1---2name: threat-model-analyst-23description: Produce full or incremental STRIDE-A threat models for repositories and systems, including architecture overviews, DFD diagrams, findings, STRIDE heatmaps, and executive assessment. Use when the user asks to threat model a repo, refresh an existing threat-model-* report, compare commits or reports, identify trust boundary risks, or map findings to CVSS 4.0, CWE, and OWASP.4---56# Threat model analyst78Analyze a repository, system, commit range, or previous report; transform code and architecture evidence into a STRIDE-A security model; output a standalone threat-model folder with diagrams, inventory, findings, and verification artifacts.910## When to invoke1112- "Run a threat model for this repository."13- "Refresh the threat model using the latest commit."14- "What changed security-wise since the last threat model?"15- "Compare these two threat-model reports."16- "Generate STRIDE-A findings with CVSS 4.0 and CWE mappings."1718## Prerequisites and context1920- Use this skill only when the user explicitly requests threat modeling, incremental threat model updates, report comparison, or `/threat-model-analyst` behavior.21- A full analysis can start from repository source alone; an incremental analysis needs a prior `threat-model-*` folder with `threat-inventory.json` or an explicitly supplied baseline report plus target commit or HEAD.22- Read the matching bundled orchestrator before doing substantive analysis; the orchestrators carry the mandatory workflow, sub-agent governance, verification rules, and output skeleton requirements.2324## Mode selection2526| User request or evidence | Mode | Required resource | Result |27| --- | --- | --- | --- |28| "update", "refresh", "re-run", "incremental", "what changed", "since last analysis" plus a `threat-model-*` baseline | Incremental mode | `references/incremental-orchestrator.md` | Reuse the old report skeleton, verify every old item against current code, discover new items, and emit status annotations for new, resolved, and still-present threats. |29| Explicit baseline folder plus target commit or HEAD | Incremental mode | `references/incremental-orchestrator.md` | Compare baseline evidence with the target revision and produce an updated report with embedded HTML comparison. |30| Compare two commits or two reports | Incremental mode | `references/incremental-orchestrator.md` | Treat the older report or commit as baseline and the newer state as target. |31| Analyze a repo, generate a DFD, perform STRIDE-A, validate controls, identify trust boundaries | Single analysis mode | `references/orchestrator.md` | Execute the complete 10-step workflow and create architecture, DFD, STRIDE-A, prioritized findings, and executive assessment outputs. |3233## STRIDE-A analysis map3435| Area | Inspect | Evidence standard |36| --- | --- | --- |37| Spoofing | Authentication entry points, session creation, identity propagation, service-to-service credentials | Show the live owner path and the exact boundary where identity is asserted or trusted. |38| Tampering | Request validation, persistence writes, queues, deserialization, infrastructure mutation | Prove whether integrity controls exist before flagging a write path. |39| Repudiation | Audit logs, actor attribution, request IDs, immutable event trails | Distinguish absent evidence from weak evidence; do not infer auditability from generic logging. |40| Information disclosure | Secrets, tokens, PII, debug output, storage policies, cross-tenant data flows | Verify the data class, exposure route, and trust boundary. |41| Denial of service | Rate limits, pagination, expensive queries, fan-out, retries, queue backpressure | Tie the risk to an externally triggerable path or operational limit. |42| Elevation of privilege | Authorization checks, admin paths, object-level access, role transitions | Require code or configuration evidence for both the caller role and protected action. |43| Abuse | Business-logic misuse, workflow bypass, fraud paths, unsafe automation | Model the malicious but protocol-valid user, not only broken inputs. |4445## Report artifacts4647| Artifact | Use | Required content |48| --- | --- | --- |49| `0.1-architecture.md` | Architecture overview | Components, trust boundaries, entry points, data stores, assumptions, and Mermaid architecture diagrams. |50| `1-threatmodel.md` | Threat inventory | DFD elements, data flows, STRIDE-A threats, mitigations, and open questions. |51| `2-stride-analysis.md` | STRIDE heatmap | Component-by-component and flow-by-flow STRIDE-A coverage with severity rationale. |52| `3-findings.md` | Prioritized findings | Exploit path, affected assets, evidence, likelihood, impact, CVSS 4.0, CWE, OWASP, and remediation. |53| `0-assessment.md` | Executive assessment | Security posture, critical decisions, residual risk, and recommended next steps. |54| `threat-inventory.json` | Incremental baseline | Stable identifiers, current status, evidence anchors, and comparison-ready metadata. |5556## Progressive disclosure and bundled resources5758Read only the resource needed for the current phase, then follow it exactly.5960| Resource | Read when | Contains |61| --- | --- | --- |62| `references/orchestrator.md` | Starting any single analysis | Complete 10-step workflow, 34 mandatory rules, tool usage, sub-agent governance, and verification process. |63| `references/incremental-orchestrator.md` | Updating, refreshing, re-running, or comparing reports or commits | Baseline loading, old skeleton inheritance, change detection, status annotations, HTML comparison, STRIDE heatmap diff, and findings diff. |64| `references/analysis-principles.md` | Judging security issues | Verify-before-flagging rules, security infrastructure inventory, OWASP Top 10:2025, platform defaults, exploitability tiers, and severity standards. |65| `references/diagram-conventions.md` | Creating any Mermaid diagram | Color palette, shapes, sidecar co-location rules, DFD style, architecture style, sequence diagram style, and pre-render checklist. |66| `references/output-formats.md` | Writing report files | Templates and common mistakes checklist for `0.1-architecture.md`, `1-threatmodel.md`, `2-stride-analysis.md`, `3-findings.md`, and `0-assessment.md`. |67| `references/skeletons/` | Before writing each output file | Verbatim `skeleton-*.md` fill-in structures; copy the relevant skeleton and replace `[FILL]` placeholders. |68| `references/verification-checklist.md` | Inline checks and final pass | Per-file structure, diagram rendering, cross-file consistency, evidence quality, JSON schema, and delegated verification checklist. |69| `references/tmt-element-taxonomy.md` | Identifying DFD elements from code | TMT-compatible element type taxonomy, trust boundary detection, data flow patterns, and code analysis checklist. |7071## Gotchas7273- **Do not skip the orchestrator**: the body of this skill is only the router; `orchestrator.md` and `incremental-orchestrator.md` are the executable source of truth.74- **Do not flag without verification**: every finding needs code, configuration, runtime, or report evidence tied to an exploitable path.75- **Do not break incremental continuity**: preserve stable threat identifiers where the issue is still-present, and mark resolved items only after checking current code.76- **Do not invent diagrams**: Mermaid DFD and architecture diagrams must reflect discovered components, flows, and trust boundaries.7778## Baseline terminology and continuity7980Preserve trigger examples and report mechanics from previous versions: `FIRST` choose mode, read the relevant orchestrator before writing `EACH` output file, copy skeletons `VERBATIM`, use `threat-model-20260309-174425` as a representative baseline folder name, allow a baseline to be `auto-detected`, accept `commit/HEAD` targets, support `Incremental/update` and `follow-up` requests, track `threats/findings`, use `on-demand` resource loading, and run `per-file` `quick-checks`. Apply Zero Trust, STRIDE-A, and `defense-in-depth` analysis throughout.81## Output template8283```markdown84## Threat model result — <system or repository>8586**Mode:** single analysis | incremental analysis | comparison87**Baseline:** <none | threat-model-* folder | commit/report>88**Target:** <HEAD | commit | report>89**Status:** complete | partial | blocked9091### Artifacts92| File | Purpose | Status |93| --- | --- | --- |94| `0.1-architecture.md` | Architecture overview and diagrams | created | updated | blocked |95| `1-threatmodel.md` | Threat inventory and DFD | created | updated | blocked |96| `2-stride-analysis.md` | STRIDE-A heatmap and analysis | created | updated | blocked |97| `3-findings.md` | Prioritized findings | created | updated | blocked |98| `0-assessment.md` | Executive assessment | created | updated | blocked |99| `threat-inventory.json` | Machine-readable inventory | created | updated | blocked |100101### Findings summary102| Severity | New | Still present | Resolved | Notes |103| --- | ---: | ---: | ---: | --- |104| Critical | <n> | <n> | <n> | <summary> |105| High | <n> | <n> | <n> | <summary> |106| Medium | <n> | <n> | <n> | <summary> |107| Low | <n> | <n> | <n> | <summary> |108109### Verification110- Orchestrator followed: pass | fail111- Skeletons used verbatim before fill-in: pass | fail112- Diagrams pre-render checked: pass | fail113- Evidence anchors present for every finding: pass | fail114```115116## Quality gate117118- [ ] The request matched an explicit threat model, incremental update, comparison, or `/threat-model-analyst` trigger.119- [ ] Single analysis read `references/orchestrator.md`; incremental analysis read `references/incremental-orchestrator.md`.120- [ ] Every output file started from the relevant `references/skeletons/skeleton-*.md` file before `[FILL]` replacement.121- [ ] STRIDE-A covers spoofing, tampering, repudiation, information disclosure, denial of service, elevation of privilege, and abuse.122- [ ] Every finding has evidence, affected boundary or asset, severity rationale, and CVSS 4.0 / CWE / OWASP mapping where applicable.123- [ ] Incremental output distinguishes new, resolved, and still-present threats and preserves baseline continuity.124- [ ] Mermaid diagrams follow `references/diagram-conventions.md` and passed the pre-render checklist.125- [ ] `threat-inventory.json` exists for report folders that can serve as future baselines.
paulasilvatech