skills.rest
real-case
real-caseCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

sec-threat-model

Generate STRIDE-based threat models with data flows, trust boundaries, and risk-scored mitigations.

Updated Apr 16, 2026
Search Tags:#security#threat modeling#risk assessment#stride#mitigation#attack surface#trust boundaries
One-click install
npx skills add https://github.com/real-case/marvin-toolkit --skill sec-threat-model-real-case
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: sec-threat-model
Source: https://github.com/real-case/marvin-toolkit/tree/main/plugins/marvin/skills/sec-threat-model
Command: npx skills add https://github.com/real-case/marvin-toolkit --skill sec-threat-model-real-case

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Security issues are often discovered only after code ships, when fixes are expensive. This Skill performs proactive, architecture-level threat modeling before or during development, systematically identifying realistic attack scenarios, trust boundary weaknesses, and missing mitigations so teams can prioritize fixes early. ## Core Features & Use Cases - STRIDE Analysis: Evaluates each component and data flow against Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, and Elevation of Privilege, with residual risk ratings. - System Discovery & Data Flow Mapping: Inventories entry points, services, data stores, and actors, then produces ASCII data flow diagrams marking trust boundaries. - Risk Scoring & Mitigation Plan: Scores threats with a likelihood × impact matrix and produces prioritized mitigations (quick wins, planned work, long-term), written to .marvin/security/threat-model.md with a machine-readable audit-report block. - Use Case: Before building a new payment integration, ask for a threat model of the checkout flow to get a diagram of trust boundaries, a table of STRIDE threats tied to specific files and endpoints, and a prioritized mitigation plan. ## Quick Start Ask the assistant to threat model the authentication feature of this repository using STRIDE and save the report.

Frequently Asked Questions about sec-threat-model

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I create a STRIDE threat model for my application?▼

STRIDE threat modeling inventories components, data stores, and actors, maps data flows across trust boundaries, then evaluates each against six threat categories: Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, and Elevation of Privilege. This Skill automates that process against your actual codebase.

What is the difference between threat modeling and a security scan?▼

Threat modeling is proactive and architecture-level, identifying realistic attack scenarios and missing mitigations before code is written. Security scanning is reactive, detecting vulnerabilities in existing code. This Skill focuses on the design-level analysis.

Can I threat model a single feature instead of the whole system?▼

Yes. Passing a feature name or directory path as an argument scopes the STRIDE analysis to that feature's components and data flows, while still tracing surrounding trust boundaries and dependencies that affect it.

Where is the threat model report saved?▼

The report is written to .marvin/security/threat-model.md, including both the prose analysis and a machine-readable audit-report JSON block consumed by the sec-report audit tool and dashboard. For quick reads, the result can be reported inline instead.

How are threats prioritized in a threat model?▼

Each threat is scored on likelihood (High/Medium/Low) and impact (Low to Critical), combined in a risk matrix. Critical and High risks receive detailed mitigations with effort estimates, while Medium and Low risks get brief recommendations.

Related Skills

Explore More Software Engineering Skills→
jaypatrickjaypatrick

security-threat-model

Identify components, data stores, entry points, and trust boundaries from repository evidence.

Community
Advanced
kay6198835kay6198835

security-audit

Audit game codebases for security vulnerabilities and generate a prioritized remediation plan.

Community
Advanced
AutomatedMarketerAutomatedMarketer

security-reviewer

Scan application code, configuration, and dependencies for security vulnerabilities.

Community
Advanced
rnavarychrnavarych
14

role-aqa:security-testing

Your response is missing. Please try again.

Community
Advanced