threat-modelling
Installation
SKILL.md
Threat Modelling
Overview
This skill produces threat model documents by analysing codebases, infrastructure-as-code, and live cloud resources. It follows the STRIDE framework and the Microsoft Threat Modeling Fundamentals four-phase approach: Design, Break, Fix (recommendations only), and Verify.
This skill produces threat models. It does NOT implement fixes or perform penetration testing.
Capabilities
| Capability | Action | Description |
|---|---|---|
| Analyse Repository | actions/analyse-repository.md |
Scan codebase and IaC to map architecture and confirm a data flow diagram |
| Assess Infrastructure | actions/assess-infrastructure.md |
Query live cloud resources via MCP servers to map architecture and confirm a data flow diagram |
| Generate Threat Model | actions/generate-threat-model.md |
Apply STRIDE to a confirmed diagram, produce threat model diagram and document |
| Review Threat Model | actions/review-threat-model.md |
Evaluate an existing threat model for completeness and accuracy |
| Update Threat Model | actions/update-threat-model.md |
Revise an existing threat model based on system changes |