1---2name: threat-model-analyst-33description: Produce full or incremental STRIDE-A threat models for repositories and systems, including architecture overviews, DFD diagrams, findings, STRIDE heatmaps, and executive assessment. Use when the user asks to threat model a repo, refresh an existing threat-model-* report, compare commits or reports, identify trust boundary risks, or map findings to CVSS 4.0, CWE, and OWASP.4---56<!-- Generated from harness/github-copilot/plugins/application-security/skills/threat-model-analyst/SKILL.md by harness/claude-code/scripts/convert_from_copilot.py. Edit the source, not this file. -->78# Threat model analyst910Analyze a repository, system, commit range, or previous report; transform code and architecture evidence into a STRIDE-A security model; output a standalone threat-model folder with diagrams, inventory, findings, and verification artifacts.1112## When to invoke1314- "Run a threat model for this repository."15- "Refresh the threat model using the latest commit."16- "What changed security-wise since the last threat model?"17- "Compare these two threat-model reports."18- "Generate STRIDE-A findings with CVSS 4.0 and CWE mappings."1920## Prerequisites and context2122- Use this skill only when the user explicitly requests threat modeling, incremental threat model updates, report comparison, or `/threat-model-analyst` behavior.23- A full analysis can start from repository source alone; an incremental analysis needs a prior `threat-model-*` folder with `threat-inventory.json` or an explicitly supplied baseline report plus target commit or HEAD.24- Read the matching bundled orchestrator before doing substantive analysis; the orchestrators carry the mandatory workflow, sub-agent governance, verification rules, and output skeleton requirements.2526## Mode selection2728| User request or evidence | Mode | Required resource | Result |29| --- | --- | --- | --- |30| "update", "refresh", "re-run", "incremental", "what changed", "since last analysis" plus a `threat-model-*` baseline | Incremental mode | `references/incremental-orchestrator.md` | Reuse the old report skeleton, verify every old item against current code, discover new items, and emit status annotations for new, resolved, and still-present threats. |31| Explicit baseline folder plus target commit or HEAD | Incremental mode | `references/incremental-orchestrator.md` | Compare baseline evidence with the target revision and produce an updated report with embedded HTML comparison. |32| Compare two commits or two reports | Incremental mode | `references/incremental-orchestrator.md` | Treat the older report or commit as baseline and the newer state as target. |33| Analyze a repo, generate a DFD, perform STRIDE-A, validate controls, identify trust boundaries | Single analysis mode | `references/orchestrator.md` | Execute the complete 10-step workflow and create architecture, DFD, STRIDE-A, prioritized findings, and executive assessment outputs. |3435## STRIDE-A analysis map3637| Area | Inspect | Evidence standard |38| --- | --- | --- |39| Spoofing | Authentication entry points, session creation, identity propagation, service-to-service credentials | Show the live owner path and the exact boundary where identity is asserted or trusted. |40| Tampering | Request validation, persistence writes, queues, deserialization, infrastructure mutation | Prove whether integrity controls exist before flagging a write path. |41| Repudiation | Audit logs, actor attribution, request IDs, immutable event trails | Distinguish absent evidence from weak evidence; do not infer auditability from generic logging. |42| Information disclosure | Secrets, tokens, PII, debug output, storage policies, cross-tenant data flows | Verify the data class, exposure route, and trust boundary. |43| Denial of service | Rate limits, pagination, expensive queries, fan-out, retries, queue backpressure | Tie the risk to an externally triggerable path or operational limit. |44| Elevation of privilege | Authorization checks, admin paths, object-level access, role transitions | Require code or configuration evidence for both the caller role and protected action. |45| Abuse | Business-logic misuse, workflow bypass, fraud paths, unsafe automation | Model the malicious but protocol-valid user, not only broken inputs. |4647## Report artifacts4849| Artifact | Use | Required content |50| --- | --- | --- |51| `0.1-architecture.md` | Architecture overview | Components, trust boundaries, entry points, data stores, assumptions, and Mermaid architecture diagrams. |52| `1-threatmodel.md` | Threat inventory | DFD elements, data flows, STRIDE-A threats, mitigations, and open questions. |53| `2-stride-analysis.md` | STRIDE heatmap | Component-by-component and flow-by-flow STRIDE-A coverage with severity rationale. |54| `3-findings.md` | Prioritized findings | Exploit path, affected assets, evidence, likelihood, impact, CVSS 4.0, CWE, OWASP, and remediation. |55| `0-assessment.md` | Executive assessment | Security posture, critical decisions, residual risk, and recommended next steps. |56| `threat-inventory.json` | Incremental baseline | Stable identifiers, current status, evidence anchors, and comparison-ready metadata. |5758## Progressive disclosure and bundled resources5960Read only the resource needed for the current phase, then follow it exactly.6162| Resource | Read when | Contains |63| --- | --- | --- |64| `references/orchestrator.md` | Starting any single analysis | Complete 10-step workflow, 34 mandatory rules, tool usage, sub-agent governance, and verification process. |65| `references/incremental-orchestrator.md` | Updating, refreshing, re-running, or comparing reports or commits | Baseline loading, old skeleton inheritance, change detection, status annotations, HTML comparison, STRIDE heatmap diff, and findings diff. |66| `references/analysis-principles.md` | Judging security issues | Verify-before-flagging rules, security infrastructure inventory, OWASP Top 10:2025, platform defaults, exploitability tiers, and severity standards. |67| `references/diagram-conventions.md` | Creating any Mermaid diagram | Color palette, shapes, sidecar co-location rules, DFD style, architecture style, sequence diagram style, and pre-render checklist. |68| `references/output-formats.md` | Writing report files | Templates and common mistakes checklist for `0.1-architecture.md`, `1-threatmodel.md`, `2-stride-analysis.md`, `3-findings.md`, and `0-assessment.md`. |69| `references/skeletons/` | Before writing each output file | Verbatim `skeleton-*.md` fill-in structures; copy the relevant skeleton and replace `[FILL]` placeholders. |70| `references/verification-checklist.md` | Inline checks and final pass | Per-file structure, diagram rendering, cross-file consistency, evidence quality, JSON schema, and delegated verification checklist. |71| `references/tmt-element-taxonomy.md` | Identifying DFD elements from code | TMT-compatible element type taxonomy, trust boundary detection, data flow patterns, and code analysis checklist. |7273## Gotchas7475- **Do not skip the orchestrator**: the body of this skill is only the router; `orchestrator.md` and `incremental-orchestrator.md` are the executable source of truth.76- **Do not flag without verification**: every finding needs code, configuration, runtime, or report evidence tied to an exploitable path.77- **Do not break incremental continuity**: preserve stable threat identifiers where the issue is still-present, and mark resolved items only after checking current code.78- **Do not invent diagrams**: Mermaid DFD and architecture diagrams must reflect discovered components, flows, and trust boundaries.7980## Baseline terminology and continuity8182Preserve trigger examples and report mechanics from previous versions: `FIRST` choose mode, read the relevant orchestrator before writing `EACH` output file, copy skeletons `VERBATIM`, use `threat-model-20260309-174425` as a representative baseline folder name, allow a baseline to be `auto-detected`, accept `commit/HEAD` targets, support `Incremental/update` and `follow-up` requests, track `threats/findings`, use `on-demand` resource loading, and run `per-file` `quick-checks`. Apply Zero Trust, STRIDE-A, and `defense-in-depth` analysis throughout.83## Output template8485```markdown86## Threat model result — <system or repository>8788**Mode:** single analysis | incremental analysis | comparison89**Baseline:** <none | threat-model-* folder | commit/report>90**Target:** <HEAD | commit | report>91**Status:** complete | partial | blocked9293### Artifacts94| File | Purpose | Status |95| --- | --- | --- |96| `0.1-architecture.md` | Architecture overview and diagrams | created | updated | blocked |97| `1-threatmodel.md` | Threat inventory and DFD | created | updated | blocked |98| `2-stride-analysis.md` | STRIDE-A heatmap and analysis | created | updated | blocked |99| `3-findings.md` | Prioritized findings | created | updated | blocked |100| `0-assessment.md` | Executive assessment | created | updated | blocked |101| `threat-inventory.json` | Machine-readable inventory | created | updated | blocked |102103### Findings summary104| Severity | New | Still present | Resolved | Notes |105| --- | ---: | ---: | ---: | --- |106| Critical | <n> | <n> | <n> | <summary> |107| High | <n> | <n> | <n> | <summary> |108| Medium | <n> | <n> | <n> | <summary> |109| Low | <n> | <n> | <n> | <summary> |110111### Verification112- Orchestrator followed: pass | fail113- Skeletons used verbatim before fill-in: pass | fail114- Diagrams pre-render checked: pass | fail115- Evidence anchors present for every finding: pass | fail116```117118## Quality gate119120- [ ] The request matched an explicit threat model, incremental update, comparison, or `/threat-model-analyst` trigger.121- [ ] Single analysis read `references/orchestrator.md`; incremental analysis read `references/incremental-orchestrator.md`.122- [ ] Every output file started from the relevant `references/skeletons/skeleton-*.md` file before `[FILL]` replacement.123- [ ] STRIDE-A covers spoofing, tampering, repudiation, information disclosure, denial of service, elevation of privilege, and abuse.124- [ ] Every finding has evidence, affected boundary or asset, severity rationale, and CVSS 4.0 / CWE / OWASP mapping where applicable.125- [ ] Incremental output distinguishes new, resolved, and still-present threats and preserves baseline continuity.126- [ ] Mermaid diagrams follow `references/diagram-conventions.md` and passed the pre-render checklist.127- [ ] `threat-inventory.json` exists for report folders that can serve as future baselines.
paulasilvatech