Loading skill
Install any skill in seconds. Free to start, no credit card required.
Get Started Free →jamestorrevillas/threat-modeling
Use this skill when identifying security threats, designing secure systems, thinking like an attacker, performing security assessments, or applying STRIDE threat modeling. Trigger on keywords: threat model, security design, attack surface, STRIDE, vulnerabilities by design, security review, who can attack this, what could go wrong security-wise.
Passed 22 of 22 test cases with the skill, and 21 of 22 without it.
1 fixed21 passed either way0 still failing0 broke
Tokens, turns and time describe resource use, not a dollar price.
A test case the skill fixed. Same model, same prompt, with and without the skill.
When executing a 7-step threat modeling process, what step immediately follows identifying assets before identifying specific STRIDE threats?
| Checked | Without skill | With skill |
|---|---|---|
| Specifies drawing or mapping data flows as the step. | Missed | Passed |
The instructions your model reads when the skill loads.
Think like an attacker, build like a defender.
Threat modeling is done BEFORE building, not after. Security retrofitted is always weaker and more expensive than security designed in.
For every component, ask: can an attacker do this?
| Threat | Definition | Example |
|---|---|---|
| Spoofing | Pretend to be someone else | Forged JWT token |
| Tampering | Modify data in transit or at rest | SQL injection, request body modification |
| Repudiation | Deny performing an action | No audit log of who deleted a record |
| Information Disclosure | Access data they shouldn't | Over-fetching API, verbose error messages |
| Denial of Service | Make system unavailable | No rate limiting on auth endpoint |
| Elevation of Privilege | Gain unauthorized access level | IDOR (accessing other users' data) |
1. DEFINE SCOPE — What are we modeling? (feature, service, system)
2. IDENTIFY ASSETS — What are we protecting? (data, services, credentials)
3. DRAW DATA FLOWS — How does data move through the system?
4. IDENTIFY THREATS — Apply STRIDE to each component and data flow
5. ASSESS RISK — Likelihood × Impact for each threat
6. MITIGATE — For each high-risk threat, define a control
7. VERIFY — Confirm controls are implemented and working
test cases passed, vs 21 / 22 without
Published skills whose descriptions closely match this one, with their headline benchmark lift.
More skills from the same source and nearby in the registry, with their headline benchmark lift.