Full

Skill josemlopez/claude-threatmodel/skills/full

Complete threat modeling workflow. Discovers assets, analyzes threats (STRIDE), verifies controls, maps compliance, generates reports.From its SKILL.md

Install

npx -y skills add josemlopez/claude-threatmodel --skill full

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

One thing to look at

1 stars1 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

SKILL.md

2.5 KB, as published. Nobody here has run it

Full Threat Model

Usage

/threatmodel:full [--docs <path>] [--compliance owasp,soc2,pci-dss]

What It Does

Runs complete threat modeling in 5 phases:

Initialize - Read docs, discover assets, map data flows, identify trust boundaries
Threats - Apply STRIDE to each component, build attack trees, calculate risk scores
Verify - Search code for security controls, collect evidence, document gaps
Compliance - Map to OWASP Top 10, SOC2, PCI-DSS frameworks
Report - Generate risk report, executive summary, create baseline

Output Structure

.threatmodel/
├── config.yaml
├── state/
│   ├── assets.json          # Discovered components
│   ├── dataflows.json       # Data movement
│   ├── threats.json         # STRIDE analysis
│   ├── controls.json        # Security controls found
│   ├── gaps.json            # Missing controls
│   └── compliance.json      # Framework mapping
├── diagrams/
│   └── architecture.mmd     # Mermaid diagram
├── reports/
│   ├── risk-report.md
│   └── executive-summary.md
└── baseline/
    └── snapshot-{date}.json

STRIDE Categories

Spoofing - Can attacker impersonate?
Tampering - Can data be modified?
Repudiation - Can actions be denied?
Information Disclosure - Can data leak?
Denial of Service - Can service be disrupted?
Elevation of Privilege - Can permissions be gained?

Risk Scoring

Risk = Likelihood (1-5) × Impact (1-5)

Score	Level
16-25	Critical
10-15	High
5-9	Medium
1-4	Low

Process

Scan documentation at --docs path for architecture info
Extract assets: services, data stores, clients, integrations
Map data flows: source → destination, protocols, encryption
Identify trust boundaries: network, privilege, environment
Apply STRIDE to each asset and trust boundary crossing
Search codebase for control implementations (auth, validation, encryption)
Document gaps where controls are missing
Map to compliance frameworks
Generate reports with prioritized findings
Create baseline snapshot for drift detection