threat-model-analyst
Full STRIDE-A threat model analysis and incremental update skill for repositories and systems. Supports two modes: (1) Single analysis — full STRIDE-A threat model of a repository, producing architecture overviews, DFD diagrams, STRIDE-A analysis, prioritized findings, and executive assessments. (2) Incremental analysis — takes a previous threat model report as baseline, compares the codebase at the latest (or a given commit), and produces an updated report with change tracking (new, resolved, still-present threats), STRIDE heatmap, findings diff, and an embedded HTML comparison. Only activate
Profile →npx skills add github/awesome-copilot --skill threat-model-analyst --agent copilot
Same command for any agent — swap --agent for claude-code, codex, cursor.
Weekly change comes from our own snapshots, not the repository page — it measures attention, not adoption.
# Threat Model Analyst You are an expert **Threat Model Analyst**. You perform security audits using STRIDE-A (STRIDE + Abuse) threat modeling, Zero Trust principles, and defense-in-depth analysis. You flag secrets, insecure boundaries, and architectural risks. ## Getting Started **FIRST — Determine which mode to use based on the user's request:** ### Incremental Mode (Preferred for Follow-Up Analyses) If the user's request mentions **updating**, **refreshing**, or **re-running** a threat model AND a prior report folder exists: - Action words: "update", "refresh", "re-run", "incremental", "what changed", "since last analysis" - **AND** a baseline report folder is identified (either explicitly named or auto-detected as the most recent `threat-model-*` folder with a `threat-inventory.json`) - **OR** the user explicitly provides a baseline report folder + a target commit/HEAD Examples that trigger incremental mode: - "Update the threat model using threat-model-20260309-174425 as the baseline" - "Run an incremental threat model analysis" - "Refresh the threat model for the latest commit" - "What changed security-wise since the last threat model?" → Read [incremental-orchestrator.md](./
- Getting Started
- Incremental Mode (Preferred for Follow-Up Analyses)
- Comparing Commits or Reports
- Single Analysis Mode
- Reference Files
- When to Activate
What does the threat-model-analyst skill do?
Full STRIDE-A threat model analysis and incremental update skill for repositories and systems. Supports two modes: (1) Single analysis — full STRIDE-A threat model of a repository, producing architecture overviews, DFD diagrams, STRIDE-A analysis, prioritized findings, and executive assessments. (2) Incremental analysis — takes a previous threat model report as baseline, compares the codebase at the latest (or a given commit), and produces an updated report with change tracking (new, resolved, still-present threats), STRIDE heatmap, findings diff, and an embedded HTML comparison. Only activate
How do I install it?
Run `npx skills add github/awesome-copilot --skill threat-model-analyst --agent claude-code` — it drops the skill into your project so the agent can pick it up. Swap the --agent value for codex, cursor or copilot if you use one of those.
Where does this skill come from?
From github/awesome-copilot, a repository with 37,432 stars. We read it straight from the repository tree rather than a submitted listing, so what you see here is what is actually published.
Is a popular skill a good skill?
Not necessarily. Stars measure attention, not adoption — a repository can trend for a week and be abandoned. That is why we show the weekly change from our own snapshots next to the total, instead of a single flattering number.