[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6CD3E2KTTMNSWXRJAAZA7D1":3,"skill-same:01M6CD3E2KTTMNSWXRJAAZA7D1":113},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":18,"publishedAt":37,"linkOnly":38,"markdownContent":39,"markdownBody":40,"frontMatter":41,"refName":48,"commitSha":49,"skillDirectory":50,"forksCount":14,"repositoryHtmlUrl":51,"repositoryHomepageUrl":6,"ownerHtmlUrl":52,"ownerBlogUrl":6,"ownerDescription":6,"updatedAt":53,"install":54,"resources":67},"01M6CD3E2KTTMNSWXRJAAZA7D1","threat-modeling",null,"Structured security analysis using OWASP Four-Question Framework and STRIDE methodology. Generates threat matrices with risk ratings, mitigations, and prioritization. Use for attack surface analysis, security architecture review, or when asking what can go wrong.","loriensleafs\u002Fbrain","loriensleafs","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F315385?v=4","01M6CCYZETMCJPTHNS258YRCBC","Peter Kloss","01M6CCYZK25T8516A39S9PCJT7",0,"MIT","https:\u002F\u002Fgithub.com\u002Floriensleafs\u002Fbrain\u002Fblob\u002Fmain\u002Ftemplates\u002Fskills\u002Fthreat-modeling\u002FSKILL.md",[],[19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36],"threat","threat modeling","owasp","use","question","architect","prioritization","stride","analysis","risk","review","methodology","framework","security analysis","architecture review","architecture","security","go","2026-11-10 10:12:30",false,"---\nname: threat-modeling\ndescription: Structured security analysis using OWASP Four-Question Framework and STRIDE methodology. Generates threat matrices with risk ratings, mitigations, and prioritization. Use for attack surface analysis, security architecture review, or when asking what can go wrong.\nlicense: MIT\nagents:\n  - security\n  - architect\n  - analyst\nmodel: claude-sonnet-4-6\nmetadata:\n  version: 1.0.0\n  timelessness: 9\u002F10\n---\n\n# Threat Modeling\n\nSystematic identification, documentation, and mitigation of security threats.\n\n## Triggers\n\n| Phrase | Context |\n|--------|---------|\n| `threat model` | Starting or updating a threat model |\n| `attack surface analysis` | Identifying exposure points |\n| `security architecture review` | Reviewing design for vulnerabilities |\n| `STRIDE analysis` | Applying STRIDE methodology |\n| `what can go wrong` | Brainstorming security concerns |\n\n## Quick Reference\n\n| Input | Output | Destination |\n|-------|--------|-------------|\n| Architecture diagram or description | Threat matrix with STRIDE categories | `.agents\u002Fsecurity\u002Fthreat-models\u002F` |\n| Component list | Trust boundary analysis | `.agents\u002Fsecurity\u002Fthreat-models\u002F` |\n| Data flow description | Data flow diagram threats | `.agents\u002Fsecurity\u002Fthreat-models\u002F` |\n| Prior threat model | Updated model with delta analysis | `.agents\u002Fsecurity\u002Fthreat-models\u002F` |\n\n---\n\n## Process Overview\n\n```text\n                         OWASP Four-Question Framework\n                         =============================\n\n          Q1: What are we        Q2: What can         Q3: What do we      Q4: Did we do\n          working on?            go wrong?            do about it?        a good job?\n               |                      |                    |                   |\n               v                      v                    v                   v\n        +-----------+          +------------+        +-----------+       +----------+\n        | Phase 1   |          | Phase 2    |        | Phase 3   |       | Phase 4  |\n        | Scope &   |  ----->  | Threat     | -----> | Mitigation| ----> | Validate |\n        | Decompose |          | Identify   |        | Strategy  |       | Model    |\n        +-----------+          +------------+        +-----------+       +----------+\n              |                      |                    |                   |\n              v                      v                    v                   v\n        Trust Boundaries       STRIDE Matrix         Prioritized         Threat Model\n        Data Flows             Kill Chains           Mitigations         Document\n        Assets                 Attack Trees          Risk Ratings\n```\n\n---\n\n## When to Use\n\nUse this skill when:\n\n- Designing new features that handle sensitive data or authentication\n- Reviewing architecture for security vulnerabilities\n- After a security incident to identify additional attack vectors\n- Before a security audit to prepare documentation\n\nUse [security-detection](..\u002Fsecurity-detection\u002FSKILL.md) instead when:\n\n- Detecting security-critical file changes in a PR (automated scanning)\n\nUse [pre-mortem](..\u002Fpre-mortem\u002FSKILL.md) instead when:\n\n- Identifying general project risks, not specifically security threats\n\n---\n\n## Phase 1: Scope and Decompose\n\n> OWASP Q1: What are we working on?\n\n### 1.1 Define Scope\n\nDetermine what you are threat modeling:\n\n| Scope Level | Examples | Typical Depth |\n|-------------|----------|---------------|\n| **Sprint** | Single feature, API endpoint | 1-2 hours |\n| **Component** | Auth module, payment service | Half day |\n| **System** | Entire application | 1-2 days |\n| **Enterprise** | Multiple systems | Multi-day workshop |\n\nDocument scope in the threat model header:\n\n```markdown\n## Scope\n\n- **Subject**: [Feature\u002FComponent\u002FSystem name]\n- **Boundaries**: [What is IN scope and OUT of scope]\n- **Stakeholders**: [Who requested, who will review]\n- **Date**: [When analysis performed]\n- **Version**: [Model version for tracking changes]\n```\n\n### 1.2 Create Architecture Model\n\nChoose appropriate diagram type:\n\n| Diagram Type | Best For | Tools |\n|--------------|----------|-------|\n| **Data Flow Diagram (DFD)** | Most threat models | Mermaid, draw.io |\n| **Component Diagram** | Service boundaries | Mermaid, PlantUML |\n| **Sequence Diagram** | Auth\u002Fdata flows | Mermaid |\n| **Deployment Diagram** | Infrastructure threats | Mermaid |\n\n**Required DFD Elements:**\n\n```text\n+----------+     HTTPS      +----------+     SQL       +----------+\n| External | -------------> |  Process | ------------> |  Data    |\n|  Entity  |                |          |               |  Store   |\n+----------+                +----------+               +----------+\n     |                           |\n     |     Trust Boundary        |\n     +---------------------------+\n```\n\n- **External Entities**: Users, third-party systems (outside your control)\n- **Processes**: Code that transforms data (your application)\n- **Data Stores**: Databases, files, caches (where data persists)\n- **Data Flows**: Arrows showing data movement (labeled with protocol)\n- **Trust Boundaries**: Dashed lines showing privilege changes\n\n### 1.3 Identify Assets\n\nList what attackers want:\n\n| Asset Category | Examples |\n|----------------|----------|\n| **Data** | PII, credentials, financial, health |\n| **Compute** | CPU cycles, storage, network bandwidth |\n| **Access** | Admin privileges, API keys, tokens |\n| **Reputation** | Brand trust, user confidence |\n| **Availability** | Service uptime, response time |\n\n### 1.4 Map Trust Boundaries\n\nIdentify where privilege levels change:\n\n- Network boundaries (internet to internal)\n- Process boundaries (user to kernel)\n- Authentication boundaries (anonymous to authenticated)\n- Authorization boundaries (user to admin)\n\n---\n\n## Phase 2: Threat Identification\n\n> OWASP Q2: What can go wrong?\n\n### 2.1 Apply STRIDE per Element\n\nFor each element in your diagram, apply STRIDE:\n\n| Category | Definition | Applies To | Example Questions |\n|----------|------------|------------|-------------------|\n| **S**poofing | Pretending to be someone else | External entities, data flows | Can an attacker impersonate a user? |\n| **T**ampering | Modifying data or code | Processes, data stores, data flows | Can data be modified in transit\u002Fat rest? |\n| **R**epudiation | Denying an action | Processes | Can users deny performing actions? |\n| **I**nfo Disclosure | Exposing information | Data stores, data flows | Can sensitive data leak? |\n| **D**enial of Service | Making service unavailable | Processes, data stores | Can resources be exhausted? |\n| **E**levation of Privilege | Gaining unauthorized access | Processes | Can users escalate privileges? |\n\n**STRIDE Applicability Matrix:**\n\n| Element Type | S | T | R | I | D | E |\n|--------------|---|---|---|---|---|---|\n| External Entity | X | | | | | |\n| Process | X | X | X | X | X | X |\n| Data Store | | X | | X | X | |\n| Data Flow | | X | | X | X | |\n\n### 2.2 Build Threat Matrix\n\nUse the generate script to create a structured matrix:\n\n```bash\nbun run ${CLAUDE_SKILL_DIR}\u002Fscripts\u002Fgenerate_threat_matrix.ts \\\n    --scope \"Authentication Service\" \\\n    --output .agents\u002Fsecurity\u002Fthreat-models\u002Fauth-threats.md\n```\n\n**Manual Format:**\n\n```markdown\n## Threat Matrix\n\n| ID | Element | STRIDE | Threat | Likelihood | Impact | Risk |\n|----|---------|--------|--------|------------|--------|------|\n| T001 | Login API | S | Credential stuffing | High | High | Critical |\n| T002 | Session Store | T | Session fixation | Medium | High | High |\n| T003 | Audit Log | R | Log tampering | Low | Medium | Medium |\n```\n\n### 2.3 Advanced Analysis (Optional)\n\nFor complex threats, use advanced techniques like attack trees and kill chains. See [references\u002Fadvanced-analysis.md](references\u002Fadvanced-analysis.md).\n\n---\n\n## Phase 3: Mitigation Strategy\n\n> OWASP Q3: What are we going to do about it?\n\n### 3.1 Risk Rating\n\nCalculate risk for prioritization:\n\n```text\nRisk = Likelihood x Impact\n\nLikelihood Scale:\n  High (3)   = Exploitable with public tools, no auth required\n  Medium (2) = Requires some skill or access\n  Low (1)    = Requires significant effort or insider access\n\nImpact Scale:\n  High (3)   = Data breach, system compromise, regulatory violation\n  Medium (2) = Limited data exposure, service degradation\n  Low (1)    = Minor inconvenience, no sensitive data\n```\n\n**Risk Matrix:**\n\n|              | Impact: Low | Impact: Medium | Impact: High |\n|--------------|-------------|----------------|--------------|\n| **High** Likelihood | Medium | High | Critical |\n| **Medium** Likelihood | Low | Medium | High |\n| **Low** Likelihood | Low | Low | Medium |\n\n### 3.2 Select Mitigation Strategy\n\n| Strategy | When to Use | Example |\n|----------|-------------|---------|\n| **Mitigate** | Risk can be reduced to acceptable level | Add input validation |\n| **Accept** | Cost of mitigation exceeds risk | Low-impact, unlikely threat |\n| **Transfer** | Someone else can manage risk better | Cyber insurance, third-party service |\n| **Eliminate** | Remove the vulnerable component | Drop unused feature |\n\n### 3.3 Document Mitigations\n\nFor each threat, document:\n\n```markdown\n### T001: Credential Stuffing on Login API\n\n**Risk**: Critical (High Likelihood x High Impact)\n\n**Mitigations**:\n\n1. **Implement rate limiting** (Mitigate)\n   - Max 5 attempts per IP per minute\n   - Progressive delays after failures\n   - Status: Planned for Sprint 23\n\n2. **Add CAPTCHA after failures** (Mitigate)\n   - Trigger after 3 failed attempts\n   - Status: In progress\n\n3. **Enable MFA** (Mitigate)\n   - TOTP or WebAuthn\n   - Status: Blocked on product decision\n\n**Residual Risk**: Medium (after mitigations applied)\n```\n\n### 3.4 Generate Mitigation Roadmap\n\n```bash\nbun run ${CLAUDE_SKILL_DIR}\u002Fscripts\u002Fgenerate_mitigation_roadmap.ts \\\n    --input .agents\u002Fsecurity\u002Fthreat-models\u002Fauth-threats.md \\\n    --output .agents\u002Fsecurity\u002Fthreat-models\u002Fauth-roadmap.md\n```\n\n---\n\n## Phase 4: Validation\n\n> OWASP Q4: Did we do a good job?\n\n### 4.1 Model Validation\n\nRun the validation script:\n\n```bash\nbun run ${CLAUDE_SKILL_DIR}\u002Fscripts\u002Fvalidate_threat_model.ts \\\n    .agents\u002Fsecurity\u002Fthreat-models\u002Fauth-threats.md\n```\n\n**Validation Checks:**\n\n- [ ] All components have at least one threat identified\n- [ ] All trust boundaries are crossed by at least one data flow\n- [ ] All STRIDE categories considered for applicable elements\n- [ ] All Critical\u002FHigh risks have mitigations planned\n- [ ] No orphaned threats (threats without parent component)\n\n### 4.2 Peer Review\n\nRequest review from:\n\n- Security team member\n- Architect familiar with the system\n- Developer implementing mitigations\n\n### 4.3 Schedule Updates\n\nThreat models are living documents. Update when:\n\n- New features added\n- Architecture changes\n- Security incident occurs\n- During regular security reviews (quarterly recommended)\n\n---\n\n## Scripts\n\n| Script | Purpose | Usage |\n|--------|---------|-------|\n| `generate_threat_matrix.ts` | Create structured threat matrix | `bun run scripts\u002Fgenerate_threat_matrix.ts --scope \"Name\" --output path.md` |\n| `generate_mitigation_roadmap.ts` | Create prioritized roadmap | `bun run scripts\u002Fgenerate_mitigation_roadmap.ts --input threats.md --output roadmap.md` |\n| `validate_threat_model.ts` | Validate model completeness | `bun run scripts\u002Fvalidate_threat_model.ts \u003Cmodel.md>` |\n\n### Exit Codes\n\n| Code | Meaning |\n|------|---------|\n| 0 | Success \u002F Validation passed |\n| 1 | General failure |\n| 10 | Validation failed (missing required elements) |\n\n---\n\n## Templates\n\n### Threat Model Document\n\nUse the template at: `templates\u002Fthreat-model-template.md`\n\n### Threat Entry\n\n```markdown\n### T{NNN}: {Threat Title}\n\n**Element**: {Component name from DFD}\n**STRIDE**: {S\u002FT\u002FR\u002FI\u002FD\u002FE}\n**Description**: {What the threat is}\n\n**Attack Scenario**:\n1. Attacker does X\n2. System responds with Y\n3. Attacker achieves Z\n\n**Likelihood**: {High\u002FMedium\u002FLow} - {Justification}\n**Impact**: {High\u002FMedium\u002FLow} - {Justification}\n**Risk**: {Critical\u002FHigh\u002FMedium\u002FLow}\n\n**Mitigations**:\n- [ ] {Mitigation 1} - {Status}\n- [ ] {Mitigation 2} - {Status}\n\n**Residual Risk**: {After mitigations}\n**References**: {CVEs, OWASP links, etc.}\n```\n\n---\n\n## Integration with Agent System\n\n### Related Agents\n\n| Agent | Relationship |\n|-------|--------------|\n| **security** | Invoke for detailed vulnerability analysis |\n| **architect** | Review threat model during design |\n| **analyst** | Research specific attack patterns |\n| **qa** | Include threat scenarios in test strategy |\n\n### Memory Integration\n\nQuery Brain memory for prior threat models:\n\n```text\nmcp__plugin____brain__search({ query: \"threat model authentication\", folder: \"security\" })\n```\n\nStore threat model summaries:\n\n```text\nmcp__plugin____brain__write_note({\n  title: \"SEC-001 Auth Service Threat Model Summary\",\n  content: \"Key threats: credential stuffing, session hijacking...\",\n  folder: \"security\"\n})\n```\n\n---\n\n## Anti-Patterns\n\n| Avoid | Why | Instead |\n|-------|-----|---------|\n| Threat model once and forget | Security landscape evolves | Schedule regular updates |\n| Skip trust boundary analysis | Miss privilege escalation paths | Always map boundaries first |\n| Generic threats only | Not actionable | Be specific to your system |\n| No risk ratings | Cannot prioritize | Rate every threat |\n| Mitigations without owners | Never implemented | Assign owners and deadlines |\n| Copy-paste from templates | Miss system-specific threats | Use templates as starting points |\n\n---\n\n## References\n\n- [OWASP Threat Modeling](https:\u002F\u002Fowasp.org\u002Fwww-community\u002FThreat_Modeling)\n- [Microsoft STRIDE](https:\u002F\u002Fdocs.microsoft.com\u002Fen-us\u002Fazure\u002Fsecurity\u002Fdevelop\u002Fthreat-modeling-tool-threats)\n- [Attack Trees (Schneier)](https:\u002F\u002Fwww.schneier.com\u002Facademic\u002Farchives\u002F1999\u002F12\u002Fattack_trees.html)\n- [Lockheed Martin Cyber Kill Chain](https:\u002F\u002Fwww.lockheedmartin.com\u002Fen-us\u002Fcapabilities\u002Fcyber\u002Fcyber-kill-chain.html)\n\n---\n\n## Verification\n\n### Success Criteria\n\n| Criterion | Verification |\n|-----------|--------------|\n| All components have threats | Validation script check |\n| All STRIDE categories considered | Validation script check |\n| All Critical\u002FHigh risks have mitigations | Validation script check |\n| Risk ratings consistent | Manual review |\n| Peer review completed | Stakeholder sign-off |\n\n### Verification Command\n\n```bash\nbun run ${CLAUDE_SKILL_DIR}\u002Fscripts\u002Fvalidate_threat_model.ts \u003Cmodel.md>\n```\n\nExit code 0 indicates a valid, complete threat model.\n\n---\n\n## Extension Points\n\n| Extension | How to Add |\n|-----------|------------|\n| Custom STRIDE questions | Add to `references\u002Fstride-methodology.md` |\n| New risk rating methodology | Add to `references\u002Frisk-rating-guide.md` |\n| Additional threat categories | Extend STRIDE sections in template |\n| Custom validation rules | Modify `validate_threat_model.ts` |\n| Integration with SAST tools | Add script in `scripts\u002F` |\n\n---\n\n## Related Skills\n\n| Skill | Relationship |\n|-------|--------------|\n| `security-detection` | Triggers threat model review on sensitive file changes |\n| `codeql-scan` | Validates code against identified threats |\n| `adr-review` | Security agent reviews architecture decisions |\n","# Threat Modeling\n\nSystematic identification, documentation, and mitigation of security threats.\n\n## Triggers\n\n| Phrase | Context |\n|--------|---------|\n| `threat model` | Starting or updating a threat model |\n| `attack surface analysis` | Identifying exposure points |\n| `security architecture review` | Reviewing design for vulnerabilities |\n| `STRIDE analysis` | Applying STRIDE methodology |\n| `what can go wrong` | Brainstorming security concerns |\n\n## Quick Reference\n\n| Input | Output | Destination |\n|-------|--------|-------------|\n| Architecture diagram or description | Threat matrix with STRIDE categories | `.agents\u002Fsecurity\u002Fthreat-models\u002F` |\n| Component list | Trust boundary analysis | `.agents\u002Fsecurity\u002Fthreat-models\u002F` |\n| Data flow description | Data flow diagram threats | `.agents\u002Fsecurity\u002Fthreat-models\u002F` |\n| Prior threat model | Updated model with delta analysis | `.agents\u002Fsecurity\u002Fthreat-models\u002F` |\n\n---\n\n## Process Overview\n\n```text\n                         OWASP Four-Question Framework\n                         =============================\n\n          Q1: What are we        Q2: What can         Q3: What do we      Q4: Did we do\n          working on?            go wrong?            do about it?        a good job?\n               |                      |                    |                   |\n               v                      v                    v                   v\n        +-----------+          +------------+        +-----------+       +----------+\n        | Phase 1   |          | Phase 2    |        | Phase 3   |       | Phase 4  |\n        | Scope &   |  ----->  | Threat     | -----> | Mitigation| ----> | Validate |\n        | Decompose |          | Identify   |        | Strategy  |       | Model    |\n        +-----------+          +------------+        +-----------+       +----------+\n              |                      |                    |                   |\n              v                      v                    v                   v\n        Trust Boundaries       STRIDE Matrix         Prioritized         Threat Model\n        Data Flows             Kill Chains           Mitigations         Document\n        Assets                 Attack Trees          Risk Ratings\n```\n\n---\n\n## When to Use\n\nUse this skill when:\n\n- Designing new features that handle sensitive data or authentication\n- Reviewing architecture for security vulnerabilities\n- After a security incident to identify additional attack vectors\n- Before a security audit to prepare documentation\n\nUse [security-detection](..\u002Fsecurity-detection\u002FSKILL.md) instead when:\n\n- Detecting security-critical file changes in a PR (automated scanning)\n\nUse [pre-mortem](..\u002Fpre-mortem\u002FSKILL.md) instead when:\n\n- Identifying general project risks, not specifically security threats\n\n---\n\n## Phase 1: Scope and Decompose\n\n> OWASP Q1: What are we working on?\n\n### 1.1 Define Scope\n\nDetermine what you are threat modeling:\n\n| Scope Level | Examples | Typical Depth |\n|-------------|----------|---------------|\n| **Sprint** | Single feature, API endpoint | 1-2 hours |\n| **Component** | Auth module, payment service | Half day |\n| **System** | Entire application | 1-2 days |\n| **Enterprise** | Multiple systems | Multi-day workshop |\n\nDocument scope in the threat model header:\n\n```markdown\n## Scope\n\n- **Subject**: [Feature\u002FComponent\u002FSystem name]\n- **Boundaries**: [What is IN scope and OUT of scope]\n- **Stakeholders**: [Who requested, who will review]\n- **Date**: [When analysis performed]\n- **Version**: [Model version for tracking changes]\n```\n\n### 1.2 Create Architecture Model\n\nChoose appropriate diagram type:\n\n| Diagram Type | Best For | Tools |\n|--------------|----------|-------|\n| **Data Flow Diagram (DFD)** | Most threat models | Mermaid, draw.io |\n| **Component Diagram** | Service boundaries | Mermaid, PlantUML |\n| **Sequence Diagram** | Auth\u002Fdata flows | Mermaid |\n| **Deployment Diagram** | Infrastructure threats | Mermaid |\n\n**Required DFD Elements:**\n\n```text\n+----------+     HTTPS      +----------+     SQL       +----------+\n| External | -------------> |  Process | ------------> |  Data    |\n|  Entity  |                |          |               |  Store   |\n+----------+                +----------+               +----------+\n     |                           |\n     |     Trust Boundary        |\n     +---------------------------+\n```\n\n- **External Entities**: Users, third-party systems (outside your control)\n- **Processes**: Code that transforms data (your application)\n- **Data Stores**: Databases, files, caches (where data persists)\n- **Data Flows**: Arrows showing data movement (labeled with protocol)\n- **Trust Boundaries**: Dashed lines showing privilege changes\n\n### 1.3 Identify Assets\n\nList what attackers want:\n\n| Asset Category | Examples |\n|----------------|----------|\n| **Data** | PII, credentials, financial, health |\n| **Compute** | CPU cycles, storage, network bandwidth |\n| **Access** | Admin privileges, API keys, tokens |\n| **Reputation** | Brand trust, user confidence |\n| **Availability** | Service uptime, response time |\n\n### 1.4 Map Trust Boundaries\n\nIdentify where privilege levels change:\n\n- Network boundaries (internet to internal)\n- Process boundaries (user to kernel)\n- Authentication boundaries (anonymous to authenticated)\n- Authorization boundaries (user to admin)\n\n---\n\n## Phase 2: Threat Identification\n\n> OWASP Q2: What can go wrong?\n\n### 2.1 Apply STRIDE per Element\n\nFor each element in your diagram, apply STRIDE:\n\n| Category | Definition | Applies To | Example Questions |\n|----------|------------|------------|-------------------|\n| **S**poofing | Pretending to be someone else | External entities, data flows | Can an attacker impersonate a user? |\n| **T**ampering | Modifying data or code | Processes, data stores, data flows | Can data be modified in transit\u002Fat rest? |\n| **R**epudiation | Denying an action | Processes | Can users deny performing actions? |\n| **I**nfo Disclosure | Exposing information | Data stores, data flows | Can sensitive data leak? |\n| **D**enial of Service | Making service unavailable | Processes, data stores | Can resources be exhausted? |\n| **E**levation of Privilege | Gaining unauthorized access | Processes | Can users escalate privileges? |\n\n**STRIDE Applicability Matrix:**\n\n| Element Type | S | T | R | I | D | E |\n|--------------|---|---|---|---|---|---|\n| External Entity | X | | | | | |\n| Process | X | X | X | X | X | X |\n| Data Store | | X | | X | X | |\n| Data Flow | | X | | X | X | |\n\n### 2.2 Build Threat Matrix\n\nUse the generate script to create a structured matrix:\n\n```bash\nbun run ${CLAUDE_SKILL_DIR}\u002Fscripts\u002Fgenerate_threat_matrix.ts \\\n    --scope \"Authentication Service\" \\\n    --output .agents\u002Fsecurity\u002Fthreat-models\u002Fauth-threats.md\n```\n\n**Manual Format:**\n\n```markdown\n## Threat Matrix\n\n| ID | Element | STRIDE | Threat | Likelihood | Impact | Risk |\n|----|---------|--------|--------|------------|--------|------|\n| T001 | Login API | S | Credential stuffing | High | High | Critical |\n| T002 | Session Store | T | Session fixation | Medium | High | High |\n| T003 | Audit Log | R | Log tampering | Low | Medium | Medium |\n```\n\n### 2.3 Advanced Analysis (Optional)\n\nFor complex threats, use advanced techniques like attack trees and kill chains. See [references\u002Fadvanced-analysis.md](references\u002Fadvanced-analysis.md).\n\n---\n\n## Phase 3: Mitigation Strategy\n\n> OWASP Q3: What are we going to do about it?\n\n### 3.1 Risk Rating\n\nCalculate risk for prioritization:\n\n```text\nRisk = Likelihood x Impact\n\nLikelihood Scale:\n  High (3)   = Exploitable with public tools, no auth required\n  Medium (2) = Requires some skill or access\n  Low (1)    = Requires significant effort or insider access\n\nImpact Scale:\n  High (3)   = Data breach, system compromise, regulatory violation\n  Medium (2) = Limited data exposure, service degradation\n  Low (1)    = Minor inconvenience, no sensitive data\n```\n\n**Risk Matrix:**\n\n|              | Impact: Low | Impact: Medium | Impact: High |\n|--------------|-------------|----------------|--------------|\n| **High** Likelihood | Medium | High | Critical |\n| **Medium** Likelihood | Low | Medium | High |\n| **Low** Likelihood | Low | Low | Medium |\n\n### 3.2 Select Mitigation Strategy\n\n| Strategy | When to Use | Example |\n|----------|-------------|---------|\n| **Mitigate** | Risk can be reduced to acceptable level | Add input validation |\n| **Accept** | Cost of mitigation exceeds risk | Low-impact, unlikely threat |\n| **Transfer** | Someone else can manage risk better | Cyber insurance, third-party service |\n| **Eliminate** | Remove the vulnerable component | Drop unused feature |\n\n### 3.3 Document Mitigations\n\nFor each threat, document:\n\n```markdown\n### T001: Credential Stuffing on Login API\n\n**Risk**: Critical (High Likelihood x High Impact)\n\n**Mitigations**:\n\n1. **Implement rate limiting** (Mitigate)\n   - Max 5 attempts per IP per minute\n   - Progressive delays after failures\n   - Status: Planned for Sprint 23\n\n2. **Add CAPTCHA after failures** (Mitigate)\n   - Trigger after 3 failed attempts\n   - Status: In progress\n\n3. **Enable MFA** (Mitigate)\n   - TOTP or WebAuthn\n   - Status: Blocked on product decision\n\n**Residual Risk**: Medium (after mitigations applied)\n```\n\n### 3.4 Generate Mitigation Roadmap\n\n```bash\nbun run ${CLAUDE_SKILL_DIR}\u002Fscripts\u002Fgenerate_mitigation_roadmap.ts \\\n    --input .agents\u002Fsecurity\u002Fthreat-models\u002Fauth-threats.md \\\n    --output .agents\u002Fsecurity\u002Fthreat-models\u002Fauth-roadmap.md\n```\n\n---\n\n## Phase 4: Validation\n\n> OWASP Q4: Did we do a good job?\n\n### 4.1 Model Validation\n\nRun the validation script:\n\n```bash\nbun run ${CLAUDE_SKILL_DIR}\u002Fscripts\u002Fvalidate_threat_model.ts \\\n    .agents\u002Fsecurity\u002Fthreat-models\u002Fauth-threats.md\n```\n\n**Validation Checks:**\n\n- [ ] All components have at least one threat identified\n- [ ] All trust boundaries are crossed by at least one data flow\n- [ ] All STRIDE categories considered for applicable elements\n- [ ] All Critical\u002FHigh risks have mitigations planned\n- [ ] No orphaned threats (threats without parent component)\n\n### 4.2 Peer Review\n\nRequest review from:\n\n- Security team member\n- Architect familiar with the system\n- Developer implementing mitigations\n\n### 4.3 Schedule Updates\n\nThreat models are living documents. Update when:\n\n- New features added\n- Architecture changes\n- Security incident occurs\n- During regular security reviews (quarterly recommended)\n\n---\n\n## Scripts\n\n| Script | Purpose | Usage |\n|--------|---------|-------|\n| `generate_threat_matrix.ts` | Create structured threat matrix | `bun run scripts\u002Fgenerate_threat_matrix.ts --scope \"Name\" --output path.md` |\n| `generate_mitigation_roadmap.ts` | Create prioritized roadmap | `bun run scripts\u002Fgenerate_mitigation_roadmap.ts --input threats.md --output roadmap.md` |\n| `validate_threat_model.ts` | Validate model completeness | `bun run scripts\u002Fvalidate_threat_model.ts \u003Cmodel.md>` |\n\n### Exit Codes\n\n| Code | Meaning |\n|------|---------|\n| 0 | Success \u002F Validation passed |\n| 1 | General failure |\n| 10 | Validation failed (missing required elements) |\n\n---\n\n## Templates\n\n### Threat Model Document\n\nUse the template at: `templates\u002Fthreat-model-template.md`\n\n### Threat Entry\n\n```markdown\n### T{NNN}: {Threat Title}\n\n**Element**: {Component name from DFD}\n**STRIDE**: {S\u002FT\u002FR\u002FI\u002FD\u002FE}\n**Description**: {What the threat is}\n\n**Attack Scenario**:\n1. Attacker does X\n2. System responds with Y\n3. Attacker achieves Z\n\n**Likelihood**: {High\u002FMedium\u002FLow} - {Justification}\n**Impact**: {High\u002FMedium\u002FLow} - {Justification}\n**Risk**: {Critical\u002FHigh\u002FMedium\u002FLow}\n\n**Mitigations**:\n- [ ] {Mitigation 1} - {Status}\n- [ ] {Mitigation 2} - {Status}\n\n**Residual Risk**: {After mitigations}\n**References**: {CVEs, OWASP links, etc.}\n```\n\n---\n\n## Integration with Agent System\n\n### Related Agents\n\n| Agent | Relationship |\n|-------|--------------|\n| **security** | Invoke for detailed vulnerability analysis |\n| **architect** | Review threat model during design |\n| **analyst** | Research specific attack patterns |\n| **qa** | Include threat scenarios in test strategy |\n\n### Memory Integration\n\nQuery Brain memory for prior threat models:\n\n```text\nmcp__plugin____brain__search({ query: \"threat model authentication\", folder: \"security\" })\n```\n\nStore threat model summaries:\n\n```text\nmcp__plugin____brain__write_note({\n  title: \"SEC-001 Auth Service Threat Model Summary\",\n  content: \"Key threats: credential stuffing, session hijacking...\",\n  folder: \"security\"\n})\n```\n\n---\n\n## Anti-Patterns\n\n| Avoid | Why | Instead |\n|-------|-----|---------|\n| Threat model once and forget | Security landscape evolves | Schedule regular updates |\n| Skip trust boundary analysis | Miss privilege escalation paths | Always map boundaries first |\n| Generic threats only | Not actionable | Be specific to your system |\n| No risk ratings | Cannot prioritize | Rate every threat |\n| Mitigations without owners | Never implemented | Assign owners and deadlines |\n| Copy-paste from templates | Miss system-specific threats | Use templates as starting points |\n\n---\n\n## References\n\n- [OWASP Threat Modeling](https:\u002F\u002Fowasp.org\u002Fwww-community\u002FThreat_Modeling)\n- [Microsoft STRIDE](https:\u002F\u002Fdocs.microsoft.com\u002Fen-us\u002Fazure\u002Fsecurity\u002Fdevelop\u002Fthreat-modeling-tool-threats)\n- [Attack Trees (Schneier)](https:\u002F\u002Fwww.schneier.com\u002Facademic\u002Farchives\u002F1999\u002F12\u002Fattack_trees.html)\n- [Lockheed Martin Cyber Kill Chain](https:\u002F\u002Fwww.lockheedmartin.com\u002Fen-us\u002Fcapabilities\u002Fcyber\u002Fcyber-kill-chain.html)\n\n---\n\n## Verification\n\n### Success Criteria\n\n| Criterion | Verification |\n|-----------|--------------|\n| All components have threats | Validation script check |\n| All STRIDE categories considered | Validation script check |\n| All Critical\u002FHigh risks have mitigations | Validation script check |\n| Risk ratings consistent | Manual review |\n| Peer review completed | Stakeholder sign-off |\n\n### Verification Command\n\n```bash\nbun run ${CLAUDE_SKILL_DIR}\u002Fscripts\u002Fvalidate_threat_model.ts \u003Cmodel.md>\n```\n\nExit code 0 indicates a valid, complete threat model.\n\n---\n\n## Extension Points\n\n| Extension | How to Add |\n|-----------|------------|\n| Custom STRIDE questions | Add to `references\u002Fstride-methodology.md` |\n| New risk rating methodology | Add to `references\u002Frisk-rating-guide.md` |\n| Additional threat categories | Extend STRIDE sections in template |\n| Custom validation rules | Modify `validate_threat_model.ts` |\n| Integration with SAST tools | Add script in `scripts\u002F` |\n\n---\n\n## Related Skills\n\n| Skill | Relationship |\n|-------|--------------|\n| `security-detection` | Triggers threat model review on sensitive file changes |\n| `codeql-scan` | Validates code against identified threats |\n| `adr-review` | Security agent reviews architecture decisions |\n",{"name":5,"model":42,"agents":43,"license":15,"metadata":45,"description":7},"claude-sonnet-4-6",[35,24,44],"analyst",{"version":46,"timelessness":47},"1.0.0","9\u002F10","main","2bd10cb7ca989f88dbf338b57957763718eda59b","templates\u002Fskills\u002Fthreat-modeling","https:\u002F\u002Fgithub.com\u002Floriensleafs\u002Fbrain","https:\u002F\u002Fgithub.com\u002Floriensleafs","2026-03-11 23:51:59",{"source":8,"skillName":5,"commands":55,"prompt":65,"zipAvailable":66},[56,59,62],{"tool":57,"command":58},"npx","npx skills add loriensleafs\u002Fbrain --skill threat-modeling",{"tool":60,"command":61},"bunx","bunx skills add loriensleafs\u002Fbrain --skill threat-modeling",{"tool":63,"command":64},"pnpm","pnpm dlx skills add loriensleafs\u002Fbrain --skill threat-modeling","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Floriensleafs\u002Fbrain\u002Fblob\u002Fmain\u002Ftemplates\u002Fskills\u002Fthreat-modeling\u002FSKILL.md",true,[68,73,79,83,87,93,97,101,105,109],{"path":69,"resourceType":69,"resourceTypeDesc":70,"sizeBytes":71,"sourceHtmlUrl":72},"LICENSE","许可证",1092,"https:\u002F\u002Fgithub.com\u002Fjiayaoqijia\u002Fcryptoskill\u002Fblob\u002Fmain\u002Fskills\u002Fdev-tools\u002Facprk-bench-protocol\u002FLICENSE",{"path":74,"resourceType":75,"resourceTypeDesc":76,"sizeBytes":77,"sourceHtmlUrl":78},"references\u002Fadvanced-analysis.md","REFERENCE","参考文档",1286,"https:\u002F\u002Fgithub.com\u002Floriensleafs\u002Fbrain\u002Fblob\u002Fmain\u002Ftemplates\u002Fskills\u002Fthreat-modeling\u002Freferences\u002Fadvanced-analysis.md",{"path":80,"resourceType":75,"resourceTypeDesc":76,"sizeBytes":81,"sourceHtmlUrl":82},"references\u002Frisk-rating-guide.md",4765,"https:\u002F\u002Fgithub.com\u002Floriensleafs\u002Fbrain\u002Fblob\u002Fmain\u002Ftemplates\u002Fskills\u002Fthreat-modeling\u002Freferences\u002Frisk-rating-guide.md",{"path":84,"resourceType":75,"resourceTypeDesc":76,"sizeBytes":85,"sourceHtmlUrl":86},"references\u002Fstride-methodology.md",5003,"https:\u002F\u002Fgithub.com\u002Floriensleafs\u002Fbrain\u002Fblob\u002Fmain\u002Ftemplates\u002Fskills\u002Fthreat-modeling\u002Freferences\u002Fstride-methodology.md",{"path":88,"resourceType":89,"resourceTypeDesc":90,"sizeBytes":91,"sourceHtmlUrl":92},"scripts\u002Fgenerate_mitigation_roadmap.ts","SCRIPT","脚本",7536,"https:\u002F\u002Fgithub.com\u002Floriensleafs\u002Fbrain\u002Fblob\u002Fmain\u002Ftemplates\u002Fskills\u002Fthreat-modeling\u002Fscripts\u002Fgenerate_mitigation_roadmap.ts",{"path":94,"resourceType":89,"resourceTypeDesc":90,"sizeBytes":95,"sourceHtmlUrl":96},"scripts\u002Fgenerate_threat_matrix.ts",5800,"https:\u002F\u002Fgithub.com\u002Floriensleafs\u002Fbrain\u002Fblob\u002Fmain\u002Ftemplates\u002Fskills\u002Fthreat-modeling\u002Fscripts\u002Fgenerate_threat_matrix.ts",{"path":98,"resourceType":89,"resourceTypeDesc":90,"sizeBytes":99,"sourceHtmlUrl":100},"scripts\u002Fvalidate_threat_model.ts",8904,"https:\u002F\u002Fgithub.com\u002Floriensleafs\u002Fbrain\u002Fblob\u002Fmain\u002Ftemplates\u002Fskills\u002Fthreat-modeling\u002Fscripts\u002Fvalidate_threat_model.ts",{"path":102,"resourceType":75,"resourceTypeDesc":76,"sizeBytes":103,"sourceHtmlUrl":104},"SOURCE.md",355,"https:\u002F\u002Fgithub.com\u002Fjiayaoqijia\u002Fcryptoskill\u002Fblob\u002Fmain\u002Fskills\u002Fdev-tools\u002Facprk-bench-protocol\u002FSOURCE.md",{"path":106,"resourceType":75,"resourceTypeDesc":76,"sizeBytes":107,"sourceHtmlUrl":108},"templates\u002Fthreat-model-template.md",9202,"https:\u002F\u002Fgithub.com\u002Floriensleafs\u002Fbrain\u002Fblob\u002Fmain\u002Ftemplates\u002Fskills\u002Fthreat-modeling\u002Ftemplates\u002Fthreat-model-template.md",{"path":110,"resourceType":75,"resourceTypeDesc":76,"sizeBytes":111,"sourceHtmlUrl":112},"TRUST.auto.yaml",2197,"https:\u002F\u002Fgithub.com\u002Fjiayaoqijia\u002Fcryptoskill\u002Fblob\u002Fmain\u002Fskills\u002Fdev-tools\u002Facprk-bench-protocol\u002FTRUST.auto.yaml",[114,129,146,167,191,202],{"skillNo":115,"name":116,"nameZh":6,"description":117,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":118,"categories":119,"keywords":120,"publishedAt":37},"01M6CD3KHDHPR633RVP95G4XWN","validation-authority","Treat upstream validators as authoritative. Align local config to them. Use when validation fails unexpectedly, before modifying validator behavior, or when tempted to change upstream tool code.","https:\u002F\u002Fgithub.com\u002Floriensleafs\u002Fbrain\u002Fblob\u002Fmain\u002Ftemplates\u002Fskills\u002Fvalidation-authority\u002FSKILL.md",[],[121,122,22,123,124,125,24,126,127,128],"validation authority","validation","implementer","behavior","tool","code","config","change",{"skillNo":130,"name":131,"nameZh":6,"description":132,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":133,"categories":134,"keywords":135,"publishedAt":37},"01M6CD3H29Q8FWN9YETT8YVQTS","using-brain-memory","Guidance for using Brain semantic memory effectively. Applies Zettelkasten atomic note principles with observations and relations. Use when deciding whether to query or create notes, structuring note content, or understanding the semantic knowledge graph.","https:\u002F\u002Fgithub.com\u002Floriensleafs\u002Fbrain\u002Fblob\u002Fmain\u002Ftemplates\u002Fskills\u002Fusing-forgetful-memory\u002FSKILL.md",[],[136,137,138,22,139,140,141,142,143,144,145],"memory","using brain memory","guidance","context","knowledge","knowledge graph","graph","content","create","notes",{"skillNo":147,"name":148,"nameZh":6,"description":149,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":150,"categories":151,"keywords":157,"publishedAt":37},"01M6CD3BC6G0Q2MDNW6X51XHBQ","taste-lints","Custom lints with agent-readable remediation instructions. Enforces taste invariants (file size, naming conventions, structured logging, complexity) and surfaces errors that agents can act on directly. Use when writing or reviewing code to catch style violations early.","https:\u002F\u002Fgithub.com\u002Floriensleafs\u002Fbrain\u002Fblob\u002Fmain\u002Ftemplates\u002Fskills\u002Ftaste-lints\u002FSKILL.md",[152],{"categoryNo":153,"categoryName":154,"taxonomyType":155,"taxonomyTypeDesc":156},"01JBSEEDCAT000000000000023","Skill与智能体开发","SCENARIO","使用场景",[158,159,160,22,123,161,162,163,164,126,165,166],"taste lints","remediation","complexity","instructions","file","logging","qa","writing","surfaces",{"skillNo":168,"name":169,"nameZh":6,"description":170,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":171,"categories":172,"keywords":173,"publishedAt":37},"01M6CD37Z7VD22BH42TG0GM66V","style-enforcement","Validate code against style rules from .editorconfig, StyleCop.json, and Directory.Build.props. Detects line ending violations, naming convention issues, indentation problems, and charset mismatches across C#, Python, TypeScript, and JavaScript. Produces JSON reports for pre-commit hooks and CI pipelines.","https:\u002F\u002Fgithub.com\u002Floriensleafs\u002Fbrain\u002Fblob\u002Fmain\u002Ftemplates\u002Fskills\u002Fstyle-enforcement\u002FSKILL.md",[],[174,175,123,176,177,178,179,180,181,182,183,164,184,126,185,186,187,188,189,190],"style enforcement","enforcement","json","hooks","pipelines","reports","javascript","pre-commit","editorconfig","ci","issues","validate","commit","Rules","python","typescript","directory",{"skillNo":192,"name":193,"nameZh":6,"description":194,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":195,"categories":196,"keywords":197,"publishedAt":37},"01M6CD35JW73TPMCZBF9DTDEE8","steering-matcher","Match file paths against steering file glob patterns to determine applicable steering guidance. Use when orchestrator needs to inject context-aware guidance based on files being modified.","https:\u002F\u002Fgithub.com\u002Floriensleafs\u002Fbrain\u002Fblob\u002Fmain\u002Ftemplates\u002Fskills\u002Fsteering-matcher\u002FSKILL.md",[],[198,162,199,138,200,22,201,139],"steering matcher","haiku","files","orchestrator",{"skillNo":203,"name":204,"nameZh":6,"description":205,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":206,"categories":207,"keywords":209,"publishedAt":37},"01M6CD32KG07KWP69SY6F4471S","slashcommandcreator","Autonomous meta-skill for creating high-quality custom slash commands using 5-phase workflow with multi-agent validation and quality gates. Use when user requests new slash command, reusable prompt automation, or wants to convert repetitive workflows into documented commands.","https:\u002F\u002Fgithub.com\u002Floriensleafs\u002Fbrain\u002Fblob\u002Fmain\u002Ftemplates\u002Fskills\u002Fslashcommandcreator\u002FSKILL.md",[208],{"categoryNo":153,"categoryName":154,"taxonomyType":155,"taxonomyTypeDesc":156},[204,210,211,22,123,212,213,214,215,216,217,218,24,219,122,220,221,222,223,35],"multi-agent","reusable","autonomous","user","command","prompt","quality","convert","critic","Meta","quality gates","workflows","automation","workflow"]