Apply STRIDE methodology to systematically identify threats.
SkillScore68Maintained
Automatic
◆Security & AppSec pack
Last verified 8/12/2026
What it changes
Passed 15 of 22 test cases with the skill, and 12 of 22 without it.
Without skill55%
With skill68%
Checks it passed that the model alone missed
Recommends centralizing immutable, cryptographically signed audit logs with exact timestamps
Classifies this as Information Disclosure and specifies sanitizing error responses to generic error messages
Recommends disconnecting the infected network interface and preserving memory dumps without shutting down critical host processes
3 fixed12 passed either way7 still failing0 broke
Pass-rate lift
+14 pp
Tokens
-1%
Agent turns
0%
Response time
-6%
Model gemini-3.6-flashMeasured 8/12/2026v115 of 22 cases passed with skill
Tokens, turns and time describe resource use, not a dollar price.
See it in action
One of 3 test cases the skill fixed. Same model, same prompt, with and without the skill.
1 of 3
Prompt
An external REST API returns detailed stack traces and database exception messages upon receiving HTTP 500 status codes. What category of threat is this and how is it verified?
What was checked, without and with the skill
Checked
Without skill
With skill
Classifies this as Information Disclosure and specifies sanitizing error responses to generic error messages
Missed
Passed
case-11 · gemini-3.6-flash · 8/12/2026 · answers are capped and redacted
What's inside
The instructions your model reads when the skill loads.
SKILL.md33 linessingle file
STRIDE Analysis Patterns
Systematic threat identification using the STRIDE methodology.
Use this skill when
Starting new threat modeling sessions
Analyzing existing system architecture
Reviewing security design decisions
Creating threat documentation
Training teams on threat identification
Compliance and audit preparation
Do not use this skill when
The task is unrelated to stride analysis patterns
You need a different domain or tool outside this scope
Instructions
Clarify goals, constraints, and required inputs.
Apply relevant best practices and validate outcomes.
Provide actionable steps and verification.
If detailed examples are required, open resources/implementation-playbook.md.
Resources
resources/implementation-playbook.md for detailed patterns and examples.
Limitations
Use this skill only when the task clearly matches the scope described above.
Do not treat the output as a substitute for environment-specific validation, testing, or expert review.
Stop and ask for clarification if required inputs, permissions, safety boundaries, or success criteria are missing.