skills.rest
MohamedSayedK
MohamedSayedKCOMMUNITY
Explore all skills by this author →
GitHub

threat-model

Generates a STRIDE threat catalogue from a data flow diagram with optional OWASP Threat Dragon export.

Updated Jun 2, 2026
Search Tags:#architecture#security#threat modeling#stride#risk analysis#dfd#owasp threat dragon
One-click install
npx skills add https://github.com/MohamedSayedK/omnigrid --skill threat-model-mohamedsayedk
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: threat-model
Source: https://github.com/MohamedSayedK/omnigrid/tree/main/assets/core/skills/threat-model
Command: npx skills add https://github.com/MohamedSayedK/omnigrid --skill threat-model-mohamedsayedk

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Security teams need a systematic way to identify threats in a system's architecture, but manual STRIDE analysis is slow and often skips trust-boundary crossings. This Skill walks every trust-boundary crossing in an existing data flow diagram and produces a severity-ranked threat catalogue with concrete mitigations. ## Core Features & Use Cases - STRIDE Analysis: Enumerates Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, and Elevation of Privilege threats per trust-boundary crossing, each with severity and mitigation. - Threat Dragon Export: Optionally serializes the model into OWASP Threat Dragon v2 JSON via a TypeScript serializer, ready to open in the Threat Dragon tool. - Artifact Handoff: Consumes the DFD artifact produced by the dfd skill and writes a regenerable threat-model artifact under omnigrid/artifacts/architecture/. - Use Case: After generating a DFD for a new service, run the threat model to get a prioritized list of threats (e.g., missing rate limiting on an API endpoint) before writing code. ## Quick Start Run /threat-model to generate a STRIDE threat catalogue from the existing DFD, adding --format=dragon if you also want an OWASP Threat Dragon JSON export.

Frequently Asked Questions about threat-model

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I run a STRIDE threat model on my architecture?▼

Run /threat-model after generating a DFD with the dfd skill. It walks every trust-boundary crossing across the six STRIDE categories and writes a severity-ranked catalogue of threats with mitigations to omnigrid/artifacts/architecture/.

How do I export a threat model to OWASP Threat Dragon?▼

Use /threat-model --format=dragon or --format=both. The skill builds a structured model from the DFD entities and STRIDE catalogue, then serializes it to Threat Dragon v2 JSON that opens directly in the Threat Dragon application.

What happens if there is no DFD before running a threat model?▼

The skill requires the DFD artifact at omnigrid/artifacts/architecture/dfd.md as its source of truth. If it is absent, you must run /dfd first, since a STRIDE walk without a DFD has no anchor for trust-boundary crossings.

Why does my Threat Dragon export report errors?▼

The serializer drops dangling references, such as a flow or threat naming an unknown entity id or a boundary listing an unknown child, and returns them in an errors array. Treat any non-empty errors result as a failed export and fix the model ids.

Does the threat model run as a separate reviewer agent?▼

No. It carries no runs-as designation because a reviewer role is read-only and cannot write artifacts. Like dfd and c4, it runs in the main thread so it can write the threat-model artifact.

Related Skills

Explore More Software Engineering Skills→
jassicsjassics
6

threat-model-dfd

Generate Data Flow Diagrams with trust boundaries for STRIDE/PASTA threat modeling.

Community
Intermediate
ArogyaReddyArogyaReddy

threat-mitigation-mapping

Map identified threats to corresponding security controls for prioritized risk mitigation.

Community
Advanced
cropsggcropsgg
15

security-audit

Identify and mitigate security flaws in pre-merge code reviews.

Community
Advanced
ohsonerdyohsonerdy

threat-modeling

Guide scoping, data flow diagramming, and STRIDE analysis per trust boundary.

Community
Advanced