threat-model
Threat-model a system or feature to find where it could be attacked, before you build it. Use when asked to threat-model, do a security design review, identify attack surface, or apply STRIDE to a design. Produces a structured threat model: assets, trust boundaries and data flows, threats enumerated by category (STRIDE), and prioritized mitigations. Defensive security for systems you own or are authorized to assess.
npx skills add mohitagw15856/pm-claude-skills --skill threat-model --agent claude-code
Same command for any agent — swap --agent for codex, cursor, copilot.
Weekly change comes from our own snapshots, not the repository page — it measures attention, not adoption.
# Threat Model Skill Security bugs are cheapest to fix at design time. Threat modeling asks, systematically, "what can go wrong here?" — before code exists. This skill runs a structured pass: map what you're protecting and the trust boundaries, enumerate threats with **STRIDE**, and prioritize mitigations by risk. It's for systems you own or are authorized to assess. ## Required Inputs Ask for these only if they aren't already provided: - **The system/feature** — what it does, its components, and how data flows through it. - **Assets** — what's worth protecting (data, credentials, funds, availability, reputation). - **Trust boundaries** — where control changes hands (internet↔app, app↔DB, tenant↔tenant, user roles). - **Actors & entry points** — users, admins, services, third parties; APIs, inputs, uploads, auth. ## Output Format ### Threat model: [system/feature] **1. Scope & assets** — what's in scope, and the assets ranked by what their compromise would cost. **2. Architecture & trust boundaries** — the components, data flows, and where trust boundaries sit. (A Mermaid diagram helps — the playground renders it.) ```mermaid flowchart LR User -->|HTTPS| API API --> DB[(Data)] API
- Required Inputs
- Output Format
- Threat model: [system/feature]
- Quality Checks
- Anti-Patterns
- Based On
What does the threat-model skill do?
Threat-model a system or feature to find where it could be attacked, before you build it. Use when asked to threat-model, do a security design review, identify attack surface, or apply STRIDE to a design. Produces a structured threat model: assets, trust boundaries and data flows, threats enumerated by category (STRIDE), and prioritized mitigations. Defensive security for systems you own or are authorized to assess.
How do I install it?
Run `npx skills add mohitagw15856/pm-claude-skills --skill threat-model --agent claude-code` — it drops the skill into your project so the agent can pick it up. Swap the --agent value for codex, cursor or copilot if you use one of those.
Where does this skill come from?
From mohitagw15856/pm-claude-skills, a repository with 1,255 stars. We read it straight from the repository tree rather than a submitted listing, so what you see here is what is actually published.
Is a popular skill a good skill?
Not necessarily. Stars measure attention, not adoption — a repository can trend for a week and be abandoned. That is why we show the weekly change from our own snapshots next to the total, instead of a single flattering number.