# Threat Modeling

> Iron Law: NO ARCHITECTURE REVIEW WITHOUT THREAT MODELING FIRST

- Skill: `kumaran-is/threat-modeling` (Agent Skill, multi-file: 3 files)
- Install (CLI): `npx skillmds@latest add kumaran-is/threat-modeling`
- Raw SKILL.md: https://api.skillmd.com/api/skills/kumaran-is/threat-modeling/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- Author: kumaran-is (https://skillmd.com/u/kumaran-is)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/kumaran-is/threat-modeling

---


## Iron Law: NO ARCHITECTURE REVIEW WITHOUT THREAT MODELING FIRST

Every new feature, service, or architectural change requires a threat model before implementation begins.

## When to Use

- New feature or service design → STRIDE analysis + DFD
- Architecture change → full DFD analysis of affected components
- Production security incident → post-incident threat review
- Security audit preparation → staleness check on all threat models

## Process

1. **Load methodology** — Read `references/stride-methodology.md` for STRIDE matrix, DFD element mapping, risk scoring, and output template
2. **Load control library** — Read `references/threat-mitigation-mapping.md` for control categories, the 16-control lookup table, and coverage scoring
3. **Model the system** — Identify assets, trust boundaries, DFD elements, and interactions
4. **Run STRIDE** — Apply per-element and per-interaction analysis using the methodology reference
5. **Map mitigations** — Select controls from the library; verify defense-in-depth across layers
6. **Score and report** — Calculate `risk = impact × likelihood`, document residual risks

## References

| File | Content | Load When |
|------|---------|-----------|
| `references/stride-methodology.md` | STRIDE matrix, DFD mapping, risk scoring formula, output template | STRIDE analysis, DFD mapping, risk scoring |
| `references/threat-mitigation-mapping.md` | Control library (16 controls), coverage scoring, budget prioritization | Selecting security controls, budget prioritization |

## Error Handling

If architecture documents are missing, reconstruct system topology from the codebase using Grep/Glob.
If a component lacks context for threat analysis, flag it explicitly rather than guessing.