SuperAPI AI Directory
Partner with us中文AI newsFavorites
Skillsthreat-modeling

threat-modeling

Security & auditing

View repository

Updated 10-15 22:12

About this skill

Threat Modeling

Adversarial design-time analysis: enumerate threats against a system and specify mitigations. This skill routes to methodology files, workflow runbooks, example libraries, and control-catalog references. Extended adversarial reasoning is the core value — spend thinking budget on threat enumeration.

When to Use

  • New system or major architecture change needs security review.
  • An OpenAPI / AsyncAPI spec exists and you want automatic STRIDE-per-interaction.
  • Architecture docs or diagrams need threat analysis.
  • A specific high-impact threat requires attack-tree deep dive.
  • Privacy / personal-data handling needs threat analysis (LINDDUN).
  • Mitigations need mapping to NIST CSF / NIST 800-53 / CIS / OWASP ASVS.
  • Producing a threat model report for stakeholders / auditors.
  • Prioritizing existing threat lists by risk score.

Trigger Phrases

  • "threat model this application / service / API"
  • "identify threats using STRIDE / PASTA / LINDDUN"
  • "create a data flow diagram / DFD"
  • "analyze the attack surface"
  • "build an attack tree for X"
  • "map these threats to NIST / ASVS / CIS controls"

When NOT to Use This Skill

  • Runtime API testing / exploitation of a live endpoint → use api-security (this skill identifies threats; api-security confirms exploitability).
  • Code-level vulnerability discovery in a repo (SAST/DAST/SCA) → use sast-orchestration.
  • Container image CVE scanning → use container-security.
  • Cloud posture misconfigurations → use iac-security / cloud-security skill.
  • Incident response on an active intrusion → this is design-time; use IR playbooks instead.
  • Compliance gap analysis only (no threat enumeration) → use a compliance skill; thread results back here for design changes.

Decision Tree

1. Have an OpenAPI / AsyncAPI spec?
   → workflows/stride_from_openapi.md         (highest-leverage entry point)

2. Have architecture docs or diagrams (or diagram images)?
   → workflows/stride_from_arch_docs.md
     (if diagrams only, first workflows/dfd_creation.md)

3. Need a DFD from scratch?
   → workflows/dfd_creation.md  (emit Mermaid)

4. Already have a high-level threat; need deep path analysis?
   → workflows/attack_tree_from_threat.md

5. Have threats; need mitigations + catalog mappings?
   → workflows/threat_to_mitigation.md

6. Privacy-specific modeling?
   → methodology/linddun.md

7. Enterprise-wide risk?
   → methodology/octave.md

8. Unsure which methodology?
   → references/framework_comparison.md

Parallelism Hints

Parallelizable:

  • STRIDE-per-element: one sub-agent per element across an entire DFD.
  • STRIDE-per-category: one sub-agent per STRIDE letter (S, T, R, I, D, E) across the whole system.
  • Attack-tree sub-branches: each first-level OR branch is independent.
  • Trust-boundary deep dives: one sub-agent per boundary.
  • OpenAPI operation analysis: batch operations across sub-agents (e.g., by tag).
  • Control-catalog mapping: per finding.

Sequential (do not parallelize):

  • DFD construction → threat enumeration (you need the DFD first).
  • Threat enumeration → prioritization (need the full list to rank).
  • Mitigation design → residual-risk assessment.
  • Top-threat selection → attack-tree construction.

Sub-Agent Delegation

Recommended patterns:

Pattern Sub-agents When
Per STRIDE category 6 (S, T, R, I, D, E) Comprehensive enumeration on a whole system — each sub-agent focuses adversarial reasoning on one category across all elements.
Per trust boundary 1 per boundary Deep dive on multi-zone systems; each sub-agent owns cross-boundary threats for their boundary.
Per subsystem 1 per service / component Microservice architectures — each sub-agent threat-models its service, then a merge step deduplicates.
Per attack-tree branch 1 per first-level OR child Parallel tree expansion.
Per OpenAPI tag group 1 per tag Large specs — shard operations by tag.

Always define a merger agent that deduplicates findings (same threat surfaced by multiple sub-agents) and reconciles inconsistent risk scores.

Reasoning Budget

Extended thinking is the whole point of this skill. Threat identification is an adversarial creativity task — models consistently miss threats when run without extended thinking.

Extended thinking ON for:

  • Initial threat enumeration (per-element and per-interaction)
  • Trust-boundary crossing analysis
  • Attack-tree branch generation (step 2 of workflows/attack_tree_from_threat.md)
  • Leaf annotation — accurate probability/cost estimation
  • Finding novel abuse cases the documentation doesn't mention
  • Deciding when the architecture is ambiguous vs attestable

Extended thinking OFF for:

  • Formatting findings into schemas/finding.json
  • Emitting Mermaid from a known DFD structure
  • Looking up control IDs (references/control_catalogs.md is deterministic)
  • Report assembly from template

Budget guidance: allocate ~70% of extended-thinking tokens to enumeration, ~20% to attack-tree depth, ~10% to prioritization / control-gap analysis.

Multimodal Hooks

  • Diagrams in → Mermaid out: when given an architecture-diagram image, re-emit as Mermaid before analysis (catches ambiguity; produces re-usable artefact).
  • DFDs out → Mermaid: default rendering format. Inline-renders in most chat surfaces.
  • Complex diagrams (deployment views, many components): use PlantUML (@startuml) or Graphviz DOT.
  • Attack trees: Graphviz or Mermaid flowchart TD.
  • Template gallery: see examples/mermaid_dfd_templates.md for ready-to-adapt diagrams.

Structured Output

All threats conform to schemas/finding.json. Key fields:

  • threat_id, title, description
  • stride_category (array of six enum values)
  • element (name, type, technology)
  • trust_boundary
  • attack_vector, attacker_profile
  • likelihood, impact, risk_score
  • dread_score (object with D/R/E/A/D + average)
  • cwe, capec, mitre_attack
  • mitigations (array with control/type/status)
  • control_mappings (array mapping to NIST/CIS/ASVS/ISO/PCI)
  • residual_risk, status

Emit as JSONL for bulk findings; emit in the report template for human review.

Workflow Index

Workflow Purpose
workflows/dfd_creation.md Build Level-0/Level-1 DFD as Mermaid; identify trust boundaries.
workflows/stride_from_openapi.md Key workflow. OpenAPI/AsyncAPI spec → STRIDE-per-interaction table.
workflows/stride_from_arch_docs.md Architecture docs (+ optional diagram images) → full threat model.
workflows/attack_tree_from_threat.md High-level threat → concrete attack tree, cheapest-path analysis.
workflows/threat_to_mitigation.md Findings → mitigations + NIST/CIS/ASVS control IDs.

Methodology Index

File When
methodology/stride.md Default. Per-element and per-interaction.
methodology/pasta.md Regulated / business-aligned; 7 stages.
methodology/attack_trees.md Single-goal deep dive; AND/OR decomposition.
methodology/dread.md Quick scoring; includes critiques and alternatives.
methodology/linddun.md Privacy-focused (GDPR/CCPA/HIPAA).
methodology/octave.md Enterprise-wide, asset-driven.

References Index

File Contents
references/control_catalogs.md NIST CSF 2.0, 800-53 Rev 5, CIS v8, OWASP ASVS v5, ISO 27001, PCI DSS v4.
references/trust_boundary_patterns.md 12 common boundary patterns + weaknesses.
references/framework_comparison.md Pick-your-methodology decision matrix.

Examples Index

File Contents
examples/mermaid_dfd_templates.md 6+ ready-to-adapt DFD templates.
examples/stride_threat_library.md Pre-built threats per STRIDE × element type.
examples/attack_tree_banking.md Fully worked attack tree: unauthorized money transfer.
examples/bounty_patterns_2024_2026.md STRIDE-per-element addendum digesting 38 post-2023 public bug-bounty patterns.

Templates Index

File Contents
templates/threat_model_report.md Full report skeleton.
templates/stride_table.md STRIDE-per-element and per-interaction tables.

Tools

Tool Purpose Install
OWASP Threat Dragon DFD + STRIDE auto-suggestion npm install -g owasp-threat-dragon
Microsoft Threat Modeling Tool Windows-native STRIDE + DFD Download from MS
Threagile Threat modeling as code (YAML) Docker image threagile/threagile
draw.io / diagrams.net Manual DFD editing Web app or desktop
Mermaid CLI (mmdc) Render Mermaid to SVG/PNG npm install -g @mermaid-js/mermaid-cli
Graphviz Attack trees, DOT rendering apt install graphviz / brew install graphviz
PlantUML Complex diagrams apt install plantuml

Last Validated

2026-04. Reference catalogs: NIST CSF 2.0, NIST 800-53 Rev 5, CIS Controls v8, OWASP ASVS v5, PCI DSS v4.0, ISO/IEC 27001:2022.