threat-modellisted

# Threat Model Skill Produce or review a STRIDE-based threat model. STRIDE walks every data-flow element through six threat categories — Spoofing, Tampering, Repudiation, Information disclosure, Denial of service, Elevation of privilege — so that no element is left unexamined. The skill runs headless: it locates its own inputs, spawns its own subagent, and emits a complete document or coverage report. ## Step 1: Determine Mode Two modes: - **AUTHOR** — build a new threat model from an architecture/design doc or codebase. - **REVIEW** — rate an existing threat model's coverage and find gaps. If the first argument is `author` or `review`, use it. Otherwise infer from the input: a file that already contains a threat table or STRIDE analysis implies REVIEW; an architecture or design doc implies AUTHOR. If still ambiguous, use AskUserQuestion to ask author-new vs review-existing. ## Step 2: Locate Inputs If the user passed a path, use it. Otherwise scan: **For REVIEW** — find an existing model: `**/THREAT-MODEL.md`, `**/threat-model.md`, `**/THREATMODEL.md`, `**/security/*.md` **For AUTHOR** — find architecture inputs: `**/ARCHITECTURE.md`, `**/design.md`, `**/DESIGN.md`, `**/plan.md`, `**/PLAN.md`, `**/README.md` If no design doc exists, scan source for entry points and trust boundaries: ```bash grep -rnE "route|router|@app\.(get|post|put|delete)|http\.Handle|addEventListener|listen\(|app\.(get|post|use)|@RequestMapping|def .*request" --include=*.py --include=*.js --incl