Structured security design analysis — find what can go wrong before an attacker does. Build a Data Flow Diagram with trust boundaries, apply STRIDE per element, add abuse/misuse cases, and map every threat to a control and a test. Use when the user asks to threat model a feature/system, run STRIDE, map the attack surface, do a security design review, write abuse cases, identify trust boundaries, ask "what could go wrong" / "what are the security risks of this feature", or draw a data flow…
Collected from public GitHub. Every version is saved exactly as it was and never changes. Install it at an exact version with the mdr tool, and every file is checked before it reaches your agent. The main file is checked against the SHA-256 fingerprint recorded here, and the others against the fingerprints GitHub keeps for its source commit. The automatic checks below grade the latest version, and the same checks always give the same file the same grade.
What the file says
# Threat Modeling
Threat modeling is structured anticipation: you reason about how a system can be attacked **while it is still cheap to change** — at design time, on paper or in a diagram, before the code exists. The output is not a document; it is a set of mitigations wired to tests and a habit of asking "what could go wrong?" continuously.
This skill runs on **Shostack's Four Question Framework** ([Adam Shostack, *Threat Modeling: Designing for Security*](https://shostack.org/resources/threat-modeling)): What are we working on? What can go wrong? What are we going to do about it? Did we do a good job? Everything else — STRIDE, DFDs, risk ranking — serves those four questions.
## Read first (always)
List `learnings/` and read every file relevant to the current system (the domain, the trust boundaries, the third parties, the compliance regime). Project-specific assets, known attacker personas, accepted risks, and "in this system X is out of scope because Y" decisions live there and override the defaults in this SKILL.md. If a learning conflicts with this file, **the learning wins** — mention it to the user.
…
The line at the top of this page pins the label git:20260619.98096d2, which is what most people want. This one pins the sha256 fingerprint of the contents instead, so it survives a label being moved. Either way the exact version is written to mdr.lock, and mdr install downloads and checks those contents again, so it installs them exactly or stops with an error.
GET https://markdownregistry.com/api/v1/artifacts/art_ydxta2ezplt3dk4p
GET https://markdownregistry.com/api/v1/resolve?ref=cristhianzl/claude-skills-czl/threat-modeling
GET https://markdownregistry.com/api/v1/blob/7bf968a5f2369270ea76187d2a5c34789afba0a67259cc9458a2fb2b750fca3d
Your AI assistant does the legwork. You hear about the deals worth your word. Hand yours the standing instructions at modelranch.com and it joins the network that reads files like this one.
cristhianzl/claude-skills-czl · configs/agnostic/skills/api-design/SKILL.md · Design and review HTTP/REST (and choose between REST/GraphQL/gRPC) APIs that are contract-first, resource-oriented…
cristhianzl/claude-skills-czl · configs/agnostic/skills/building-frontend-ui/SKILL.md · Build, refactor, and review frontend UI in any framework — components, accessibility, forms, client state and data…
cristhianzl/claude-skills-czl · configs/agnostic/skills/debugging-agent-runs/SKILL.md · Recover when the AGENT itself is stuck — looping, repeating the same failed action, burning tokens/budget, overflowing…
cristhianzl/claude-skills-czl · configs/agnostic/skills/developing-features-tdd/SKILL.md · Build a new feature using strict test-driven development — UNDERSTAND → DESIGN → RED → VERIFY RED → GREEN → VERIFY…
cristhianzl/claude-skills-czl · configs/agnostic/skills/documenting-features/SKILL.md · Produce living, DDD-aligned feature documentation as a single Markdown file with 10 fixed sections — overview…
cristhianzl/claude-skills-czl · configs/agnostic/skills/exploratory-testing/SKILL.md · Run structured exploratory testing — write a charter, time-box a session, apply heuristics and oracles to discover bugs…
cristhianzl/claude-skills-czl · configs/agnostic/skills/guarding-scope/SKILL.md · Keep every piece of work inside the scope the user asked for — and detect scope creep, gold plating, and AI slop in any…
cbrock84/headcount · plugins/security/skills/threat-modeling/SKILL.md · Identifies what could go wrong in a system before it is built or changed — the assets worth attacking, the entry…
naodeng/awesome-qa-skills · skills/en/testing-types/threat-modeling/SKILL.md · Use this skill when you need evidence-bounded threat-modeling analysis and validation preparation; triggers include…
miosa-osa/osa · priv/skills/threat-modeling/SKILL.md · Build a concrete cyber defense threat model from assets, data flows and trust boundaries, then map controls to attack…
nahid-sparktales/agent-dispatcher · skills/security/threat-modeling/SKILL.md · Work out what is actually worth defending in this system — the trust boundaries data crosses, the assets behind them…
jpeetz/agent-skills · skills/security/threat-modeling/SKILL.md · Use this skill when performing security reviews of features, APIs, or architecture changes. Produces a STRIDE threat…
