Threat Modeling Skill

Analyze a project's architecture and produce a security reference document that describes assets, trust boundaries, applicable threat categories, and the security guarantees the project must uphold.

When to Use

• New project kickoff or initial architecture review
• A new feature introduces authentication, data storage, network exposure, or third-party integrations
• Pre-deploy or pre-launch security review
• The user explicitly asks for a threat model or security analysis
• After a significant architectural change (new microservice, new database, new external API)

When NOT to Use

• Cosmetic or UI-only changes with no security surface
• Pure refactors that do not change trust boundaries, data flows, or access control
• One-off bug fixes unrelated to security

Methodology