Results for “risk-review”

Structured threat modeling skill using the PASTA framework (Process for Attack Simulation and Threat Analysis) combined with Adam Shostack's 4-question framework. Use this skill whenever the user asks to do threat modeling, security analysis, map the attack surface, identify threats, or review an application for security risks — even if they don't mention PASTA or a specific framework by name. Core activities: Component Mapping (architecture + data flows), Critical Assessment (business impact prioritization), and Logic Flaw Identification (attacker mindset on business logic). Produces: component map diagram (Mermaid), data flow diagram (Mermaid), attack tree (Mermaid), STRIDE threat table, prioritized risk register, and an actionable mitigation plan. Invoke proactively for any security review, architecture review, or "what could go wrong?" session.

Create OR review a wireflow — the artifact BETWEEN user journeys and wireframes. It maps whole journeys into swimlane flows with high-level navigation (screens, decisions, system/agent steps) while keeping Jobs-To-Be-Done at the core, WITHOUT deep UI. Use whenever the user wants to "map the flows", "make/build a wireflow", turn journeys / JTBDs / a spec / a live prototype into flows, or put every journey on one board against shared owner lanes — even if they never say "wireflow". ALSO use it to REVIEW or critique an existing wireflow (image, FigJam, or description). In the A-Team pipeline this is a definition-phase skill: output lands in docs/features/<slug>/briefs/wireflow/ with jobs consumed by id from docs/product/jtbd/; pipeline mode derives the method decisions and highlights the riskiest at the gate, standalone mode runs the full grill. CREATE generates verified SVG/HTML (self-checked by rendering and Reading its output) in a horizontal per-journey OR shared-matrix layout, and can rebuild in FigJam. Do