About

Imported from bobmatnyc/claude-mpm-skills (universal/security/threat-modeling/SKILL.md) via skills.sh. Install upstream with npx skills add bobmatnyc/claude-mpm-skills --skill threat-modeling. Copyright stays with the author (MIT).

Threat Modeling (STRIDE)

Name: threat-modeling
Author: bobmatnyc

Workflow

Scope — Identify the system boundary, assets (PII, credentials, payments), and availability requirements (SLO/SLA).
Data Flow Diagram — Map actors, entry points, data stores, and external dependencies. Mark trust boundaries (public internet → edge → internal → database → third-party).
STRIDE per element — For each element in the diagram, walk through all six STRIDE categories (Spoofing, Tampering, Repudiation, Information disclosure, Denial of service, Elevation of privilege) and record threats.
Risk score — Rate each threat by Impact (Low/Med/High) and Likelihood (Low/Med/High). Prioritize High-impact + Med/High-likelihood items first.
Mitigate — Convert each prioritized threat into engineering tasks, verification tasks (tests, alerts), and operational controls (runbooks, access reviews).
Tickets and tests — Create backlog items for mitigations and add abuse-case tests for critical flows. Add PR checklist items for ongoing verification.

Example: Threat Register Row

Element	STRIDE	Threat	Impact	Likelihood	Mitigation	Owner	Status
API Gateway	Spoofing	Stolen JWT reuse after session revocation	High	Med	Short-lived tokens (15 min TTL), refresh rotation, revocation list check on each request	Security	Open

This single row drives three artifacts: an engineering ticket (implement revocation-list middleware), a test (verify revoked token returns 401 within TTL window), and a PR checklist item (authz checks for new endpoints).

Validation Checkpoint

Before finalizing, verify completeness:

Every element in the data flow diagram has at least one STRIDE entry
All High-impact threats have an assigned owner and mitigation
Each mitigation maps to a backlog ticket or test case
Threat model doc includes assumptions and scope boundaries
PR checklist updated with new security requirements

Outputs (Definition of Done)

Produce a data flow diagram, a threat register, and a mitigation plan that becomes tickets and tests.

Load Next (References)

references/stride-workshop.md — step-by-step workshop agenda + DFD guidance
references/common-threats-and-mitigations.md — threat catalog with mitigations
references/templates.md — copy/paste templates for docs and tickets

Use it

Copy one of these into your project. Installing also returns the manifest and these snippets.

yaml

targets:
  - https://api.opensmartroute.ai/api/v1/registry/bobmatnyc-claude-mpm-skills-threat-modeling/manifest   # or paste the manifest below

Manifest

An Open Capability Manifest: the router reads it to know what this does, what it costs and when to pick it.

bobmatnyc-claude-mpm-skills-threat-modeling.ocm.jsonjson

{
  "ocm": "1",
  "id": "bobmatnyc-claude-mpm-skills-threat-modeling",
  "kind": "skill",
  "name": "threat-modeling",
  "description": "Threat modeling workflow for software systems: scope, data flow diagrams, STRIDE analysis, risk scoring, and turning mitigations into backlog and tests. Use when designing new features, reviewing architecture changes, handling sensitive data, or hardening auth/payment/multi-tenant flows.",
  "publisher": "bobmatnyc",
  "version": "1.0.0",
  "capabilities": {
    "domains": [
      "coding"
    ],
    "tags": [
      "skill-md",
      "security",
      "threat-modeling",
      "stride",
      "architecture",
      "risk",
      "skills-sh"
    ],
    "languages": [
      "en"
    ]
  },
  "quality_prior": 0.6,
  "examples": [
    "Threat modeling workflow for software systems: scope, data flow diagrams, STRIDE analysis, risk scoring, and turning mitigations into backlog and tests. Use when designing new features, reviewing architecture changes, handling sensitive data, or hardening auth/payment/multi-tenant flows."
  ],
  "primary": false,
  "metadata": {
    "source": {
      "provider": "skills.sh",
      "repository": "https://github.com/bobmatnyc/claude-mpm-skills",
      "path": "universal/security/threat-modeling/SKILL.md",
      "ref": "HEAD",
      "url": "https://www.skills.sh/bobmatnyc/claude-mpm-skills/threat-modeling",
      "key": "bobmatnyc/claude-mpm-skills/universal/security/threat-modeling/SKILL.md"
    },
    "license": "MIT"
  },
  "instructions": "# Threat Modeling (STRIDE)\n\n## Workflow\n\n1. **Scope** — Identify the system boundary, assets (PII, credentials, payments), and availability requirements (SLO/SLA).\n2. **Data Flow Diagram** — Map actors, entry points, data stores, and external dependencies. Mark trust boundaries (public internet → edge → internal → database → third-party).\n3. **STRIDE per element** — For each element in the diagram, walk through all six STRIDE categories (Spoofing, Tampering, Repudiation, Information disclosure, Denial of service, Elevation of privilege) and record threats.\n4. **Risk score** — Rate each threat ",
  "cost": {
    "context_tokens": 610
  }
}

Fetch it by URL: GET /api/v1/registry/bobmatnyc-claude-mpm-skills-threat-modeling/manifest?version=1.0.0

Reviews

Star ratings from people who tried it. One review per account; edit yours any time.

No reviews yet. Install it, try it, and be the first to rate it.