skills.rest
obispobruno
obispobrunoCOMMUNITY
Explore all skills by this author →
GitHub

threat-modeling-with-aws-security-agent

Runs AWS Security Agent threat model reviews on spec documents using STRIDE analysis.

1|Updated Aug 1, 2024
Search Tags:#threat modeling#security review#stride#vulnerability analysis#design documents#aws cli#aws security
One-click install
npx skills add https://github.com/obispobruno/dotfiles --skill threat-modeling-with-aws-security-agent-obispobruno
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: threat-modeling-with-aws-security-agent
Source: https://github.com/obispobruno/dotfiles/tree/main/dot_agents/skills/threat-modeling-with-aws-security-agent
Command: npx skills add https://github.com/obispobruno/dotfiles --skill threat-modeling-with-aws-security-agent-obispobruno

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Security reviews of design documents are often manual and inconsistent. This Skill automates threat modeling by analyzing requirements.md and design.md files against your source code with the AWS Security Agent, identifying security-posture changes using the STRIDE methodology. ## Core Features & Use Cases - Automated STRIDE Threat Modeling: Uploads your workspace and spec files to AWS Security Agent, creates a threat model, and starts a review job without any prior scan. - Managed Job Lifecycle: Handles S3 uploads, threat model creation, job polling every 2 minutes, and paginated retrieval of findings. - Structured Findings Reports: Presents threats with severity, STRIDE category, impact, affected assets, and recommendations, and writes a full report to .security-agent/findings-<scan_id>.md. - Use Case: Before merging a new feature, ask for a security review of your updated design.md to detect regressions such as missing authentication or new data exposure risks. ## Quick Start Review the security posture of my requirements.md and design.md files by running a threat model against this workspace.

Frequently Asked Questions about threat-modeling-with-aws-security-agent

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I run a threat model on my design documents with AWS?▼

Provide your requirements.md or design.md files and the Skill zips your workspace, uploads it to S3, creates a threat model via the AWS Security Agent API, and starts the review job. Findings are returned with severity, STRIDE category, and recommendations.

What is STRIDE analysis in threat modeling?▼

STRIDE is a threat classification methodology covering Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, and Elevation of Privilege. The AWS Security Agent categorizes each identified threat under one of these categories in its findings.

Do I need a prior security scan before running a threat model?▼

No, threat model reviews are standalone and require no prior scan. You only need a configured agent space in .security-agent/config.json and at least one spec file such as requirements.md or design.md.

How long does an AWS Security Agent threat model take?▼

Runtime varies with workspace size. The Skill polls the job status every 2 minutes using batch-get-threat-model-jobs and only reports when the status changes, and you can say 'stop polling' to opt out.

What AWS permissions are needed for threat modeling with Security Agent?▼

You need AWS CLI credentials, an IAM role named SecurityAgentScanRole, and access to an S3 bucket named security-agent-scans-<account>-<region> for uploading the source zip and spec files.

Related Skills

Explore More Software Engineering Skills→
VentoriumVentorium

security-review-expert

Identify and document security risks in VentoStack backend code and configurations.

Official
Advanced
ManzuetiManzueti

qa

Automate QA testing and bug fixing for web applications with atomic commits.

Community
Advanced
barbosakjnbarbosakjn
1

vulnerability-scanner

Scan codebases, dependencies, and configurations for security vulnerabilities with severity levels.

Community
Advanced
tylern91tylern91

threat-modeling

Identify and mitigate STRIDE security threats in system designs.

Community
Advanced