security-threat-model
Write a STRIDE-based threat model for a service or feature. Use when asked to produce a threat model, document security risks, identify attack vectors, assess a service's security posture, or prepare for a security design review. Produces a structured threat model covering assets, trust boundaries, STRIDE threat enumeration per component, risk scores, mitigation controls, and residual risk sign-off.
npx skills add mohitagw15856/pm-claude-skills --skill security-threat-model --agent claude-code
Same command for any agent — swap --agent for codex, cursor, copilot.
Weekly change comes from our own snapshots, not the repository page — it measures attention, not adoption.
# Security Threat Model Skill Produce a complete STRIDE-based threat model for a service or feature. A threat model is not a list of things that could go wrong — it is a structured analysis of attackers, assets, boundaries, and controls that lets an engineering team make informed, documented security decisions. A good threat model is specific enough that a new engineer can understand what is being protected, why each control exists, and what risk the team has accepted. ## Required Inputs Ask for these if not already provided: - **Service name and description** — what the service does, who uses it - **Architecture overview** — components, dependencies, data flows (a diagram description or ASCII diagram is fine) - **Deployment environment** — cloud provider, VPC/network topology, where it runs (Kubernetes, ECS, VMs, serverless) - **Data sensitivity** — what data does this service handle? PII, payment data, credentials, internal-only? - **Existing controls** — authentication method, encryption in transit/at rest, current WAF/firewall, existing security scanning - **Trust levels** — who are the principals? (anonymous public, authenticated users, internal services, admins) ## Output For
- Required Inputs
- Output Format
- 1. Overview
- 2. Asset Register
- 3. Trust Boundaries and Architecture
- 4. STRIDE Threat Analysis
- Component: [API Gateway / Auth Layer]
- Component: [Application Service / Business Logic]
- Component: [Database]
- Component: [Internal Service-to-Service Communication]
- 5. Risk Register
- 6. Mitigations Table
- 7. Accepted Risks
- 8. Security Controls Summary
What does the security-threat-model skill do?
Write a STRIDE-based threat model for a service or feature. Use when asked to produce a threat model, document security risks, identify attack vectors, assess a service's security posture, or prepare for a security design review. Produces a structured threat model covering assets, trust boundaries, STRIDE threat enumeration per component, risk scores, mitigation controls, and residual risk sign-off.
How do I install it?
Run `npx skills add mohitagw15856/pm-claude-skills --skill security-threat-model --agent claude-code` — it drops the skill into your project so the agent can pick it up. Swap the --agent value for codex, cursor or copilot if you use one of those.
Where does this skill come from?
From mohitagw15856/pm-claude-skills, a repository with 1,255 stars. We read it straight from the repository tree rather than a submitted listing, so what you see here is what is actually published.
Is a popular skill a good skill?
Not necessarily. Stars measure attention, not adoption — a repository can trend for a week and be abandoned. That is why we show the weekly change from our own snapshots next to the total, instead of a single flattering number.