# Security Threat Modeling

> ===SECURITY_THREAT_MODELING===

- Skill: `elevanaltd-hestai-mcp/security-threat-modeling` (Agent Skill)
- Install (CLI): `npx skillmds@latest add elevanaltd-hestai-mcp/security-threat-modeling`
- Raw SKILL.md: https://api.skillmd.com/api/skills/elevanaltd-hestai-mcp/security-threat-modeling/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- Author: elevanaltd (https://skillmd.com/u/elevanaltd-hestai-mcp)
- Updated: 2026-09-21
- Page: https://skillmd.com/skills/elevanaltd-hestai-mcp/security-threat-modeling

---

===SECURITY_THREAT_MODELING===
META:
  TYPE::SKILL
  VERSION::"1.0.0"
  STATUS::ACTIVE
  PURPOSE::"Security-focused code review lens with OWASP-aligned threat detection"

§1::CORE
AUTHORITY::BLOCKING[secrets_exposure⊕injection_vulnerabilities⊕auth_bypass]
SCOPE::security_review[OWASP⊕auth_flows⊕dependency_risk⊕injection⊕secrets]
MISSION::"Apply security threat modeling to code changes — detect vulnerabilities before they reach production"

§2::PROTOCOL

OWASP_REVIEW_CHECKLIST::[
  A01_BROKEN_ACCESS_CONTROL::[missing_authz_checks,IDOR_patterns,privilege_escalation_paths],
  A02_CRYPTO_FAILURES::[hardcoded_secrets,weak_hashing,plaintext_sensitive_data],
  A03_INJECTION::[SQL∨NoSQL∨OS_command∨LDAP,unsanitized_user_input,template_injection],
  A04_INSECURE_DESIGN::[missing_rate_limiting,no_input_validation,trust_boundary_violations],
  A05_SECURITY_MISCONFIGURATION::[debug_enabled,default_credentials,overly_permissive_CORS]
]

AUTH_FLOW_VALIDATION::[
  verify_authentication_before_authorization,
  check_session_management[expiry⊕rotation⊕invalidation],
  validate_token_handling[storage⊕transmission⊕scope],
  flag_missing_CSRF_protection_on_state_changing_endpoints
]

INJECTION_PATTERN_DETECTION::[
  string_concatenation_in_queries::BLOCKING,
  "user_input→eval∨exec∨system_call"::BLOCKING,
  unsanitized_path_construction[path_traversal]::BLOCKING,
  "template_rendering_with_raw_user_input"::BLOCKING,
  parameterized_queries_present::SAFE_SIGNAL
]

SECRETS_EXPOSURE_DETECTION::[
  hardcoded_API_keys∨tokens∨passwords::BLOCKING,
  credentials_in_config_files_without_env_vars::BLOCKING,
  secrets_in_log_output::BLOCKING,
  .env_files_committed_to_git::BLOCKING,
  private_keys_in_source::BLOCKING
]

DEPENDENCY_RISK::[
  new_dependency_added::ADVISORY<check_known_vulnerabilities>,
  pinned_versions::ADVISORY<verify_not_known_vulnerable>,
  "transitive_dependency_risk::ADVISORY<flag_for_audit>"
]

§3::GOVERNANCE

SEVERITY_CLASSIFICATION::[
  BLOCKING::[injection,secrets_exposure,auth_bypass,crypto_failure],
  ADVISORY::[missing_rate_limiting,overly_broad_permissions,dependency_risk]
]

MUST::[
  scan_all_changed_files_for_OWASP_top_5,
  flag_any_hardcoded_secrets_or_credentials,
  validate_auth_flows_when_auth_code_changes,
  check_injection_patterns_in_data_handling_code,
  assess_new_dependencies_for_known_CVEs
]

NEVER::[
  approve_hardcoded_secrets_with_TODO_to_fix_later,
  ignore_injection_patterns_in_test_code[tests_may_leak_to_prod],
  downgrade_BLOCKING_security_finding_without_evidence
]

§5::ANCHOR_KERNEL
TARGET::security_threat_detection_in_code_reviews
NEVER::[approve_hardcoded_secrets,ignore_injection_patterns,skip_auth_flow_validation,downgrade_security_findings_without_evidence]
MUST::[scan_OWASP_top_5,detect_secrets_exposure,validate_auth_flows,check_injection_patterns,assess_dependency_risk]
GATE::"Does this change introduce security vulnerabilities or weaken existing protections?"

===END===