Use this skill when performing security reviews of features, APIs, or architecture changes. Produces a STRIDE threat model document with risk-rated threats, mitigations, and backlog-ready security stories. Use during sprint planning or design review.
Collected from public GitHub. Every version is saved exactly as it was and never changes. Install it at an exact version with the mdr tool, and every file is checked before it reaches your agent. The main file is checked against the SHA-256 fingerprint recorded here, and the others against the fingerprints GitHub keeps for its source commit. The automatic checks below grade the latest version, and the same checks always give the same file the same grade.
What the file says
# Threat Modeling (STRIDE)
## Overview
Produce a lightweight, sprint-compatible threat model: 15-30 minutes of structured analysis, not a multi-week security assessment. The output is a threat model document plus security stories the team can schedule.
## When to Use
- Designing a new feature or API endpoint
- Reviewing architecture changes
- Integrating with third-party services
- Processing personal data, payment data, or regulated data
- Sprint planning or design review sessions
- Any change that crosses a trust boundary
## Process
### 1. Establish the Data Flow
Ask for (or derive from the code/design) the feature's data flow: actors, entry points, services, data stores, and trust boundaries. Summarize it as:
```
Actor → Component || API Gateway → Service → Database
```
Mark each trust boundary crossing with `||`. If the user has architecture docs or code, read them instead of asking.
### 2. Walk the STRIDE Categories
Run each STRIDE category against every trust boundary crossing:
| # | Category | Question to Ask | Typical Mitigations |
|---|---|---|---|
…
The line at the top of this page pins the label git:20261012.4b2f1b0, which is what most people want. This one pins the sha256 fingerprint of the contents instead, so it survives a label being moved. Either way the exact version is written to mdr.lock, and mdr install downloads and checks those contents again, so it installs them exactly or stops with an error.
GET https://markdownregistry.com/api/v1/artifacts/art_oe5a2lwbwqkwkh5l
GET https://markdownregistry.com/api/v1/resolve?ref=jpeetz/agent-skills/threat-modeling
GET https://markdownregistry.com/api/v1/blob/0d2fddf5c1122021cb8722b6b2b1c93e1b58213ea0af491dbae910f250e08b08
Your AI assistant does the legwork. You hear about the deals worth your word. Hand yours the standing instructions at modelranch.com and it joins the network that reads files like this one.
jpeetz/agent-skills · skills/api-backend/api-and-interface-design/SKILL.md · Use this skill when designing APIs, module boundaries, or any public interface. Create stable, well-documented…
jpeetz/agent-skills · skills/api-backend/har-api-reverse-engineering/SKILL.md · Use this skill when an agent needs to call a website's hidden or undocumented API: capture real browser requests into a…
jpeetz/agent-skills · skills/api-backend/image-to-image-character-generation/SKILL.md · Use this skill when an agent needs to generate consistent character images via kie.ai grok-imagine image-to-image from…
jpeetz/agent-skills · skills/api-backend/kie-ai-platform/SKILL.md · Use this skill when an agent needs to integrate with the Kie.ai API for image/video/audio generation, task management…
jpeetz/agent-skills · skills/api-backend/n8n-api-shape/SKILL.md · Use this skill when working with the n8n REST API — read, update, or verify workflows on ANY n8n instance…
jpeetz/agent-skills · skills/api-backend/social-har-api-connectivity/SKILL.md · Use this skill when an agent needs to connect to a social platform's API by prompting the user to pick a platform…
jpeetz/agent-skills · skills/business-strategy/app-discovery-scrutiny/SKILL.md · Use this skill when the user wants to evaluate a mobile app idea for commercial viability — whether it's a clone…
jpeetz/agent-skills · skills/business-strategy/enterprise-consulting-methods/SKILL.md · Use when you need McKinsey/BCG-grade strategy work — problem decomposition, hypothesis testing, storyline building…
cbrock84/headcount · plugins/security/skills/threat-modeling/SKILL.md · Identifies what could go wrong in a system before it is built or changed — the assets worth attacking, the entry…
naodeng/awesome-qa-skills · skills/en/testing-types/threat-modeling/SKILL.md · Use this skill when you need evidence-bounded threat-modeling analysis and validation preparation; triggers include…
miosa-osa/osa · priv/skills/threat-modeling/SKILL.md · Build a concrete cyber defense threat model from assets, data flows and trust boundaries, then map controls to attack…
nahid-sparktales/agent-dispatcher · skills/security/threat-modeling/SKILL.md · Work out what is actually worth defending in this system — the trust boundaries data crosses, the assets behind them…
timwukp/agent-skills-best-practice · skills/skills/threat-modeling/SKILL.md · Performs STRIDE threat modeling for features, APIs, and architecture changes, producing a threat model document with…
