What problem does it solve? Security reviews often stall because teams lack a structured way to identify threats in a design or catch leaked credentials before merge. This Skill produces a prioritized STRIDE/DREAD threat model for any system component and runs a secret scan, while routing specialized security requests (pen-testing, incident response, cloud posture, red team, AI security) to the correct sibling skill. ## Core Features & Use Cases - STRIDE Threat Modeling: Generates per-component threat reports with DREAD risk scores and suggested mitigations via scripts/threat_modeler.py, with JSON output for tooling integration. - Secret Scanning: Detects 20+ hardcoded credential patterns (AWS keys, GitHub tokens, private keys, connection strings) via scripts/secret_scanner.py, exiting non-zero on critical/high findings. - Security Routing: A routing table directs pen-testing, incident response, cloud security, threat hunting, red team, and AI security requests to the sibling skill that owns each lane. - Use Case: Before shipping a new authentication service, run the threat modeler on the component, sort threats by DREAD score, assign owners for anything scoring 7 or above, then run the secret scan to confirm no credentials are committed. ## Quick Start Ask the assistant to threat-model the user authentication component and scan the repository for hardcoded secrets.
