What problem does it solve? Security is often considered only after implementation, when fixing design flaws is expensive. This Skill embeds threat modelling into the architecture phase so teams can identify how systems may be misused, what assets need protection, and which controls should be designed in before any code is written. ## Core Features & Use Cases - Structured Threat Analysis: Follows a seven-step procedure covering system context, asset identification, trust boundaries, threat identification, risk assessment, mitigations, and documentation. - STRIDE-Based Threat Categories: Analyses spoofing, tampering, repudiation, information disclosure, denial of service, and elevation of privilege across attack surfaces and trust boundaries. - Template-Driven Outputs: Produces a documented Threat Model with asset inventory, trust boundary analysis, risk assessment, recommended mitigations, and residual risks using the Threat-Model template. - Use Case: When designing a new service that handles user credentials and integrates with third-party APIs, apply this Skill to map trust boundaries, identify likely attack paths, and recommend architectural controls before development starts. ## Quick Start Apply the Forge-Threat-Modelling skill to analyse the proposed system architecture and produce a threat model with identified assets, trust boundaries, risks, and recommended mitigations.
