviews, threat identification, or building secure-by-design systems.

Capabilities

  • STRIDE threat analysis
  • Attack tree construction
  • Data flow diagram analysis
  • Security requirement extraction
  • Risk prioritization and scoring
  • Mitigation strategy design
  • Security control mapping

Use this skill when

  • Designing new systems or features
  • Reviewing architecture for security gaps
  • Preparing for security audits
  • Identifying attack vectors
  • Prioritizing security investments
  • Creating security documentation
  • Training teams on security thinking

Do not use this skill when

  • You lack scope or authorization for security review
  • You need legal or compliance certification
  • You only need automated scanning without human review

Instructions

  1. Define system scope and trust boundaries
  2. Create data flow diagrams
  3. Identify assets and entry points
  4. Apply STRIDE to each component
  5. Build attack trees for critical paths
  6. Score and prioritize threats
  7. Design mitigations
  8. Document residual risks

Safety

  • Avoid storing sensitive details in threat models without access controls.
  • Keep threat models updated after architecture changes.

Best Practices

  • Involve developers in threat modeling sessions
  • Focus on data flows, not just components
  • Consider insider threats
  • Update threat models with architecture changes
  • Link threats to security requirements
  • Track mitigations to implementation
  • Review regularly, not just at design time

Example

User request:

Design new systems or features.

Limitations

  • Use this skill only when the task clearly matches the scope described above.
  • Do not treat the output as a substitute for environment-specific validation, testing, or expert review.
  • Stop and ask for clarification if required inputs, permissions, safety boundaries, or success criteria are missing.

Comments

Markdown supported