How do I install the Threat Model skill?

Run npx skillmds@latest add tomevault-io/threat-model in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is Threat Model safe to use?

This skill has not completed SkillMD's automated safety review yet. Independent scanners report: SkillSpector: PASS, Skill Scanner: PASS. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Threat Model?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Threat Model free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published Threat Model?

tomevault-io (@tomevault-io) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Threat Model by tomevault-io — Agent Skill

Name: Threat Model
Author: tomevault-io

Threat Model

Perform STRIDE threat modeling on the application architecture. Use when user says "threat model", "STRIDE analysis", "identify threats", or "security architecture review". Systematically identifies threats, assesses risks with DREAD scoring, and recommends mitigations. Use when this capability is needed.

tomevault-io Updated Sep 17, 2026

File contents

Threat Modeling

Perform systematic threat modeling on $ARGUMENTS using STRIDE methodology.

Reference: Microsoft Threat Modeling

Modeling Strategy

Identify the system scope and assets
Create a Data Flow Diagram (DFD)
Identify trust boundaries
Apply STRIDE to each component and data flow
Assess risk severity using DREAD
Prioritize and recommend mitigations

Dynamic Context

Architecture overview: !cat README.md 2>/dev/null | head -50 || cat ARCHITECTURE.md 2>/dev/null | head -50 || echo "No architecture docs found"

References

Topic	Reference	Use for
STRIDE Framework	references/stride-framework.md	Full S/T/R/I/D/E categories with attack vectors, mitigations, audit questions
DREAD Assessment	references/dread-assessment.md	Risk scoring methodology, score guides, example calculations
Output Format	references/output-format.md	DFD notation, report template, attack trees
Architecture Patterns	references/architecture-patterns.md	Microservices, serverless, SPA threat focus areas

Related Skills

security-scan - Automated vulnerability scanning
review-code - Code-level security review
protocol-check - Protocol security analysis

Resources

Guardrails

Prefer measured evidence over blanket rules of thumb.
Ask for explicit human approval before destructive data operations (drops/deletes/truncates).

Source: gr1m0h/dot — distributed by TomeVault.

---name: threat-modeldescription: Perform STRIDE threat modeling on the application architecture. Use when user says "threat model", "STRIDE analysis", "identify threats", or "security architecture review". Systematically identifies threats, assesses risks with DREAD scoring, and recommends mitigations. Use when this capability is needed.---# Threat ModelingPerform systematic threat modeling on $ARGUMENTS using STRIDE methodology.**Reference:** [Microsoft Threat Modeling](https://learn.microsoft.com/en-us/azure/security/develop/threat-modeling-tool)## Modeling Strategy1. Identify the system scope and assets2. Create a Data Flow Diagram (DFD)3. Identify trust boundaries4. Apply STRIDE to each component and data flow5. Assess risk severity using DREAD6. Prioritize and recommend mitigations## Dynamic ContextArchitecture overview:!`cat README.md 2>/dev/null | head -50 || cat ARCHITECTURE.md 2>/dev/null | head -50 || echo "No architecture docs found"`Authentication components:!`grep -rl "auth\|jwt\|session\|oauth\|passport" --include="*.py" --include="*.js" --include="*.ts" --include="*.go" 2>/dev/null | head -10`Data stores:!`grep -rl "database\|redis\|mongo\|postgres\|mysql\|sqlite" --include="*.py" --include="*.js" --include="*.ts" --include="*.go" --include="*.yaml" --include="*.yml" 2>/dev/null | head -10`API endpoints:!`grep -rn "app\.$get\|post\|put\|delete\|patch$\|@app\.route\|router\.\|@Get\|@Post" --include="*.py" --include="*.js" --include="*.ts" 2>/dev/null | head -15`## References| Topic | Reference | Use for || --- | --- | --- || STRIDE Framework | [references/stride-framework.md](references/stride-framework.md) | Full S/T/R/I/D/E categories with attack vectors, mitigations, audit questions || DREAD Assessment | [references/dread-assessment.md](references/dread-assessment.md) | Risk scoring methodology, score guides, example calculations || Output Format | [references/output-format.md](references/output-format.md) | DFD notation, report template, attack trees || Architecture Patterns | [references/architecture-patterns.md](references/architecture-patterns.md) | Microservices, serverless, SPA threat focus areas |## Related Skills- [security-scan](/security-scan) - Automated vulnerability scanning- [review-code](/review-code) - Code-level security review- [protocol-check](/protocol-check) - Protocol security analysis## Resources- [STRIDE Threat Model](https://learn.microsoft.com/en-us/azure/security/develop/threat-modeling-tool-threats)- [OWASP Threat Modeling](https://owasp.org/www-community/Threat_Modeling)- [MITRE ATT&CK](https://attack.mitre.org/)- [NIST SP 800-154](https://csrc.nist.gov/publications/detail/sp/800-154/draft)## Guardrails- Prefer measured evidence over blanket rules of thumb.- Ask for explicit human approval before destructive data operations (drops/deletes/truncates).---> Source: [gr1m0h/dot](https://github.com/gr1m0h/dot) — distributed by [TomeVault](https://tomevault.io).

Frequently asked questions