skills.rest
ohsonerdy
ohsonerdyCOMMUNITY
Explore all skills by this author →
GitHub

threat-modeling

Guide scoping, data flow diagramming, and STRIDE analysis per trust boundary.

Updated Aug 23, 2026
Search Tags:#threat modeling#security architecture#stride#risk prioritization#data flow diagram#security mitigations#abuser stories
One-click install
npx skills add https://github.com/ohsonerdy/openclaw-frontier-stack --skill threat-modeling-ohsonerdy
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: threat-modeling
Source: https://github.com/ohsonerdy/openclaw-frontier-stack/tree/main/skills/threat-modeling
Command: npx skills add https://github.com/ohsonerdy/openclaw-frontier-stack --skill threat-modeling-ohsonerdy

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Threat modeling helps teams identify what could go wrong in a system’s design so security risks are addressed before production.

Core Features & Use Cases

  • Guided threat modeling workflow: Define scope, build a data flow diagram (DFD), apply STRIDE per trust boundary, and document assumptions.
  • Concrete adversary thinking: Produce abuser stories and prioritize risks using likelihood × impact, not intuition.
  • Actionable mitigations: Map top threats to control strategies using prevent/detect/respond/recover and capture residual risk and open questions.

Use case: before launching an API or integration (like webhooks, authentication changes, or multi-tenant data access), you generate a structured threat model that outputs prioritized threats, mitigations, and residual risks tied to the relevant data flows and trust boundaries.

Quick Start

Use the threat-modeling skill to produce a structured STRIDE-based threat model (including DFD, abuser stories, prioritized top risks, and mitigations) for a “new webhook delivery system where customers register URLs and we POST signed events.”

Frequently Asked Questions about threat-modeling

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I do threat modeling for a new API integration?▼

Threat modeling for a new API integration involves defining scope, building a data flow diagram, and applying STRIDE analysis per trust boundary to identify threats. It systematically generates prioritized risks, abuser stories, and mitigations for sensitive data or privilege changes.

What is STRIDE analysis in security architecture?▼

STRIDE analysis in security architecture is a structured method to categorize threats like spoofing, tampering, and elevation of privilege across system data flows. It maps threats to trust boundaries to produce prioritized likelihood × impact risks and actionable mitigations.

When should I use threat modeling for software releases?▼

Threat modeling should be used for software releases involving major architectural changes, sensitive data, privilege changes, or external integrations. It identifies security risks early by mapping data flow diagrams and generating structured outputs like attack trees and residual risks.

How do I prioritize security risks using abuser stories?▼

Prioritize security risks using abuser stories by mapping them to a likelihood × impact matrix rather than intuition. This structured approach translates concrete adversary thinking into prioritized top threats, enabling targeted prevent, detect, respond, and recover mitigations.

Does threat modeling work for multi-tenant data access changes?▼

Threat modeling works effectively for multi-tenant data access changes by systematically scoping the architectural shift and diagramming data flows. It applies STRIDE analysis across trust boundaries to generate prioritized risks, mitigations, and open questions for the release.

What is the best way to document security mitigations and residual risks?▼

The best way to document security mitigations and residual risks is by mapping top threats to control strategies using prevent, detect, respond, and recover categories. This captures residual risk and open questions tied directly to relevant data flows and trust boundaries.

Related Skills

Explore More Software Engineering Skills→
jassicsjassics
6

threat-model-dfd

Generate Data Flow Diagrams with trust boundaries for STRIDE/PASTA threat modeling.

Community
Intermediate
patricio0312revpatricio0312rev
5

threat-model-generator

Generate STRIDE-based threat models with asset tagging and residual risk computation.

Community
Advanced
LuisSambranoLuisSambrano
7

code-review

Perform systematic code review and static analysis across multiple programming languages.

Community
Advanced
bobmatnycbobmatnyc
68

threat-modeling

Facilitate STRIDE threat modeling with data flow diagrams and mitigation plans.

Community
Advanced