[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6CTGKQJH4SBVCWFVXF3GR5K":3,"skill-same:01M6CTGKQJH4SBVCWFVXF3GR5K":59},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":18,"publishedAt":29,"linkOnly":30,"markdownContent":31,"markdownBody":32,"frontMatter":33,"refName":38,"commitSha":39,"skillDirectory":40,"forksCount":41,"repositoryHtmlUrl":42,"repositoryHomepageUrl":6,"ownerHtmlUrl":43,"ownerBlogUrl":6,"ownerDescription":44,"updatedAt":45,"install":46,"resources":58},"01M6CTGKQJH4SBVCWFVXF3GR5K","threat-modeling",null,"Analyzes data flows for security threats and proposes mitigations. Use when assessing a new feature, an architecture change or a compliance review.","vibbs\u002Fcompany-os","vibbs","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F7379149?v=4","01M6CT6M03CAS1H7RA89F3965B","Vibbs Dod","01M6CT6M4MY60C9FFQ3AAR2RSK",6,"MIT","https:\u002F\u002Fgithub.com\u002Fvibbs\u002Fcompany-os\u002Fblob\u002Fmain\u002Fos\u002Fskills\u002Fthreat-modeling\u002FSKILL.md",[],[19,20,21,22,23,24,25,26,27,28],"threat modeling","threat","review","security","change","architecture","compliance","data","new feature","use","2026-11-10 10:12:30",false,"---\nname: threat-modeling\ndescription: Analyzes data flows for security threats and proposes mitigations. Use when assessing a new feature, an architecture change or a compliance review.\nruntimes:\n  claude:\n    user-invocable: true\n    argument-hint: \"[--quick]\"\n---\n\n# Threat Modeling\n\n## Reference\n- **ID**: S-RISK-01\n- **Category**: Risk\n- **Inputs**: system architecture, data flow diagrams, trust boundaries, asset inventory\n- **Outputs**: threat model document → artifacts\u002Frisk\u002F\n- **Used by**: Ops & Risk Agent\n- **Tool scripts**: .\u002Ftools\u002Fartifact\u002Fvalidate.sh\n\n## Purpose\nProduces a structured threat model that identifies attack surfaces, enumerates threats using a systematic methodology (STRIDE), and maps each threat to concrete mitigations, ensuring security is considered proactively rather than reactively.\n\n## Procedure\n\n### Step 0: Stage-Aware Mode Selection\n\nRead `company.stage` from `company.config.yaml`. If `idea` or `mvp`:\n\n**MVP Security Checklist** (use instead of full STRIDE):\n1. Auth provider (not roll-your-own)\n2. HTTPS enforced\n3. Input sanitization on all user-supplied fields\n4. Payment webhook signature verification (if applicable)\n5. No secrets in code (run `.\u002Ftools\u002Fsecurity\u002Fsecrets-scan.sh`)\n6. Dependency scanning configured\n\nReserve full STRIDE analysis for `growth`\u002F`scale` stages or features touching financial data\u002FPII at scale. If user passes `--quick`, always use MVP mode regardless of stage.\n\n1. Define the scope: which system, feature, or data flow is being modeled.\n2. Draw or review the data flow diagram (DFD): external entities, processes, data stores, data flows. Use the **excalidraw skill** (S-ENG-17) to produce the DFD — Mermaid `flowchart LR` with trust boundary subgraphs inline, and optionally an Excalidraw file for richer documentation.\n3. Identify trust boundaries: where data crosses between trust zones.\n4. Enumerate threats using STRIDE (Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, Elevation of Privilege) for each element.\n5. Rate each threat: likelihood (1-5) and impact (1-5), calculate risk score.\n6. For each threat, define a mitigation: preventive control, detective control, or accepted risk.\n7. Prioritize mitigations by risk score.\n8. Document residual risks: threats accepted without full mitigation.\n9. Define review triggers: when this threat model should be revisited.\n10. Save the threat model to `artifacts\u002Frisk\u002F`.\n11. Validate the artifact using `.\u002Ftools\u002Fartifact\u002Fvalidate.sh`.\n\n## Cross-References\n- **security-posture** (S-RISK-04) — aggregate view of all threat model findings across features; run `\u002Fsecurity-posture` for cross-cutting risk inventory\n- **release-readiness-gate** (S-QA-03) — consumes threat model as a required artifact for Bar 3 (Security & Risk)\n\n## Quality Checklist\n- [ ] Scope is clearly defined and bounded\n- [ ] Data flow diagram is complete with all trust boundaries\n- [ ] STRIDE analysis covers all DFD elements\n- [ ] Each threat has likelihood and impact ratings\n- [ ] Every high-risk threat has a defined mitigation\n- [ ] Residual risks are explicitly documented and accepted\n- [ ] Review triggers are specified\n- [ ] Artifact passes validation\n","# Threat Modeling\n\n## Reference\n- **ID**: S-RISK-01\n- **Category**: Risk\n- **Inputs**: system architecture, data flow diagrams, trust boundaries, asset inventory\n- **Outputs**: threat model document → artifacts\u002Frisk\u002F\n- **Used by**: Ops & Risk Agent\n- **Tool scripts**: .\u002Ftools\u002Fartifact\u002Fvalidate.sh\n\n## Purpose\nProduces a structured threat model that identifies attack surfaces, enumerates threats using a systematic methodology (STRIDE), and maps each threat to concrete mitigations, ensuring security is considered proactively rather than reactively.\n\n## Procedure\n\n### Step 0: Stage-Aware Mode Selection\n\nRead `company.stage` from `company.config.yaml`. If `idea` or `mvp`:\n\n**MVP Security Checklist** (use instead of full STRIDE):\n1. Auth provider (not roll-your-own)\n2. HTTPS enforced\n3. Input sanitization on all user-supplied fields\n4. Payment webhook signature verification (if applicable)\n5. No secrets in code (run `.\u002Ftools\u002Fsecurity\u002Fsecrets-scan.sh`)\n6. Dependency scanning configured\n\nReserve full STRIDE analysis for `growth`\u002F`scale` stages or features touching financial data\u002FPII at scale. If user passes `--quick`, always use MVP mode regardless of stage.\n\n1. Define the scope: which system, feature, or data flow is being modeled.\n2. Draw or review the data flow diagram (DFD): external entities, processes, data stores, data flows. Use the **excalidraw skill** (S-ENG-17) to produce the DFD — Mermaid `flowchart LR` with trust boundary subgraphs inline, and optionally an Excalidraw file for richer documentation.\n3. Identify trust boundaries: where data crosses between trust zones.\n4. Enumerate threats using STRIDE (Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, Elevation of Privilege) for each element.\n5. Rate each threat: likelihood (1-5) and impact (1-5), calculate risk score.\n6. For each threat, define a mitigation: preventive control, detective control, or accepted risk.\n7. Prioritize mitigations by risk score.\n8. Document residual risks: threats accepted without full mitigation.\n9. Define review triggers: when this threat model should be revisited.\n10. Save the threat model to `artifacts\u002Frisk\u002F`.\n11. Validate the artifact using `.\u002Ftools\u002Fartifact\u002Fvalidate.sh`.\n\n## Cross-References\n- **security-posture** (S-RISK-04) — aggregate view of all threat model findings across features; run `\u002Fsecurity-posture` for cross-cutting risk inventory\n- **release-readiness-gate** (S-QA-03) — consumes threat model as a required artifact for Bar 3 (Security & Risk)\n\n## Quality Checklist\n- [ ] Scope is clearly defined and bounded\n- [ ] Data flow diagram is complete with all trust boundaries\n- [ ] STRIDE analysis covers all DFD elements\n- [ ] Each threat has likelihood and impact ratings\n- [ ] Every high-risk threat has a defined mitigation\n- [ ] Residual risks are explicitly documented and accepted\n- [ ] Review triggers are specified\n- [ ] Artifact passes validation\n",{"name":5,"runtimes":34,"description":7},{"claude":35},{"argument-hint":36,"user-invocable":37},"[--quick]",true,"main","e842fb6d0e04360c47db78bc2e2e2987314d64d4","os\u002Fskills\u002Fthreat-modeling",2,"https:\u002F\u002Fgithub.com\u002Fvibbs\u002Fcompany-os","https:\u002F\u002Fgithub.com\u002Fvibbs","Principal Engineer · Applied AI · building ArcAI @ GrowthArc","2026-10-21 02:08:08",{"source":8,"skillName":5,"commands":47,"prompt":57,"zipAvailable":37},[48,51,54],{"tool":49,"command":50},"npx","npx skills add vibbs\u002Fcompany-os --skill threat-modeling",{"tool":52,"command":53},"bunx","bunx skills add vibbs\u002Fcompany-os --skill threat-modeling",{"tool":55,"command":56},"pnpm","pnpm dlx skills add vibbs\u002Fcompany-os --skill threat-modeling","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fvibbs\u002Fcompany-os\u002Fblob\u002Fmain\u002Fos\u002Fskills\u002Fthreat-modeling\u002FSKILL.md",[],[60,69,77,87,103,121],{"skillNo":61,"name":62,"nameZh":6,"description":63,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":64,"categories":65,"keywords":66,"publishedAt":29},"01M6CTHBW1E64ECYGD105N4S5E","typo-field","Fixture skill with a misspelled top-level field.","https:\u002F\u002Fgithub.com\u002Fvibbs\u002Fcompany-os\u002Fblob\u002Fmain\u002Ftests\u002Ffixtures\u002Fskills\u002Ftypo-field\u002FSKILL.md",[],[67,68],"typo field","fixture skill",{"skillNo":70,"name":71,"nameZh":6,"description":72,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":73,"categories":74,"keywords":75,"publishedAt":29},"01M6CTHABTV8FKVDHFMMKPAV51","spaced-comments","Fixture skill with comments and spaces after block keys.","https:\u002F\u002Fgithub.com\u002Fvibbs\u002Fcompany-os\u002Fblob\u002Fmain\u002Ftests\u002Ffixtures\u002Fskills\u002Fspaced-comments\u002FSKILL.md",[],[76,68],"spaced comments",{"skillNo":78,"name":79,"nameZh":6,"description":80,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":81,"categories":82,"keywords":83,"publishedAt":29},"01M6CTH8MHC14KB65ZDHYBJW1N","crlf-comments","Fixture skill with Windows line endings.","https:\u002F\u002Fgithub.com\u002Fvibbs\u002Fcompany-os\u002Fblob\u002Fmain\u002Ftests\u002Ffixtures\u002Fskills\u002Fcrlf-comments\u002FSKILL.md",[],[84,85,86,68],"crlf comments","CRLF","windows",{"skillNo":88,"name":89,"nameZh":6,"description":90,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":91,"categories":92,"keywords":93,"publishedAt":29},"01M6CTH6TBKTDP9G8QB1Z2K0TY","claude-fields","Fixture skill using top-level fields Claude Code documents.","https:\u002F\u002Fgithub.com\u002Fvibbs\u002Fcompany-os\u002Fblob\u002Fmain\u002Ftests\u002Ffixtures\u002Fskills\u002Fclaude-fields\u002FSKILL.md",[],[94,95,96,97,98,99,68,100,101,102],"claude fields","explore","documents","src","grep","read","Bash","code","testing",{"skillNo":104,"name":105,"nameZh":6,"description":106,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":107,"categories":108,"keywords":114,"publishedAt":29},"01M6CTH46BGKXH80RWS876Y2CW","workflow-router","Maps an objective to the artifacts, stages and agents it needs. Use when deciding what happens next or which agents to involve.","https:\u002F\u002Fgithub.com\u002Fvibbs\u002Fcompany-os\u002Fblob\u002Fmain\u002Fos\u002Fskills\u002Fworkflow-router\u002FSKILL.md",[109],{"categoryNo":110,"categoryName":111,"taxonomyType":112,"taxonomyTypeDesc":113},"01JBSEEDCAT000000000000023","Skill与智能体开发","SCENARIO","使用场景",[115,116,117,118,119,28,120],"workflow","router","workflow router","next","maps","artifacts",{"skillNo":122,"name":123,"nameZh":6,"description":124,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":125,"categories":126,"keywords":127,"publishedAt":29},"01M6CTH27653SRVP2FMEQN3J5B","weekly-review","Summarizes your week: what shipped, AI spend, support themes, security health and next priorities. Use at the end of each week.","https:\u002F\u002Fgithub.com\u002Fvibbs\u002Fcompany-os\u002Fblob\u002Fmain\u002Fos\u002Fskills\u002Fweekly-review\u002FSKILL.md",[],[128,21,129,118,28,130,131,132,22],"weekly review","priorities","health","save","support"]