modern-threat-modelinglisted

Threat model a system, service, or architecture with STRIDE, then produce a data-flow diagram, a threat ledger, a scored and ranked risk register, and prioritized remediations. Every threat maps to a valid MITRE ATT&CK technique; MITRE ATLAS techniques are added only for LLM components in the data-flow diagram. Use it for a security design review of a whole system: attack surface, trust boundaries, which risks matter most, and how to fix them first, even when the user never says STRIDE or threat model. It works from a described idea, an architecture diagram, a code repo, or any mix, and covers LLM and agent apps (prompt injection, unsafe tool calls, RAG poisoning) as well as conventional software. It also fits asks to build a DFD, enumerate threats, or map them to ATT&CK and rank by risk. Not for hardening one config file, scanning for secrets or vulnerable dependencies, debugging a live outage or DoS, incident response after a breach, improving an LLM's answer quality, or a project schedule risk register.
abelreqma/modern-threat-model · ★ 0 · AI & Automation · score 72

Install: claude install-skill abelreqma/modern-threat-model

# Modern Threat Modeling (STRIDE to ATT&CK, plus ATLAS for LLMs) This skill turns a system description, a diagram, and/or a codebase into a traceable STRIDE threat model in which every threat maps to a valid MITRE technique, ending in a scored risk register and prioritized remediations. **STRIDE is the only threat-modeling framework permitted in this skill.** Every threat is classified as exactly one of Spoofing, Tampering, Repudiation, Information disclosure, Denial of service, or Elevation of privilege. Do not use, mention, offer, or blend in any other threat-modeling or threat-enumeration framework (not PASTA, LINDDUN, DREAD, OCTAVE, Trike, VAST, attack trees, the OWASP Top 10, kill-chain models, or any custom taxonomy), and do not invent new categories. If a user asks for another framework, state that this skill is STRIDE-only and continue in STRIDE. MITRE ATT&CK and ATLAS are technique catalogs used for mapping, not threat-modeling frameworks; they are the only outside taxonomies allowed, and only for mapping, per the Mapping rules below. ## Authorized use only Threat modeling is defensive work. Only model systems the user owns or is authorized to assess. Describe how a system could be attacked so it can be defended, staying at the level of techniques, controls, and abstract attack paths. Do not write working exploits, weaponized payloads, or step-by-step intrusion instructions against third-party systems. Illustrative proof-of-concept sketches are acceptable for a s