Threat Model Analyst
GitHubOfficialFirst committed by cheguvDistributed by GitHub
- Skill
- Review and audit
- Security
- MIT
- No issues found
AutoGineer summary
Written by AutoGineer from the skill’s own files, not by the author
Threat Model Analyst is a specialized agent skill designed to perform rigorous security audits using the STRIDE-A (STRIDE + Abuse) methodology. It operates in two primary modes: a full initial analysis for new systems and an incremental mode for tracking security posture changes over time. The skill enforces strict architectural modeling rules, particularly regarding Kubernetes sidecar co-location, and provides structured, evidence-based reporting including DFD diagrams, prioritized findings, and executive assessments.
What it does
- Performs full STRIDE-A threat modeling including DFD generation and architectural risk assessment.
- Executes incremental analysis to track new, resolved, and persistent threats between code versions.
- Identifies security gaps by verifying infrastructure components and platform defaults before flagging.
- Generates standardized security reports including architecture overviews and prioritized findings.
- Maps security findings to industry standards like CVSS 4.0, CWE, and OWASP.
- Enforces consistent diagramming conventions for complex system architectures.
When to use it
- When you need a comprehensive security audit of a new repository or system architecture.
- When you need to update an existing threat model to reflect recent code changes.
- When you need to compare the security posture between two specific commits or report versions.
- When you need to identify trust boundary violations or architectural security risks.
Advantages
- Reduces false positives by requiring evidence-based verification of security controls.
- Maintains continuity in security documentation through incremental change tracking.
- Ensures architectural diagrams accurately reflect Kubernetes pod-level sidecar co-location.
- Provides actionable, prioritized security findings mapped to recognized industry frameworks.
Usage examples
- “Perform a full STRIDE-A threat model analysis on this repository.”
- The agent will analyze the codebase, generate architecture diagrams, identify threats, and produce a comprehensive security report.
- “Run an incremental threat model analysis using the report from last week as a baseline.”
- The agent will compare the current codebase against the previous report to identify new, fixed, or remaining security threats.
Install
Download the skill as a ZIP:
https://mp-staging.autogineer.com/agent-skills/github/threat-model-analyst/downloadUnzip it into the cross-client skills folder of your project:
mkdir -p .agents/skills && unzip threat-model-analyst.zip -d .agents/skills
Documentation by cheguv
Threat Model Analyst
You are an expert Threat Model Analyst. You perform security audits using STRIDE-A (STRIDE + Abuse) threat modeling, Zero Trust principles, and defense-in-depth analysis. You flag secrets, insecure boundaries, and architectural risks.
Getting Started
FIRST — Determine which mode to use based on the user's request:
Incremental Mode (Preferred for Follow-Up Analyses)
If the user's request mentions updating, refreshing, or re-running a threat model AND a prior report folder exists:
Action words: "update", "refresh", "re-run", "incremental", "what changed", "since last analysis"
AND a baseline report folder is identified (either explicitly named or auto-detected as the most recent
threat-model-*folder with athreat-inventory.json)OR the user explicitly provides a baseline report folder + a target commit/HEAD
Examples that trigger incremental mode:
"Update the threat model using threat-model-20260309-174425 as the baseline"
"Run an incremental threat model analysis"
"Refresh the threat model for the latest commit"
"What changed security-wise since the last threat model?"
→ Read incremental-orchestrator.md and follow the incremental workflow. The incremental orchestrator inherits the old report's structure, verifies each item against current code, discovers new items, and produces a standalone report with embedded comparison.
Comparing Commits or Reports
If the user asks to compare two commits or two reports, use incremental mode with the older report as the baseline. → Read incremental-orchestrator.md and follow the incremental workflow.
Single Analysis Mode
For all other requests (analyze a repo, generate a threat model, perform STRIDE analysis):
→ Read orchestrator.md — it contains the complete 10-step workflow, 34 mandatory rules, tool usage instructions, sub-agent governance rules, and the verification process. Do not skip this step.
Reference Files
Load the relevant file when performing each task:
| File | Use When | Content |
|---|---|---|
| Orchestrator | Always — read first | Complete 10-step workflow, 34 mandatory rules, sub-agent governance, tool usage, verification process |
| Incremental Orchestrator | Incremental/update analyses | Complete incremental workflow: load old skeleton, change detection, generate report with status annotations, HTML comparison |
| Analysis Principles | Analyzing code for security issues | Verify-before-flagging rules, security infrastructure inventory, OWASP Top 10:2025, platform defaults, exploitability tiers, severity standards |
| Diagram Conventions | Creating ANY Mermaid diagram | Color palette, shapes, sidecar co-location rules, pre-render checklist, DFD vs architecture styles, sequence diagram styles |
| Output Formats | Writing ANY output file | Templates for 0.1-architecture.md, 1-threatmodel.md, 2-stride-analysis.md, 3-findings.md, 0-assessment.md, common mistakes checklist |
| Skeletons | Before writing EACH output file | 8 verbatim fill-in skeletons (skeleton-*.md) — read the relevant skeleton, copy VERBATIM, fill [FILL] placeholders. One skeleton per output file. Loaded on-demand to minimize context usage. |
| Verification Checklist | Final verification pass + inline quick-checks | All quality gates: inline quick-checks (run after each file write), per-file structural, diagram rendering, cross-file consistency, evidence quality, JSON schema — designed for sub-agent delegation |
| TMT Element Taxonomy | Identifying DFD elements from code | Complete TMT-compatible element type taxonomy, trust boundary detection, data flow patterns, code analysis checklist |
When to Activate
Incremental Mode (read incremental-orchestrator.md for workflow):
Update or refresh an existing threat model analysis
Generate a new analysis that builds on a prior report's structure
Track what threats/findings were fixed, introduced, or remain since a baseline
When a prior
threat-model-*folder exists and the user wants a follow-up analysis
Single Analysis Mode:
Perform full threat model analysis of a repository or system
Generate threat model diagrams (DFD) from code
Perform STRIDE-A analysis on components and data flows
Validate security control implementations
Identify trust boundary violations and architectural risks
Write prioritized security findings with CVSS 4.0 / CWE / OWASP mappings
Comparing commits or reports:
To compare security posture between commits, use incremental mode with the older report as baseline
Files
- ATTRIBUTION.mdAdded by AutoGineer869 B
- LICENSELicence file added by AutoGineer1.0 KiB
- SKILL.md5.7 KiB
- references/analysis-principles.md28.9 KiB
- references/diagram-conventions.md18.5 KiB
- references/incremental-orchestrator.md33.5 KiB
- references/orchestrator.md53.8 KiB
- references/output-formats.md58.5 KiB
- references/skeletons/skeleton-architecture.md6.1 KiB
- references/skeletons/skeleton-assessment.md11.1 KiB
- references/skeletons/skeleton-dfd.md3.3 KiB
- references/skeletons/skeleton-findings.md7.7 KiB
- references/skeletons/skeleton-incremental-html.md5.3 KiB
- references/skeletons/skeleton-inventory.md5.3 KiB
- references/skeletons/skeleton-stride-analysis.md6.2 KiB
- references/skeletons/skeleton-summary-dfd.md2.8 KiB
- references/skeletons/skeleton-threatmodel.md2.2 KiB
- references/tmt-element-taxonomy.md8.5 KiB
- references/verification-checklist.md69.9 KiB
Requirements and compatibility
Written for: GitHub Copilot
Works with: Claude Code, Claude apps, OpenAI Codex, GitHub Copilot, Cursor, Gemini CLI, Kiro, OpenCode, Goose, Amp, Roo Code, JetBrains Junie, Factory Droid, Devin (ex-Windsurf), Mistral Vibe, OpenHands, Letta
“Works with” means the tool reads the open Agent Skills format; a skill written for one tool may use features others lack.
Security
No issues found by our static scan· No issues found
A static scan is not a guarantee. Skills are third-party content: review a skill before you let an agent use it.
Attribution and licence
- First committed by
cheguv
- Publisher
- GitHub (Official)
- Distributed by
- GitHub
- Source
- github/awesome-copilot · skills/threat-model-analyst · commit 797337f
- Licence
- MIT License (redistribution allowed)
- LICENSE (added by AutoGineer from LICENSE)
- ATTRIBUTION.md (written by AutoGineer)
- Synced
- Contributors
- cheguv, stbenjam
AutoGineer is not affiliated with or endorsed by cheguv or GitHub.
Related skills
Security Audit
CloudflareOfficial
A structured, source-first security audit and vulnerability research framework for codebases and services.
SecurityClaude CodeClaude appsOpenAI Codex+14 moreMITLow riskHas scriptsGitHub stars of the source repository65.3k
Sast Configuration
Seth Hobson· Community
Configure and optimize Static Application Security Testing (SAST) tools like Semgrep, SonarQube, and CodeQL for automated vulnerability detection.
SecurityClaude CodeClaude appsOpenAI Codex+14 moreMITLow riskGitHub stars of the source repository42.3k
Firmware Analyst
Seth Hobson· Community
An expert firmware analyst providing structured guidance for embedded systems security, reverse engineering, and vulnerability research.
SecurityClaude CodeMITLow riskGitHub stars of the source repository42.3k
Policy Enforcer
Seth Hobson· Community
Expert guide for authoring and auditing Cedar authorization policies to secure Claude Code agent tool interactions.
SecurityClaude CodeMITGitHub stars of the source repository42.3k
Backend Development Security Auditor
Seth Hobson· Community
A specialized security auditor for identifying vulnerabilities in backend code and architecture during feature development.
SecurityClaude CodeMITGitHub stars of the source repository42.3k
Memory Forensics
Seth Hobson· Community
Master memory forensics and incident response using the Volatility framework and industry-standard acquisition tools.
SecurityClaude CodeClaude appsOpenAI Codex+14 moreMITLow riskGitHub stars of the source repository42.3k
Download ZIP
The ZIP holds the skill’s files, its licence files and an ATTRIBUTION.md. Download threat-model-analyst.zip