Threat modeling

Skill uwuclxdy/agenticat/skills/threat-modeling

Some of my Agents & Skills, compatible with most AI coding tools

Install

npx -y skills add uwuclxdy/agenticat --skill threat-modeling

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

One thing to look at

5 stars5 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

What its author says it does

Copied from the file, not written here

Threat modeling with STRIDE, attack trees, security-requirement extraction, mitigation and control-library selection (defense-in-depth), and compliance mapping (PCI-DSS/HIPAA/GDPR/OWASP-ASVS). Use when doing a security review, choosing mitigating controls, hardening a design, or building a threat-model doc.

SKILL.md

3.0 KB, as published. Nobody here has run it

Threat Modeling

This threat-models a system's components and data flows, not its code. Pick the one reference the task needs; don't load all four.

Task	File
Identify threats per component/interaction (STRIDE questionnaires, DFD trust-boundary analysis, threat-model doc template)	`references/stride.md`
Map attack paths (OR/AND node model, path + coverage analysis, worked account-takeover example)	`references/attack-trees.md`
Turn threats into requirements (STRIDE -> requirement patterns, compliance mapping with PCI-DSS/HIPAA/GDPR/OWASP-ASVS control IDs; SOC2/NIST CSF/ISO 27001 have no control-id table)	`references/requirements.md`
Choose and prioritize controls (standard-controls library, defense-in-depth layering, coverage + gap analysis)	`references/mitigations.md`

Core Model

STRIDE categories and the property each violates:

Threat	Property violated
Spoofing	Authentication
Tampering	Integrity
Repudiation	Non-repudiation
Information disclosure	Confidentiality
Denial of service	Availability
Elevation of privilege	Authorization

Attack trees: root = attacker goal; OR nodes (any child suffices), AND nodes (all children required), leaves = concrete attack steps scored by difficulty, cost, and detection risk. Cheapest complete path = priority defense target.

Control categories, in layering order: preventive (stop), detective (notice), corrective (recover). Deterrent and compensating controls sit outside that order. A threat counts as covered only when both a preventive control and a detective control apply.

Workflow

Define scope and trust boundaries.
Draw the data flow diagram (flows and boundaries, not just components).
Identify assets and entry points.
Apply STRIDE per element and per interaction (references/stride.md).
Build attack trees for the critical paths (references/attack-trees.md).
Score and prioritize (likelihood × impact).
Extract requirements and map controls (references/requirements.md, references/mitigations.md).
Document residual risks; revisit when components, trust boundaries, or data flows change.

The reference tables and templates are material to read and adapt per session, not a library to install.

Gotchas

references/requirements.md Template 1 names 7 compliance frameworks, but Template 3's control-id mapping table only covers PCI DSS, HIPAA, GDPR, and OWASP ASVS. SOC2, NIST CSF, and ISO 27001 have no control-id table anywhere in this skill.

Delegating

For a standalone modeling run, if the threat-modeler agent is installed, spawn it; otherwise follow the Workflow above directly.