skills.rest
braydos-h
braydos-hCOMMUNITY
Explore all skills by this author →
GitHub

performing-threat-modeling-with-owasp-threat-dragon

Create OWASP Threat Dragon data flow diagrams and apply STRIDE analysis to generate threat model reports.

4|Updated Apr 28, 2026
Search Tags:#threat modeling#devsecops#stride#secure design#data flow diagram#linddun#owasp threat dragon
One-click install
npx skills add https://github.com/braydos-h/BreachPilot --skill performing-threat-modeling-with-owasp-threat-dragon-braydos-h
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: performing-threat-modeling-with-owasp-threat-dragon
Source: https://github.com/braydos-h/BreachPilot/tree/main/skills/performing-threat-modeling-with-owasp-threat-dragon
Command: npx skills add https://github.com/braydos-h/BreachPilot --skill performing-threat-modeling-with-owasp-threat-dragon-braydos-h

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) and assets (resource) components.

What problem does it solve? Security teams need a structured way to identify design-level threats before code ships, but manual threat modeling is slow and inconsistent. This Skill guides the creation of data flow diagrams in OWASP Threat Dragon, applies STRIDE and LINDDUN methodologies per element, and produces threat inventories and reports for secure design review. ## Core Features & Use Cases - DFD-Based Threat Modeling: Build data flow diagrams with processes, data stores, external entities, data flows, and trust boundaries in Threat Dragon JSON format. - Automated STRIDE Analysis: Programmatically generate threats per DFD element using STRIDE-per-element mapping, with suggested mitigations for each category. - Gap Analysis and Reporting: Parse existing Threat Dragon JSON files to compute mitigation coverage, STRIDE category coverage, and open threats lacking mitigations. - Use Case: During a design review for a new checkout flow, generate a Threat Dragon model with STRIDE threats auto-applied to each component, then run the analyzer to produce a mitigation gap report for the architecture review board. ## Quick Start Use the threat modeling skill to create a STRIDE threat model for my web application with an API gateway and database, then summarize the open threats.

Frequently Asked Questions about performing-threat-modeling-with-owasp-threat-dragon

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I create a threat model with OWASP Threat Dragon?▼

Install the Threat Dragon desktop app or run the Docker web image, then create a threat model and add a data flow diagram with processes, data stores, external entities, and trust boundaries. Apply STRIDE to each element and mark threats as Open, Mitigated, or Not Applicable.

How to apply STRIDE to data flow diagram elements?▼

STRIDE maps categories to element types: external entities get Spoofing and Repudiation, processes get all six categories, and data stores and data flows get Tampering, Information Disclosure, and Denial of Service. Threat Dragon's rule engine auto-suggests threats based on these mappings.

What is the difference between STRIDE and LINDDUN threat modeling?▼

STRIDE focuses on security threats like spoofing, tampering, and elevation of privilege against system components. LINDDUN targets privacy threats such as linkability, identifiability, and non-compliance with regulations like GDPR. Threat Dragon supports both methodologies.

Can Threat Dragon threat models be stored in version control?▼

Yes, Threat Dragon saves models as JSON files, which can be committed to Git alongside source code. This enables diff-based reviews, programmatic analysis, and keeping threat models synchronized with architecture changes.

How do I find open threats without mitigations in a threat model?▼

Parse the Threat Dragon JSON file and filter threats where status is Open and the mitigation field is empty. The included analyzer script automates this, producing a gap list sorted by severity from Critical to Low.

Related Skills

Explore More Software Engineering Skills→
josemlopezjosemlopez
8

tm-init

Analyze architecture documentation to generate asset inventories, data flows, trust boundaries, and attack surface mappings.

Community
Intermediate
p-o-ke-naep-o-ke-nae

security-requirement-extraction

Convert threat models and business context into actionable security requirements.

Community
Advanced
MolcajeteAIMolcajeteAI
2

security-scanning

Scan Go projects with gosec and govulncheck for security vulnerabilities.

Official
Intermediate
Chid0kChid0k

crawler

Crawl web applications to discover entry points for penetration testing.

Community
Intermediate