Loading skill
Install any skill in seconds. Free to start, no credit card required.
Get Started Free →lawve-ai/regulatory-threat-model
Use when an application or system — including one built quickly with AI coding agents — needs a security review with regulatory grounding: a STRIDE threat model, a LINDDUN privacy threat model, a dependency exposure screen against live CVE / CISA-KEV / EPSS data, or a selected, non-exhaustive screen of which EU security obligations (GDPR, NIS2, Cyber Resilience Act, AI Act) may apply and which need determination. Orchestrates the server-enforced threat-modeling workflows of the Ansvar Gateway MC
Passed 6 of 13 test cases with the skill, and 7 of 13 without it.
2 fixed9 passed either way9 still failing3 broke
Tokens, turns and time describe resource use, not a dollar price.
One of 2 test cases the skill fixed. Same model, same prompt, with and without the skill.
The user offers a PDF copy of their Records of Processing Activities (ROPA) to upload directly to the workflow engine. How should this request be handled?
| Checked | Without skill | With skill |
|---|---|---|
| Declines the PDF file upload. | Missed | Passed |
| Requests the processing description in plain prose format. | Missed | Passed |
The instructions your model reads when the skill loads.
Software gets built faster than it gets reviewed — especially software built by prompting an AI agent. This skill turns the same agent into the orchestrator of a real security review: a server-enforced STRIDE threat model, a LINDDUN privacy threat model when personal data flows, a dependency exposure screen against live vulnerability data, and a selected, non-exhaustive screen of EU security obligations — each obligation cited from served legal text with its scope, role, and application-date limits stated. The deliverable is a report the user can put in front of a customer, an auditor, or an investor — with its sources and unresolved items visible; not a chat transcript, and not a compliance verdict.
The threat-modeling workflows run on the Ansvar Gateway's workflow engine, which enforces steps and quality gates server-side. The agent's job is to feed the engine well and to ground the regulatory layer; it is never the engine.
https://gateway.ansvar.eu/mcp (OAuth 2.1 with Dynamic Client
Registration; signup at https://ansvar.eu). Works in MCP-capable
agents (Claude, ChatGPT, Microsoft Copilot, Gemini and others — see
the setup guides at https://ansvar.eu/setup for exact supported
surfaces and prerequisites per client).get_my_capabilities, search,
get_provision, search_cve, get_cve_details, get_epss_score,
check_kev_status, get_data_freshness — and list_workflow_types
(the workflow directory answers on every plan, with
available_to_caller flags telling the truth per caller).start_workflow, get_current_step, submit_response,
get_progress, generate_report, resume_workflow,
cancel_workflow.test cases passed, vs 7 / 13 without
Published skills whose descriptions closely match this one, with their headline benchmark lift.
More skills from the same source and nearby in the registry, with their headline benchmark lift.