Expert in threat modeling methodologies, security architecture review, and risk assessment. Masters STRIDE, PASTA, attack trees, and security requirement extraction. Use PROACTIVELY for security architecture reviews, threat identification, or building secure-by-design systems.
SkillScore64Maintained
Automatic
◆Security & AppSec pack
Last verified 8/11/2026
What it changes
Passed 14 of 22 test cases with the skill, and 9 of 22 without it.
Without skill41%
With skill64%
Checks it passed that the model alone missed
Includes a dedicated section documenting residual risks.
Ranks identified risks using a defined risk scoring methodology.
Explicitly documents residual risks after applying recommended mitigations.
and 5 more in the full report
5 fixed9 passed either way8 still failing0 broke
Pass-rate lift
+23 pp
Tokens
+18%
Agent turns
0%
Response time
+8%
Model gemini-3.6-flashMeasured 8/11/2026v114 of 22 cases passed with skill
Tokens, turns and time describe resource use, not a dollar price.
See it in action
One of 5 test cases the skill fixed. Same model, same prompt, with and without the skill.
1 of 5
Prompt
Our team is preparing to launch a cloud-connected IoT device telemetry pipeline. Could you perform a threat analysis on our architecture? Walk through the entry points and data flows, identify potential attack vectors using STRIDE, rank the discovered threats based on impact and likelihood, and map out recommended security controls and requirements for the engineering backlog.
What was checked, without and with the skill
Checked
Without skill
With skill
Includes an attack tree representation for critical attack paths in the telemetry architecture.
Missed
Passed
Explicitly documents residual risks after applying recommended mitigations.
Missed
Passed
case-01 · gemini-3.6-flash · 8/11/2026 · answers are capped and redacted
What's inside
The instructions your model reads when the skill loads.
SKILL.md60 linessingle file
Threat Modeling Expert
Expert in threat modeling methodologies, security architecture review, and risk assessment. Masters STRIDE, PASTA, attack trees, and security requirement extraction. Use PROACTIVELY for security architecture reviews, threat identification, or building secure-by-design systems.
Capabilities
STRIDE threat analysis
Attack tree construction
Data flow diagram analysis
Security requirement extraction
Risk prioritization and scoring
Mitigation strategy design
Security control mapping
Use this skill when
Designing new systems or features
Reviewing architecture for security gaps
Preparing for security audits
Identifying attack vectors
Prioritizing security investments
Creating security documentation
Training teams on security thinking
Do not use this skill when
You lack scope or authorization for security review
You need legal or compliance certification
You only need automated scanning without human review
Write a STRIDE-based threat model for a service or feature. Use when asked to produce a threat model, document security risks, identify attack vectors, assess a service's security posture, or prepare for a security design review. Produces a structured threat model covering assets, trust boundaries, STRIDE threat enumeration per component, risk scores, mitigation controls, and residual risk sign-off.