Threat model

Skill minagayid/Agents/skills/library/threat-model

Produce a threat model for a system or feature using STRIDE and data-flow analysis. Use when the user asks to threat-model, assess attack surface, or plan security for a design.From its SKILL.md

Install

npx -y skills add minagayid/Agents --skill threat-model

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

One thing to look at

1 stars1 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

SKILL.md

1.5 KB, as published. Nobody here has run it

Threat Model

Systematically enumerate how a system could be attacked and what to do about it.

Steps

Scope & assets. What are we protecting (data, funds, availability, trust)? Who are the actors?
Draw the data flow. External entities, processes, data stores, and the flows between them. Mark trust boundaries (where data crosses privilege levels).
Enumerate threats with STRIDE per element/flow:
- Spoofing · Tampering · Repudiation · Information disclosure · Denial of service · Elevation of privilege
Rate each threat by likelihood × impact; focus on what crosses trust boundaries.
Mitigate. For each significant threat, name a control (authN, input validation, encryption, rate limiting, least privilege, logging) and who owns it.
Track residual risk you're accepting and why.

Deliverable

A table: element/flow · STRIDE category · threat · likelihood/impact · mitigation · status. Plus a short list of the top risks and recommended next actions.

Guidelines

Concentrate on trust boundaries — that's where most real vulnerabilities live.
Prefer eliminating a threat (design change) over detecting it.
Keep it living: revisit when the design or data flows change.