regulatory-threat-model

What it does

The skill acts as an orchestrator for security threat-modeling workflows that are run on a server-enforced engine. It produces outputs including STRIDE threat modeling, LINDDUN privacy threat modeling when personal data flows exist, a dependency exposure screen using live vulnerability data, and a non-exhaustive screen of EU security obligations (GDPR, NIS2, Cyber Resilience Act, AI Act) with scope, role, and application-date limits stated. Each regulatory statement is grounded in officially published text fetched at answer time, with sources and unresolved items visible; the deliverable is a report suitable for customers, auditors, or investors, not a chat transcript or a compliance verdict.

The threat-modeling workflows are executed through the Ansvar Gateway's workflow engine, which enforces steps and quality gates server-side. The agent's job is to feed the engine well and ground the regulatory layer; it is never the engine.

How it works

• Requires connection to the Ansvar Gateway MCP connector: https://gateway.ansvar.eu/mcp with OAuth 2.1 and Dynamic Client Registration. Works with various surfaces per setup guides.
• On every plan, uses tools: get_my_capabilities, search, get_provision, search_cve, get_cve_details, get_epss_score, check_kev_status, get_data_freshness, and list_workflow_types.
• For modeling runs (Premium plan and above): start_workflow, get_current_step, submit_response, get_progress, generate_report, resume_workflow, cancel_workflow.
• If gateway tools are unavailable, it informs the user to connect the gateway and does not produce a substitute review.
• Ground rules require that regulatory statements come from fetched text with full provisions read via get_provision, and only URLs from official publishers are used.
• It enforces a strict boundary between workflow outputs and free-text data, quoting and citing all data from tool outputs and serving only structured results from the engine.
• Before starting a workflow, it re-checks capabilities and obtains explicit user consent, explaining run consumption and remaining quota per step as required.

When to use it

• Use when a server-enforced security review with regulatory grounding is needed: STRIDE threat model, LINDDUN privacy threat model, a live dependency exposure screen, and a screen of applicable EU obligations.
• Activate when the user requires the deliverable to include sources and unresolved items visible, not a raw model memory answer, and when grounding statements in official text is essential.

What it can touch

• Tools: get_my_capabilities, search, get_provision, search_cve, get_cve_details, get_epss_score, check_kev_status, get_data_freshness, list_workflow_types, start_workflow, get_current_step, submit_response, get_progress, generate_report, resume_workflow, cancel_workflow.
• It interacts with the Ansvar Gateway MCP connector URL: https://gateway.ansvar.eu/mcp.

Caveats

• The workflow runs are server-enforced; if the gateway plan cannot run them, the skill falls back to a free lane delivering intake, scoping worksheet, dependency screen, and obligations screen only.
• Regulatory statements must come from fetched text with instrument and source_url; it will fetch full provisions via get_provision before making dispositive statements.
• The output is a report, not a chat transcript or a compliance verdict, and it cites sources for every obligation.