threat-model SKILL.md skillA

threat-model from qa-aman/claude-skills is an agent skill: a SKILL.md folder an AI agent loads when a task calls for it.

mdr add qa-aman/claude-skills/threat-model@git:20260303.8412b01

Pins git:20260303.8412b01 in mdr.lock. Pin the fingerprint instead.

Audit grade

A, 17 of 17 checks passed

Kind

SKILL.md skill

Repository

qa-aman/claude-skills

Path

skills/by-role/security/threat-model/SKILL.md

Versions recorded

1

Latest version

git:20260303.8412b01, committed Mar 3, 2026

Size

6,546 bytes

Repository stars

24

License

MIT

Write a threat model document. Use when the user says "threat model", "threat modeling", "STRIDE analysis", "attack surface analysis", "security design review", "what are the threats to this system", "adversarial analysis", "identify threats", "security threat assessment", or needs to systematically identify and document threats to a system or feature - even if they don't explicitly say "threat model".

Collected from public GitHub. Every version is saved exactly as it was and never changes. Install it at an exact version with the mdr tool, and every file is checked before it reaches your agent. The main file is checked against the SHA-256 fingerprint recorded here, and the others against the fingerprints GitHub keeps for its source commit. The automatic checks below grade the latest version, and the same checks always give the same file the same grade.

What the file says

## Overview

Based on **Threat Modeling: Designing for Security** (Adam Shostack). Threat modeling is structured adversarial thinking applied before code ships. Shostack's standard: the goal is not to find every bug - it's to find the worst things that can happen to your system and decide what to do about each one. A threat model is not a security audit; it is a design artifact.

STRIDE framework (Shostack):
- **S**poofing - impersonating a user or system
- **T**ampering - modifying data or code
- **R**epudiation - denying an action occurred
- **I**nformation disclosure - exposing data to unauthorized parties
- **D**enial of service - degrading or blocking availability
- **E**levation of privilege - gaining access beyond what's authorized

## Workflow

### Step 1: Define scope

```
System: [name of the system or feature being modeled]
Scope: [what is in scope - specific components, APIs, data flows]
Out of scope: [what is explicitly excluded]
Assumptions: [what we assume is already secured, e.g. OS-level security, network perimeter]
Assets: [what we're protecting]
  - [asset 1, e.g. user PII]
  - [asset 2, e.g. payment data]
  - [asset 3, e.g. service availability]
```
…

Read the whole file at its exact version.

How to install

mdr add qa-aman/claude-skills/threat-model@sha256:e482076b78aa8c4e

[![mdr](https://markdownregistry.com/badge/art_7e7bhklqord2hsy5.svg)](https://markdownregistry.com/a/art_7e7bhklqord2hsy5)

Versions

The registry has recorded 1 version of this file, committed on Mar 3, 2026.

Audit of the latest version

Source

API

GET https://markdownregistry.com/api/v1/artifacts/art_7e7bhklqord2hsy5
GET https://markdownregistry.com/api/v1/resolve?ref=qa-aman/claude-skills/threat-model
GET https://markdownregistry.com/api/v1/blob/e482076b78aa8c4ef141fd1d9b0839d5b1d9e91d071f5321ed64f80a16f82dbe

Your AI assistant does the legwork. You hear about the deals worth your word. Hand yours the standing instructions at modelranch.com and it joins the network that reads files like this one.

Guides: the SKILL.md format and its required fields · what to check before you install a skill · how to pin a skill to an exact version · where to find agent skills · keeping a team on the same skills · which agent file does what.

More from qa-aman/claude-skills

Every file in qa-aman/claude-skills

Other files named threat-model

Browse by kind, by grade A, or by owner.