How do I install the Sec Threat Modeling skill?

Run npx skillmds@latest add jcorpac/sec-threat-modeling in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is Sec Threat Modeling safe to use?

This skill has not completed SkillMD's automated safety review yet. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Sec Threat Modeling?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Sec Threat Modeling free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published Sec Threat Modeling?

jcorpac (@jcorpac) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Sec Threat Modeling by jcorpac — Agent Skill

Name: Sec Threat Modeling
Author: jcorpac

File contents

Threat Modeling

This skill facilitates interactive threat-modeling sessions. By analyzing the architecture and data flows of a feature before implementation, this skill aims to prevent A06:2025 – Insecure Design.

Usage

Deploy this skill when planning a new feature, service, or significant architectural change.

Example Triggers:

"I want to add a new password reset flow. Can we threat model it?"
"Let's use the STRIDE methodology to review the design for the new payment processing microservice."

Workflow

Architecture Elicitation: Ask the user to describe the system's components, actors (users/services), trust boundaries, and data flows. Encourage them to provide a textual description or a Mermaid diagram.
STRIDE Analysis: Methodically evaluate the proposed design against the STRIDE categories:
- Spoofing (Authentication): Can an attacker pretend to be someone else?
- Tampering (Integrity): Can data be altered in transit or at rest?
- Repudiation (Non-repudiation): Can actions be denied by the user taking them (lack of logging/auditing)?
- Information Disclosure (Confidentiality): Is private data exposed to unauthorized parties?
- Denial of Service (Availability): Can the system be brought down or degraded?
- Elevation of Privilege (Authorization): Can a user gain higher-level permissions?
Vulnerability Identification: Based on the STRIDE analysis, list potential threats specific to the design.
Mitigation Strategy Formulation: For each identified threat, propose concrete, actionable security controls that should be integrated into the design.

Goal

The output of a threat modeling session should be a list of security requirements that must be met during the implementation phase.

---name: sec-threat-modelingdescription: Guide users through threat-modeling exercises (like STRIDE) during the design phase to identify and mitigate A06:2025 Insecure Design vulnerabilities before code is written.---# Threat ModelingThis skill facilitates interactive threat-modeling sessions. By analyzing the architecture and data flows of a feature *before* implementation, this skill aims to prevent **A06:2025 – Insecure Design**.## UsageDeploy this skill when planning a new feature, service, or significant architectural change.**Example Triggers:*** "I want to add a new password reset flow. Can we threat model it?"* "Let's use the STRIDE methodology to review the design for the new payment processing microservice."## Workflow1. **Architecture Elicitation:** Ask the user to describe the system's components, actors (users/services), trust boundaries, and data flows. Encourage them to provide a textual description or a Mermaid diagram.2. **STRIDE Analysis:** Methodically evaluate the proposed design against the STRIDE categories: * **S**poofing (Authentication): Can an attacker pretend to be someone else? * **T**ampering (Integrity): Can data be altered in transit or at rest? * **R**epudiation (Non-repudiation): Can actions be denied by the user taking them (lack of logging/auditing)? * **I**nformation Disclosure (Confidentiality): Is private data exposed to unauthorized parties? * **D**enial of Service (Availability): Can the system be brought down or degraded? * **E**levation of Privilege (Authorization): Can a user gain higher-level permissions?3. **Vulnerability Identification:** Based on the STRIDE analysis, list potential threats specific to the design.4. **Mitigation Strategy Formulation:** For each identified threat, propose concrete, actionable security controls that should be integrated into the design.## GoalThe output of a threat modeling session should be a list of security requirements that must be met during the implementation phase.

Frequently asked questions

Sec Threat Modeling