threat-modeling

Solid

Threat modeling with STRIDE, attack trees, security-requirement extraction, mitigation and control-library selection (defense-in-depth), and compliance mapping (PCI-DSS/HIPAA/GDPR/OWASP-ASVS). Use when doing a security review, choosing mitigating controls, hardening a design, or building a threat-model doc.

AI & Automation 5 stars 0 forks Updated today MIT

Install

View on GitHub

Quality Score: 80/100

Stars 20%
26
Recency 20%
100
Frontmatter 20%
70
Documentation 15%
100
Issue Health 10%
80
License 10%
100
Description 5%
100

Skill Content

# Threat Modeling This threat-models a system's components and data flows, not its code. Pick the one reference the task needs; don't load all four. | Task | File | |---|---| | Identify threats per component/interaction (STRIDE questionnaires, DFD trust-boundary analysis, threat-model doc template) | `references/stride.md` | | Map attack paths (OR/AND node model, path + coverage analysis, worked account-takeover example) | `references/attack-trees.md` | | Turn threats into requirements (STRIDE -> requirement patterns, compliance mapping with PCI-DSS/HIPAA/GDPR/OWASP-ASVS control IDs; SOC2/NIST CSF/ISO 27001 have no control-id table) | `references/requirements.md` | | Choose and prioritize controls (standard-controls library, defense-in-depth layering, coverage + gap analysis) | `references/mitigations.md` | ## Core Model STRIDE categories and the property each violates: | Threat | Property violated | |---|---| | Spoofing | Authentication | | Tampering | Integrity | | Repudiation | Non-repudiation | | Information disclosure | Confidentiality | | Denial of service | Availability | | Elevation of privilege | Authorization | Attack trees: root = attacker goal; OR nodes (any child suffices), AND nodes (all children required), leaves = concrete attack steps scored by difficulty, cost, and detection risk. Cheapest complete path = priority defense target. Control categories, in layering order: preventive (stop), detective (notice), corrective (recover). Deterrent and compensat...

Details

Author
uwuclxdy
Repository
uwuclxdy/agenticat
Created
5 months ago
Last Updated
today
Language
TypeScript
License
MIT

Bundled in these plugins

Similar Skills

Semantically similar based on skill content — not just same category