Data & analysis

Threat Modeling Expert

Try it

Threat modeling with STRIDE, PASTA, and attack trees. Analyze architectures for security gaps, extract security requirements, build data flow diagrams, and p...

What it does

Expert in threat modeling methodologies, security architecture review, and risk assessment. Masters STRIDE, PASTA, attack trees, and security requirement extraction. Use PROACTIVELY for security architecture reviews, threat identification, or building secure-by-design systems.

The skill document

Threat Modeling Expert

Expert in threat modeling methodologies, security architecture review, and risk assessment. Masters STRIDE, PASTA, attack trees, and security requirement extraction. Use PROACTIVELY for security architecture reviews, threat identification, or building secure-by-design systems.

Capabilities

  • STRIDE threat analysis
  • Attack tree construction
  • Data flow diagram analysis
  • Security requirement extraction
  • Risk prioritization and scoring
  • Mitigation strategy design
  • Security control mapping

Use this skill when

  • Designing new systems or features
  • Reviewing architecture for security gaps
  • Preparing for security audits
  • Identifying attack vectors
  • Prioritizing security investments
  • Creating security documentation
  • Training teams on security thinking

Do not use this skill when

  • You lack scope or authorization for security review
  • You need legal or compliance certification
  • You only need automated scanning without human review

Instructions

  1. Define system scope and trust boundaries
  2. Create data flow diagrams
  3. Identify assets and entry points
  4. Apply STRIDE to each component
  5. Build attack trees for critical paths
  6. Score and prioritize threats
  7. Design mitigations
  8. Document residual risks

Safety

  • Avoid storing sensitive details in threat models without access controls.
  • Keep threat models updated after architecture changes.

Best Practices

  • Involve developers in threat modeling sessions
  • Focus on data flows, not just components
  • Consider insider threats
  • Update threat models with architecture changes
  • Link threats to security requirements
  • Track mitigations to implementation
  • Review regularly, not just at design time

Related skills

AdMapix

Fetch raw ad creative, app, ranking, and revenue data from AdMapix as structured JSON.

by fly0pants4.3k installs296 stars

diagram-generator

Generate and edit Draw.io, Mermaid, and Excalidraw diagrams from natural language using a structured JSON spec.

by nssa.io1.0k installs47 stars

opentwitter

Query Twitter/X profiles, tweets, follower events, and KOL data through the 6551 REST API.

by infra403840 installs27 stars

security-ownership-map

Official

Map git history into a people-to-file ownership graph, flag sensitive-code risk, and export data for Neo4j or Gephi.

by OpenAI27.5k stars

plugin-creator

Official

Scaffold a Codex plugin folder with the required manifest and optional companion directories in one command.

by OpenAI27.5k stars

netlify-deploy

Official

Deploy web projects to Netlify using the Netlify CLI (`npx netlify`). Use when the user asks to deploy, host, publish, or link a site/repo on Netlify, including preview and production deploys.

by OpenAI27.5k stars

More from solomonneas

Browse all skills

Pentest Commands

Essential penetration testing command reference. Quick lookup for nmap, Metasploit, hydra, john, nikto, gobuster, and other offensive security tools. Covers...

by Solomon Neas65 installs1 stars

Memory Forensics

Memory forensics with Volatility and related tools. Acquire RAM dumps, extract processes and DLLs, investigate rootkits and fileless malware, recover credent...

by solomonneas31 installs1 stars

S³ Pentest Commands

This skill should be used when the user asks to "run pentest commands", "scan with nmap", "use metasploit exploits", "crack passwords with hydra or john", "s...

by solomonneas36 installs

Malware Analyst

Expert malware analysis for defensive security research. Static and dynamic analysis, sandbox triage, IOC extraction, unpacking, and malware family identific...

by solomonneas31 installs

Self Learning Agent

Knowledge card memory system with semantic search. Agents wake up fresh each session but remember everything through atomic ~350-token cards with YAML frontm...

by solomonneas28 installs

Wireshark Analysis

Network traffic analysis with Wireshark and tshark. Capture packets, write display and BPF filters, follow TCP/UDP/TLS streams, detect C2 beacons, troublesho...

by solomonneas27 installs