skills.rest
yogiex
yogiexCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

threat-modeling

Guides structured threat modeling to identify, prioritize, and mitigate security risks in systems.

Updated Jun 5, 2026
Search Tags:#threat modeling#security analysis#security audit#risk assessment#stride#risk mitigation
One-click install
npx skills add https://github.com/yogiex/opencode-cyber-security-skills --skill threat-modeling-yogiex
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: threat-modeling
Source: https://github.com/yogiex/opencode-cyber-security-skills/tree/main/skills/threat-modeling
Command: npx skills add https://github.com/yogiex/opencode-cyber-security-skills --skill threat-modeling-yogiex

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Organizations often skip structured threat analysis because it seems too technical, leaving security risks undiscovered until after incidents occur. This Skill walks non-technical stakeholders through a systematic threat modeling process without requiring deep security engineering expertise. ## Core Features & Use Cases - Asset and Data Flow Mapping: Identifies valuable data, trust boundaries, and how information moves through a system in plain business language. - STRIDE-Based Threat Questioning: Translates the STRIDE framework (spoofing, tampering, repudiation, information disclosure, denial of service, elevation of privilege) into plain-language questions anyone can answer. - Risk Prioritization and Mitigation Planning: Uses a simple impact-versus-likelihood matrix and produces actionable reports with owners and deadlines. - Use Case: Before launching a new customer-facing feature, a product manager uses this Skill to map data flows, surface threats like unauthorized data access by partners, and produce a documented risk register for auditors. ## Quick Start Ask the agent to run a threat modeling session for your system by describing its users, most sensitive data, and main data flows.

Frequently Asked Questions about threat-modeling

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I do threat modeling without security expertise?▼

Threat modeling without deep technical expertise works by answering structured questions about your assets, data flows, and trust boundaries. This Skill translates the STRIDE framework into plain-language questions and prioritizes risks using a simple impact-versus-likelihood matrix.

What is the STRIDE threat modeling framework?▼

STRIDE is a threat classification model covering spoofing, tampering, repudiation, information disclosure, denial of service, and elevation of privilege. This Skill expresses each category as an everyday question, such as whether someone could act outside their authority.

When should I run a threat modeling session?▼

Run threat modeling at the start of a project or new feature, before engaging a penetration tester, after significant architecture changes, following a security incident, or when auditors require documented threat analysis.

Can threat modeling replace a penetration test?▼

No, threat modeling and penetration testing serve different purposes. Threat modeling identifies and prioritizes potential risks conceptually, while penetration testing technically exploits real vulnerabilities. Threat modeling output helps scope a more focused penetration test.

What are the limitations of non-technical threat modeling?▼

Non-technical threat modeling does not provide concrete technical steps like SQL injection commands or firewall configurations. It also requires a basic understanding of business assets and processes first, and should be repeated when the system changes.

Related Skills

Explore More Product & Management Skills→
vecearvecear

threat-model-generator

Generate STRIDE-based threat models with threats, mitigations, and residual risk.

Community
Advanced
amplitudeamplitude
142

pre-mortem

Categorize launch risks into Tigers, Paper Tigers, and Elephants with owners and deadlines.

Official
Advanced
fatihkanfatihkan
7

security

Provide structured cybersecurity playbooks covering threat modeling, incident response, and compliance mapping.

Community
Advanced
bughqbughq
2

stacks-security-audit

Map attack surfaces and evaluate Stacks applications against OWASP Top 10 and STRIDE.

Official
Advanced