Threat modeling

Skill uwuclxdy/agenticat/skills/threat-modeling

STRIDE, attack trees, security-requirement extraction, mitigation and control selection (defense-in-depth), compliance mapping (PCI-DSS/HIPAA/GDPR/OWASP-ASVS). Use for a security review, hardening a design, choosing controls, or a threat-model doc.From its SKILL.md

Install

npx -y skills add uwuclxdy/agenticat --skill threat-modeling

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

One thing to look at

5 stars5 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

SKILL.md

3.0 KB, as published. Nobody here has run it

Threat Modeling

This threat-models a system's components and data flows, not its code. Pick the one reference the task needs; don't load all four.

Task	File
Identify threats per component/interaction (STRIDE questionnaires, DFD trust-boundary analysis, threat-model doc template)	`references/stride.md`
Map attack paths (OR/AND node model, path + coverage analysis, worked account-takeover example)	`references/attack-trees.md`
Turn threats into requirements (STRIDE -> requirement patterns, compliance mapping with PCI-DSS/HIPAA/GDPR/OWASP-ASVS control IDs; SOC2/NIST CSF/ISO 27001 have no control-id table)	`references/requirements.md`
Choose and prioritize controls (standard-controls library, defense-in-depth layering, coverage + gap analysis)	`references/mitigations.md`

Core Model

STRIDE categories and the property each violates:

Threat	Property violated
Spoofing	Authentication
Tampering	Integrity
Repudiation	Non-repudiation
Information disclosure	Confidentiality
Denial of service	Availability
Elevation of privilege	Authorization

Attack trees: root = attacker goal; OR nodes (any child suffices), AND nodes (all children required), leaves = concrete attack steps scored by difficulty, cost, and detection risk. Cheapest complete path = priority defense target.

Control categories, in layering order: preventive (stop), detective (notice), corrective (recover). Deterrent and compensating controls sit outside that order. A threat counts as covered only when both a preventive control and a detective control apply.

Workflow

Define scope and trust boundaries.
Draw the data flow diagram (flows and boundaries, not just components).
Identify assets and entry points.
Apply STRIDE per element and per interaction (references/stride.md).
Build attack trees for the critical paths (references/attack-trees.md).
Score and prioritize (likelihood × impact).
Extract requirements and map controls (references/requirements.md, references/mitigations.md).
Document residual risks; revisit when components, trust boundaries, or data flows change.

The reference tables and templates are material to read and adapt per session, not a library to install.

Gotchas

references/requirements.md Template 1 names 7 compliance frameworks, but Template 3's control-id mapping table only covers PCI DSS, HIPAA, GDPR, and OWASP ASVS. SOC2, NIST CSF, and ISO 27001 have no control-id table anywhere in this skill.

Delegating

For a standalone modeling run, if the threat-modeler agent is installed, spawn it; otherwise follow the Workflow above directly.

What ships with it: 4 files

16.0 KB alongside SKILL.md

references/

Gives 0 of the 12 instructions most threat modeling skills give

Counted across 325 of the 341 authors here whose files we hold, read 2026-09-06

Use parameterized queries for all database accessin 58 of 325, across 34 files
Validate all user input with schemasin 52 of 325, across 29 files
Store tokens in httpOnly cookiesin 50 of 325, across 27 files
Store secrets in environment variablesin 50 of 325, across 27 files
Sanitize user-provided HTML before renderingin 49 of 325, across 26 files
Apply rate limiting to all API endpointsin 48 of 325, across 25 files
Verify authorization before sensitive operationsin 47 of 325, across 24 files
Require CSRF tokens on state-changing operationsin 46 of 325, across 23 files
Return generic error messages to usersin 40 of 325, across 22 files
Restrict file uploads by size, type, and extensionin 38 of 325, across 20 files
Run npm audit and fix vulnerabilitiesin 28 of 325, across 16 files
Redact sensitive data from logsin 25 of 325, across 11 files

Said here and by no other author read

Identify assets and entry points.
Score and prioritize by likelihood and impact.
Extract requirements and map controls.
Revisit when components or trust boundaries change.
Spawn the threat-modeler agent if installed.

Grouped from the skills themselves: near-identical wordings counted once, and counted by distinct author, so one author publishing three of these counts once.