threat-modeling
Use when starting a security assessment and you need to map an application's attack surface, enumerate trust boundaries, and rank what to test first — before auditing code or running tools. Produces a prioritized target list.
How do I install this agent skill?
npx skills add https://github.com/mn-youssef/security-skills --skill threat-modelingIs this agent skill safe to install?
- Gen Agent Trust Hubpass
This skill provides a methodology and reference guide for performing threat modeling using the STRIDE framework. It contains no executable code, network operations, or external dependencies.
- Socketpass
No alerts
- Snykpass
Risk: LOW · No issues
What does this agent skill do?
Threat Modeling (PLAN phase)
Overview
Decide what to worry about and test first before spending effort. Map assets, entry points, and trust boundaries; apply STRIDE; rank risks by likelihood × impact.
Core principle: You can't test everything. Spend effort where a break hurts most.
Process
- Inventory assets — What's valuable? (user data, money, credentials, PII, admin control, IP)
- Map entry points — Every place untrusted input enters: routes/endpoints, forms, file uploads, query params, headers, webhooks, message queues, mobile API calls, third-party callbacks.
- Draw trust boundaries — Where does data cross from less-trusted to more-trusted? (browser→API, API→DB, service→service, user→admin). Bugs cluster on these lines.
- Apply STRIDE per boundary/component — see
references/stride-and-surface.md. - Rank — score each threat:
risk = likelihood × impact(1–3 each → 1–9). Test high scores first.
Quick reference — STRIDE
| Threat | Question | Defends |
|---|---|---|
| Spoofing | Can someone pretend to be another user/service? | Authentication |
| Tampering | Can data be modified in transit/at rest? | Integrity |
| Repudiation | Can an action be denied / is it logged? | Non-repudiation |
| Information disclosure | Can data leak? | Confidentiality |
| Denial of service | Can it be made unavailable? | Availability |
| Elevation of privilege | Can a user gain rights they shouldn't? | Authorization |
Output: prioritized target list
A table the next phases consume:
| # | Asset | Entry point | STRIDE | Likelihood | Impact | Risk | Test via |
|---|---|---|---|---|---|---|---|
| 1 | User PII | GET /api/users/:id | I (IDOR) | 3 | 3 | 9 | code-audit + active-pentest |
| 2 | Auth | POST /login | S | 2 | 3 | 6 | code-audit |
Hand-off
Feed the top items into security-code-audit (find) and active-pentest (validate).
The surface inventory is also the applicability driver. It tells the security-testing
orchestrator which specialists apply (surface present → run) and which to skip (absent → N/A),
and exposes any surface with no matching specialist as a coverage gap to handle with the
generic methodology + a recommendation to build a new skill. List every surface you found —
including ones no current skill covers — so nothing is silently missed.
Common mistakes
- Modeling the happy path only — attackers use the unhappy paths.
- Forgetting internal/trusted entry points (admin panels, internal APIs, cron, queues).
- Treating all findings as equal — rank, or you'll drown in low-value work.
How can the creator link this skill?
Add the canonical catalog link to the repository README so users can inspect current installs and available audits. The publishing guide covers the complete discovery path.
<a href="https://skillzs.dev/skills/mn-youssef/security-skills/threat-modeling">View threat-modeling on skillZs</a>