Performs STRIDE threat modeling for features, APIs, and architecture changes, producing a threat model document with risk-rated threats, mitigations, and security stories ready for the backlog. Use during sprint planning or design review. Triggers on: "threat model", "STRIDE", "security risks of this feature", "what could go wrong with this design", "security review of architecture".
Collected from public GitHub. Every version is saved exactly as it was and never changes. Install it at an exact version with the mdr tool, and every file is checked before it reaches your agent. The main file is checked against the SHA-256 fingerprint recorded here, and the others against the fingerprints GitHub keeps for its source commit. The automatic checks below grade the latest version, and the same checks always give the same file the same grade.
What the file says
# Threat Modeling (STRIDE)
Produce a lightweight, sprint-compatible threat model: 15-30 minutes of structured analysis, not a multi-week security assessment. The output is a threat model document plus security stories the team can schedule.
## Process
1. **Establish the data flow.** Ask for (or derive from the code/design) the feature's data flow: actors, entry points, services, data stores, and trust boundaries. Summarize it as `Actor → Component → ... → Store`, marking each trust boundary crossing with `||`. If the user has architecture docs or code, read them instead of asking.
2. **Walk the STRIDE categories** against each trust boundary crossing (see table below). For each plausible threat, capture: description, category, likelihood (H/M/L), impact (H/M/L), and a concrete mitigation. Skip categories that genuinely don't apply — do not pad the table.
3. **Rate risk** as High if likelihood or impact is High and the other is at least Medium; Low only if both are Low; otherwise Medium.
…
The line at the top of this page pins the label v1.0.0, which is what most people want. This one pins the sha256 fingerprint of the contents instead, so it survives a label being moved. Either way the exact version is written to mdr.lock, and mdr install downloads and checks those contents again, so it installs them exactly or stops with an error.
GET https://markdownregistry.com/api/v1/artifacts/art_vxgwk7x7leszoyhh
GET https://markdownregistry.com/api/v1/resolve?ref=timwukp/agent-skills-best-practice/threat-modeling
GET https://markdownregistry.com/api/v1/blob/cf9fb5e2476191561e42eccfef4666ab7385df79c340d3f48f7cf3aa00f8632f
Your AI assistant does the legwork. You hear about the deals worth your word. Hand yours the standing instructions at modelranch.com and it joins the network that reads files like this one.
timwukp/agent-skills-best-practice · skills/skills/agentcore-harness-builder/SKILL.md · Build production-ready AWS Bedrock AgentCore Harness agents end to end — declarative model + prompt, managed/BYO…
timwukp/agent-skills-best-practice · skills/skills/ai-native-sdlc/SKILL.md · Drive a change through an AI-native software development lifecycle as a loop of committed, machine-readable artifacts —…
timwukp/agent-skills-best-practice · skills/skills/algorithmic-art/SKILL.md · Creating algorithmic art using p5.js with seeded randomness and interactive parameter exploration. Use this when users…
timwukp/agent-skills-best-practice · skills/skills/aws-well-architected-review/SKILL.md · Reviews AWS architectures, IaC, and design docs against the AWS Well-Architected Framework's six pillars, producing a…
timwukp/agent-skills-best-practice · skills/skills/brand-guidelines/SKILL.md · Applies Anthropic's official brand colors and typography to any sort of artifact that may benefit from having…
timwukp/agent-skills-best-practice · skills/skills/canvas-design/SKILL.md · Create beautiful visual art in .png and .pdf documents using design philosophy. You should use this skill when the user…
cbrock84/headcount · plugins/security/skills/threat-modeling/SKILL.md · Identifies what could go wrong in a system before it is built or changed — the assets worth attacking, the entry…
naodeng/awesome-qa-skills · skills/en/testing-types/threat-modeling/SKILL.md · Use this skill when you need evidence-bounded threat-modeling analysis and validation preparation; triggers include…
miosa-osa/osa · priv/skills/threat-modeling/SKILL.md · Build a concrete cyber defense threat model from assets, data flows and trust boundaries, then map controls to attack…
nahid-sparktales/agent-dispatcher · skills/security/threat-modeling/SKILL.md · Work out what is actually worth defending in this system — the trust boundaries data crosses, the assets behind them…
jpeetz/agent-skills · skills/security/threat-modeling/SKILL.md · Use this skill when performing security reviews of features, APIs, or architecture changes. Produces a STRIDE threat…
