# Threat Modeler

> Builds asset- and STRIDE-based threat models before deep security audits. Use for new features touching auth, data, trust boundaries, or HighRisk specs. Emits THREAT_MODEL. Never invents exploits or replaces security-auditor findings.

- Skill: `willianbs/threat-modeler` (Agent Skill, multi-file: 2 files)
- Install (CLI): `npx skillmds@latest add willianbs/threat-modeler`
- Raw SKILL.md: https://api.skillmd.com/api/skills/willianbs/threat-modeler/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- Author: willianbs (https://skillmd.com/u/willianbs)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/willianbs/threat-modeler

---


# Purpose

Produce a structured threat model (assets, trust boundaries, STRIDE abuse cases, prioritized threats) that security-auditor and delivery-planner can consume.

# When to Use / When NOT to Use

**Use when:** new HighRisk features; auth/PII/payments/integrations; before security-auditor on greenfield surfaces; architecture changes that move trust boundaries.

**Do not use when:** style-only PRs; trivial chores; full vuln hunting (security-auditor); active exploit response without modeling first is OK to skip lite.

# Preconditions

Scope (feature/system) and enough CONTEXT_PACK to identify actors, data, and boundaries. If missing, ask before inventing assets.

# Inputs / Outputs

**Inputs:** feature/system scope, CONTEXT_PACK, SPEC_STATUS (preferred), data classification if known.

**Outputs:** `THREAT_MODEL`

# Upstream / Downstream

**Upstream:** context-loader, spec-validator, delivery-planner, engineering-os.

**Downstream:** security-auditor, delivery-planner, adr-enforcer, test-strategy-designer.

# Core Principles

1. Assets and trust boundaries before checklists.
2. STRIDE-light: Spoofing, Tampering, Repudiation, Info disclosure, DoS, Elevation.
3. Threats need actor + asset + abuse path.
4. Prioritize by Likelihood × Impact; mark assumptions.
5. Feed security-auditor — do not duplicate deep code audit.
6. Redact secrets; never invent CVEs.
7. Unknown boundaries → ProceedWithConditions, not fake completeness.

# Process

## Lite
Single feature / small API: list assets, 2–4 trust boundaries, top STRIDE threats, hand off.

## Full
1. **Actors** — users, admins, services, attackers, insiders.
2. **Assets** — data, secrets, sessions, money, admin actions, reputation.
3. **Diagram (textual)** — components and trust boundaries.
4. **STRIDE pass** per boundary/asset.
5. **Threat list** — ID, description, likelihood, impact, severity, mitigations (existing vs needed).
6. **Out of scope** — explicitly list.
7. Decision: Proceed to security-auditor / Revise design / Block if Critical unmitigated design flaw.

# Evidence Requirements

Cite real modules/APIs from CONTEXT_PACK. Label assumptions. No invented endpoints.

# Stop Conditions / Failure Modes

| Condition | Action |
|-----------|--------|
| Cannot identify assets/boundaries | Ask; Block if HighRisk |
| Design has Critical unmitigated threat | Block until design change or accepted risk |
| Scope is pure UI copy | Refuse; not applicable |

# Severity + Confidence

Threat severity uses portfolio standard. Critical = auth bypass / mass data exposure / RCE-class design flaws.

# Output Contract

```
## THREAT_MODEL
Scope: ...
Actors: ...
Assets: ...
Trust boundaries: ...
Threats:
  - ID, STRIDE, severity, likelihood, impact, mitigations
Assumptions: ...
Decision: Proceed | ProceedWithConditions | Revise | Block
```

# Handoffs

**security-auditor** (primary), **adr-enforcer** (security architecture), **test-strategy-designer** (negative cases), **delivery-planner** (mitigation tasks).

# Never

- Never invent vulnerabilities in code you did not reason about.
- Never print secrets.
- Never replace security-auditor with a shallow STRIDE table alone for ship decisions.
- Never skip assets/boundaries and jump to OWASP laundry lists.