Indexed from public GitHub and served as immutable, content-addressed versions. Install it pinned to an exact SHA-256 with the mdr CLI, and every file is verified against the hash recorded here before it reaches your agent. The deterministic audit below grades the latest version, and the same file always earns the same grade.
What the file says
# Threat Modeling — STRIDE + Agentic Threats
Guide **architecture → threat model → security review → security acceptance criteria**. Produces a STRIDE table augmented with agentic-specific threats (prompt injection, tool poisoning, excessive agency, inter-agent trust), risk-ranked with mitigations and acceptance criteria.
**Evidence-linked, portable, incremental.** Architecture discovery reuses C4/Mermaid inputs (#369); outputs feed `agentic-security-reviewer` + `owasp-agentic-review` + `security-reviewer`.
> **Sources:** Microsoft STRIDE (Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, Elevation of Privilege) + OWASP Threat Modeling + OWASP Agentic Security (prompt injection, tool poisoning, excessive agency, data leakage, insecure plugin/MCP). See https://learn.microsoft.com/en-us/azure/security/develop/threat-modeling-tool-threats and https://owasp.org/www-project-threat-model/ .
## When to use
- New system/C4 design (`architect` output), new data flow (user → agent → tool → external), new trust boundary (skill composition, MCP addition, swarm handoff)
- Before `security-reviewer` / `owasp-agentic-review` prioritizes mitigations
…
Pin to a label to follow the author's releases, or to a sha256 to freeze the exact bytes forever. Either way the resolved hash is written to mdr.lock, and mdr install reproduces it on any machine.
GET https://markdownregistry.com/api/v1/artifacts/art_irk7tzg46ltbdvtb
GET https://markdownregistry.com/api/v1/resolve?ref=ulises-jeremias/agent-toolkit/threat-modeling
GET https://markdownregistry.com/api/v1/blob/9c87fa52c71a8143f0f3138385f7ae36c49059d8751c8f3edbafd03b125d7489
Your agent does the legwork. You hear about the deals worth your word. Hand yours the standing instructions at modelranch.com and it joins the network that reads files like this one.
ulises-jeremias/agent-toolkit · plugins/agent-toolkit-complete/.github/skills/adr/SKILL.md · WHAT — Create and maintain Architecture Decision Records (ADRs) per the process. Covers when
ulises-jeremias/agent-toolkit · plugins/agent-toolkit-complete/.github/skills/blast-radius/SKILL.md · Find what a change could break somewhere else before it ships, beyond the diff, and prove the one fact it's safe…
ulises-jeremias/agent-toolkit · plugins/agent-toolkit-complete/.github/skills/bug/SKILL.md · WHAT - Draft and review bugs using the Bug Template; classifies whether an issue should be
ulises-jeremias/agent-toolkit · plugins/agent-toolkit-complete/.github/skills/c4-model/SKILL.md · WHAT — C4 model methodology (Context, Container, Component, Code) guidance — what to draw at each level, when, and how…
ulises-jeremias/agent-toolkit · plugins/agent-toolkit-complete/.github/skills/chrome-devtools/SKILL.md · Use Chrome DevTools MCP to control and inspect a live Chrome instance for network, console, performance, rendering, and…
miosa-osa/osa · priv/skills/threat-modeling/SKILL.md · Build a concrete cyber defense threat model from assets, data flows and trust boundaries, then map controls to attack…
timwukp/agent-skills-best-practice · skills/skills/threat-modeling/SKILL.md · Performs STRIDE threat modeling for features, APIs, and architecture changes, producing a threat model document with…
cristhianzl/claude-skills-czl · configs/langflow/skills/threat-modeling/SKILL.md · Structured security design analysis — find what can go wrong before an attacker does. Build a Data Flow Diagram with…
cristhianzl/claude-skills-czl · configs/agnostic/skills/threat-modeling/SKILL.md · Structured security design analysis — find what can go wrong before an attacker does. Build a Data Flow Diagram with…
okhp3/skillz · community/threat-modeling/SKILL.md · Works out what could go wrong in a system's design before it is built — who would attack it, how, and which defences…
aniruddhadas1/oniroute_swarmagents · skills/official/security/threat-modeling/SKILL.md · Identify assets, trust boundaries, threats, and mitigations before risks become incidents. Use for planning…
