What problem does it solve? Security reviews often stall because threat modeling is manual and inconsistent, and hardcoded credentials slip into repositories unnoticed. This Skill produces structured STRIDE threat models with DREAD risk scores for any system component and runs a pattern-based secret scan, while routing specialized security requests (pen-testing, incident response, cloud posture, red team, AI security) to the correct sibling skill. ## Core Features & Use Cases - STRIDE Threat Modeling: Generates per-component threat reports with STRIDE categories, DREAD scores, and mitigations via scripts/threat_modeler.py, with JSON output and an interactive scoping mode. - Secret Scanning: Detects 20+ secret patterns (AWS keys, GitHub tokens, private keys, database connection strings) via scripts/secret_scanner.py, exiting non-zero on critical or high findings. - Security Routing: Directs requests outside threat modeling — vulnerability assessment, incident triage, compliance checks, adversarial review — to the specialist skill that owns that lane. - Use Case: Before shipping a new authentication service, run the threat modeler on the component, sort threats by DREAD score, assign owners for anything scoring 7 or above, then run the secret scan to confirm no credentials are committed. ## Quick Start Ask the assistant to threat-model the user authentication component and scan the repository for exposed secrets before the next release.
