Collected from public GitHub. Every version is saved exactly as it was and never changes. Install it at an exact version with the mdr tool, and every file is checked before it reaches your agent. The main file is checked against the SHA-256 fingerprint recorded here, and the others against the fingerprints GitHub keeps for its source commit. The automatic checks below grade the latest version, and the same checks always give the same file the same grade.
What the file says
# Threat Modeling — STRIDE + Agentic Threats
Guide **architecture → threat model → security review → security acceptance criteria**. Produces a STRIDE table augmented with agentic-specific threats (prompt injection, tool poisoning, excessive agency, inter-agent trust), risk-ranked with mitigations and acceptance criteria.
**Evidence-linked, portable, incremental.** Architecture discovery reuses C4/Mermaid inputs (#369); outputs feed `agentic-security-reviewer` + `owasp-agentic-review` + `security-reviewer`.
> **Sources:** Microsoft STRIDE (Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, Elevation of Privilege) + OWASP Threat Modeling + OWASP Agentic Security (prompt injection, tool poisoning, excessive agency, data leakage, insecure plugin/MCP). See https://learn.microsoft.com/en-us/azure/security/develop/threat-modeling-tool-threats and https://owasp.org/www-project-threat-model/ .
## When to use
- New system/C4 design (`architect` output), new data flow (user → agent → tool → external), new trust boundary (skill composition, MCP addition, swarm handoff)
- Before `security-reviewer` / `owasp-agentic-review` prioritizes mitigations
…
The line at the top of this page pins the label git:20260831.856ee57, which is what most people want. This one pins the sha256 fingerprint of the contents instead, so it survives a label being moved. Either way the exact version is written to mdr.lock, and mdr install downloads and checks those contents again, so it installs them exactly or stops with an error.
GET https://markdownregistry.com/api/v1/artifacts/art_irk7tzg46ltbdvtb
GET https://markdownregistry.com/api/v1/resolve?ref=ulises-jeremias/agent-toolkit/threat-modeling
GET https://markdownregistry.com/api/v1/blob/9c87fa52c71a8143f0f3138385f7ae36c49059d8751c8f3edbafd03b125d7489
Your AI assistant does the legwork. You hear about the deals worth your word. Hand yours the standing instructions at modelranch.com and it joins the network that reads files like this one.
ulises-jeremias/agent-toolkit · plugins/agent-toolkit-complete/.github/skills/adr/SKILL.md · WHAT — Create and maintain Architecture Decision Records (ADRs) per the process. Covers when
ulises-jeremias/agent-toolkit · plugins/agent-toolkit-complete/.github/skills/blast-radius/SKILL.md · Find what a change could break somewhere else before it ships, beyond the diff, and prove
ulises-jeremias/agent-toolkit · plugins/agent-toolkit-complete/.github/skills/brag-slim/SKILL.md · Turn a project directory or a website URL into a short, shareable launch video with music, motion, and share copy. One…
ulises-jeremias/agent-toolkit · plugins/agent-toolkit-complete/.github/skills/brag/SKILL.md · Turn the current project website into a short, polished, shareable launch video using Hyperframes. Use when someone…
ulises-jeremias/agent-toolkit · plugins/agent-toolkit-complete/.github/skills/bug/SKILL.md · WHAT - Draft and review bugs using the Bug Template; classifies whether an issue should be
cbrock84/headcount · plugins/security/skills/threat-modeling/SKILL.md · Identifies what could go wrong in a system before it is built or changed — the assets worth attacking, the entry…
naodeng/awesome-qa-skills · skills/en/testing-types/threat-modeling/SKILL.md · Use this skill when you need evidence-bounded threat-modeling analysis and validation preparation; triggers include…
miosa-osa/osa · priv/skills/threat-modeling/SKILL.md · Build a concrete cyber defense threat model from assets, data flows and trust boundaries, then map controls to attack…
nahid-sparktales/agent-dispatcher · skills/security/threat-modeling/SKILL.md · Work out what is actually worth defending in this system — the trust boundaries data crosses, the assets behind them…
jpeetz/agent-skills · skills/security/threat-modeling/SKILL.md · Use this skill when performing security reviews of features, APIs, or architecture changes. Produces a STRIDE threat…
timwukp/agent-skills-best-practice · skills/skills/threat-modeling/SKILL.md · Performs STRIDE threat modeling for features, APIs, and architecture changes, producing a threat model document with…
