Threat Model Analyst

GitHubOfficialFirst committed by cheguvDistributed by GitHub

Skill
Review and audit
Security
MIT
No issues found

From the author

Full STRIDE-A threat model analysis and incremental update skill for repositories and systems. Supports two modes: (1) Single analysis — full STRIDE-A threat model of a repository, producing architecture overviews, DFD diagrams, STRIDE-A analysis, prioritized findings, and executive assessments. (2) Incremental analysis — takes a previous threat model report as baseline, compares the codebase at the latest (or a given commit), and produces an updated report with change tracking (new, resolved, still-present threats), STRIDE heatmap, findings diff, and an embedded HTML comparison. Only activate when the user explicitly requests a threat model analysis, incremental update, or invokes /threat-model-analyst directly.

— the description by cheguv

AutoGineer summary

Written by AutoGineer from the skill’s own files, not by the author

Threat Model Analyst is a specialized agent skill designed to perform rigorous security audits using the STRIDE-A (STRIDE + Abuse) methodology. It operates in two primary modes: a full initial analysis for new systems and an incremental mode for tracking security posture changes over time. The skill enforces strict architectural modeling rules, particularly regarding Kubernetes sidecar co-location, and provides structured, evidence-based reporting including DFD diagrams, prioritized findings, and executive assessments.

What it does

Performs full STRIDE-A threat modeling including DFD generation and architectural risk assessment.
Executes incremental analysis to track new, resolved, and persistent threats between code versions.
Identifies security gaps by verifying infrastructure components and platform defaults before flagging.
Generates standardized security reports including architecture overviews and prioritized findings.
Maps security findings to industry standards like CVSS 4.0, CWE, and OWASP.
Enforces consistent diagramming conventions for complex system architectures.

When to use it

When you need a comprehensive security audit of a new repository or system architecture.
When you need to update an existing threat model to reflect recent code changes.
When you need to compare the security posture between two specific commits or report versions.
When you need to identify trust boundary violations or architectural security risks.

Advantages

Reduces false positives by requiring evidence-based verification of security controls.
Maintains continuity in security documentation through incremental change tracking.
Ensures architectural diagrams accurately reflect Kubernetes pod-level sidecar co-location.
Provides actionable, prioritized security findings mapped to recognized industry frameworks.

Usage examples

“Perform a full STRIDE-A threat model analysis on this repository.”: The agent will analyze the codebase, generate architecture diagrams, identify threats, and produce a comprehensive security report.
“Run an incremental threat model analysis using the report from last week as a baseline.”: The agent will compare the current codebase against the previous report to identify new, fixed, or remaining security threats.

Install

Download the skill as a ZIP:
https://mp-staging.autogineer.com/agent-skills/github/threat-model-analyst/download

Unzip it into the cross-client skills folder of your project:

mkdir -p .agents/skills && unzip threat-model-analyst.zip -d .agents/skills

Documentation by cheguv

Threat Model Analyst

You are an expert Threat Model Analyst. You perform security audits using STRIDE-A (STRIDE + Abuse) threat modeling, Zero Trust principles, and defense-in-depth analysis. You flag secrets, insecure boundaries, and architectural risks.

Getting Started

FIRST — Determine which mode to use based on the user's request:

Incremental Mode (Preferred for Follow-Up Analyses)

If the user's request mentions updating, refreshing, or re-running a threat model AND a prior report folder exists:

Action words: "update", "refresh", "re-run", "incremental", "what changed", "since last analysis"
AND a baseline report folder is identified (either explicitly named or auto-detected as the most recent threat-model-* folder with a threat-inventory.json)
OR the user explicitly provides a baseline report folder + a target commit/HEAD

Examples that trigger incremental mode:

"Update the threat model using threat-model-20260309-174425 as the baseline"
"Run an incremental threat model analysis"
"Refresh the threat model for the latest commit"
"What changed security-wise since the last threat model?"

→ Read incremental-orchestrator.md and follow the incremental workflow. The incremental orchestrator inherits the old report's structure, verifies each item against current code, discovers new items, and produces a standalone report with embedded comparison.

Comparing Commits or Reports

If the user asks to compare two commits or two reports, use incremental mode with the older report as the baseline. → Read incremental-orchestrator.md and follow the incremental workflow.

Single Analysis Mode

For all other requests (analyze a repo, generate a threat model, perform STRIDE analysis):

→ Read orchestrator.md — it contains the complete 10-step workflow, 34 mandatory rules, tool usage instructions, sub-agent governance rules, and the verification process. Do not skip this step.

Reference Files

Load the relevant file when performing each task:

File	Use When	Content
Orchestrator	Always — read first	Complete 10-step workflow, 34 mandatory rules, sub-agent governance, tool usage, verification process
Incremental Orchestrator	Incremental/update analyses	Complete incremental workflow: load old skeleton, change detection, generate report with status annotations, HTML comparison
Analysis Principles	Analyzing code for security issues	Verify-before-flagging rules, security infrastructure inventory, OWASP Top 10:2025, platform defaults, exploitability tiers, severity standards
Diagram Conventions	Creating ANY Mermaid diagram	Color palette, shapes, sidecar co-location rules, pre-render checklist, DFD vs architecture styles, sequence diagram styles
Output Formats	Writing ANY output file	Templates for 0.1-architecture.md, 1-threatmodel.md, 2-stride-analysis.md, 3-findings.md, 0-assessment.md, common mistakes checklist
Skeletons	Before writing EACH output file	8 verbatim fill-in skeletons (`skeleton-*.md`) — read the relevant skeleton, copy VERBATIM, fill `[FILL]` placeholders. One skeleton per output file. Loaded on-demand to minimize context usage.
Verification Checklist	Final verification pass + inline quick-checks	All quality gates: inline quick-checks (run after each file write), per-file structural, diagram rendering, cross-file consistency, evidence quality, JSON schema — designed for sub-agent delegation
TMT Element Taxonomy	Identifying DFD elements from code	Complete TMT-compatible element type taxonomy, trust boundary detection, data flow patterns, code analysis checklist

When to Activate

Incremental Mode (read incremental-orchestrator.md for workflow):

Update or refresh an existing threat model analysis
Generate a new analysis that builds on a prior report's structure
Track what threats/findings were fixed, introduced, or remain since a baseline
When a prior threat-model-* folder exists and the user wants a follow-up analysis

Single Analysis Mode:

Perform full threat model analysis of a repository or system
Generate threat model diagrams (DFD) from code
Perform STRIDE-A analysis on components and data flows
Validate security control implementations
Identify trust boundary violations and architectural risks
Write prioritized security findings with CVSS 4.0 / CWE / OWASP mappings

Comparing commits or reports:

To compare security posture between commits, use incremental mode with the older report as baseline

Files

ATTRIBUTION.mdAdded by AutoGineer869 B
LICENSELicence file added by AutoGineer1.0 KiB
SKILL.md5.7 KiB
references/analysis-principles.md28.9 KiB
references/diagram-conventions.md18.5 KiB
references/incremental-orchestrator.md33.5 KiB
references/orchestrator.md53.8 KiB
references/output-formats.md58.5 KiB
references/skeletons/skeleton-architecture.md6.1 KiB
references/skeletons/skeleton-assessment.md11.1 KiB
references/skeletons/skeleton-dfd.md3.3 KiB
references/skeletons/skeleton-findings.md7.7 KiB
references/skeletons/skeleton-incremental-html.md5.3 KiB
references/skeletons/skeleton-inventory.md5.3 KiB
references/skeletons/skeleton-stride-analysis.md6.2 KiB
references/skeletons/skeleton-summary-dfd.md2.8 KiB
references/skeletons/skeleton-threatmodel.md2.2 KiB
references/tmt-element-taxonomy.md8.5 KiB
references/verification-checklist.md69.9 KiB

references/tmt-element-taxonomy.md

TMT Element Taxonomy — Code to Threat Model DFD Reference

Complete reference for identifying DFD elements from source code analysis. Aligns with Microsoft Threat Modeling Tool (TMT) element types for TM7 compatibility. This is the single authoritative file for all TMT type classifications.

Diagram styling & rendering rules are in: diagram-conventions.md This file covers: What to look for in code, how to classify it, and how to name it.

1. Element Types

NOTE: TMT IDs (e.g., SE.P.TMCore.OSProcess) are for classification reference only. Do NOT use TMT IDs as Mermaid node IDs. Use concise, readable PascalCase IDs (e.g., WebServer, SqlDatabase).

1.1 Process Types

TMT ID	Name	Code Patterns to Identify
`SE.P.TMCore.OSProcess`	OS Process	Native executables, system processes, spawned processes
`SE.P.TMCore.Thread`	Thread	Thread pools, `Task`, `pthread`, worker threads
`SE.P.TMCore.WinApp`	Native Application	Win32 apps, C/C++ executables, desktop apps
`SE.P.TMCore.NetApp`	Managed Application	.NET apps, C# services, F# programs
`SE.P.TMCore.ThickClient`	Thick Client	Desktop GUI apps, WPF, WinForms, Electron
`SE.P.TMCore.BrowserClient`	Browser Client	SPAs, JavaScript apps, WebAssembly
`SE.P.TMCore.WebServer`	Web Server	IIS, Apache, Nginx, Express, Kestrel
`SE.P.TMCore.WebApp`	Web Application	ASP.NET, Django, Rails, Spring MVC
`SE.P.TMCore.WebSvc`	Web Service	REST APIs, SOAP, GraphQL endpoints
`SE.P.TMCore.VM`	Virtual Machine	VMs, containers, Docker
`SE.P.TMCore.Win32Service`	Win32 Service	Windows services, `ServiceBase`
`SE.P.TMCore.KernelThread`	Kernel Thread	Kernel modules, drivers, ring-0 code
`SE.P.TMCore.Modern`	Windows Store Process	UWP apps, Windows Store apps, sandboxed apps
`SE.P.TMCore.PlugIn`	Browser and ActiveX Plugins	Browser extensions, ActiveX, BHO plugins
`SE.P.TMCore.NonMS`	Applications Running on a non Microsoft OS	Linux apps, macOS apps, Unix processes

1.2 External Interactor Types

TMT ID	Name	Code Patterns to Identify
`SE.EI.TMCore.Browser`	Browser	Browser clients, user agents, web UI consumers
`SE.EI.TMCore.AuthProvider`	Authorization Provider	OAuth servers, OIDC providers, IdP, SAML
`SE.EI.TMCore.WebSvc`	External Web Service	External APIs, vendor services, SaaS endpoints
`SE.EI.TMCore.User`	Human User	End users, operators, administrators
`SE.EI.TMCore.Megaservice`	Megaservice	Large cloud platforms (Azure, AWS, GCP services)
`SE.EI.TMCore.WebApp`	External Web Application	Third-party web apps, external portals
`SE.EI.TMCore.CRT`	Windows Runtime	WinRT APIs, Windows runtime components
`SE.EI.TMCore.NFX`	Windows .NET Runtime	.NET Framework, CLR, BCL
`SE.EI.TMCore.WinRT`	Windows RT Runtime	Windows RT platform, ARM Windows apps

1.3 Data Store Types

TMT ID	Name	Code Patterns to Identify
`SE.DS.TMCore.CloudStorage`	Cloud Storage	Azure Blob, S3, GCS
`SE.DS.TMCore.SQL`	SQL Database	PostgreSQL, MySQL, SQL Server, SQLite
`SE.DS.TMCore.NoSQL`	Non-Relational DB	MongoDB, CosmosDB, Redis, Cassandra
`SE.DS.TMCore.FS`	File System	Local files, NFS, shared drives
`SE.DS.TMCore.Cache`	Cache	Redis, Memcached, in-memory caches
`SE.DS.TMCore.ConfigFile`	Configuration File	`.env`, `appsettings.json`, YAML configs
`SE.DS.TMCore.Cookie`	Cookies	HTTP cookies, session cookies
`SE.DS.TMCore.Registry`	Registry Hive	Windows Registry, system configuration stores
`SE.DS.TMCore.HTML5LS`	HTML5 Local Storage	`localStorage`, `sessionStorage`, IndexedDB
`SE.DS.TMCore.Device`	Device	Hardware devices, USB, peripheral storage

1.4 Data Flow Types

TMT ID	Name	Code Patterns to Identify
`SE.DF.TMCore.HTTP`	HTTP	`fetch()`, `axios`, `HttpClient`, REST without TLS
`SE.DF.TMCore.HTTPS`	HTTPS	TLS-secured REST, `https://` endpoints
`SE.DF.TMCore.Binary`	Binary	gRPC, Protobuf, raw binary protocols
`SE.DF.TMCore.NamedPipe`	Named Pipe	IPC via named pipes
`SE.DF.TMCore.SMB`	SMB	SMB/CIFS file shares
`SE.DF.TMCore.UDP`	UDP	UDP sockets, datagram protocols
`SE.DF.TMCore.SSH`	SSH	SSH tunnels, SFTP, SCP
`SE.DF.TMCore.LDAP`	LDAP	LDAP queries, AD lookups
`SE.DF.TMCore.LDAPS`	LDAPS	Secure LDAP over TLS
`SE.DF.TMCore.IPsec`	IPsec	VPN tunnels, IPsec-secured connections
`SE.DF.TMCore.RPC`	RPC or DCOM	COM+, DCOM, RPC calls, WCF net.tcp
`SE.DF.TMCore.ALPC`	ALPC	Advanced Local Procedure Call, Windows IPC
`SE.DF.TMCore.IOCTL`	IOCTL Interface	Device I/O control, driver communication

1.5 Trust Boundary Types

Line Boundaries:

TMT ID	Name	Code Indicators
`SE.TB.L.TMCore.Internet`	Internet Boundary	Public endpoints, API gateways
`SE.TB.L.TMCore.Machine`	Machine Boundary	Process boundaries, VM separation
`SE.TB.L.TMCore.Kernel`	Kernel/User Mode	Drivers, ring 0/3 transitions
`SE.TB.L.TMCore.AppContainer`	AppContainer	UWP sandboxes, app containers

Border Boundaries:

TMT ID	Name	Code Indicators
`SE.TB.B.TMCore.CorpNet`	CorpNet	Corporate network, VPN perimeter
`SE.TB.B.TMCore.Sandbox`	Sandbox	Sandboxed execution environments
`SE.TB.B.TMCore.IEB`	Internet Explorer Boundaries	IE zones, IE security settings
`SE.TB.B.TMCore.NonIEB`	Other Browsers Boundaries	Chrome, Firefox, Edge security contexts

2. Trust Boundary Detection

Create a trust boundary (subgraph) when code crosses:

Boundary Type	Code Indicators
Internet/Public	Public endpoints, API gateways, load balancers
Machine	Process boundaries, host separation
Kernel/User Mode	Kernel calls, drivers, syscalls
AppContainer	UWP sandboxes, containerized apps
CorpNet	Corporate network perimeter, VPN
Sandbox	Sandboxed execution environments

3. Data Flow Detection

Look for these patterns to identify flows:

Flow Type	Code Patterns
HTTP/HTTPS	`fetch()`, `axios`, `HttpClient`, REST calls
SQL Database	ORM queries, SQL connections, `DbContext`
Message Queue	Pub/sub, queue send/receive, Dapr pub/sub
File I/O	File read/write, blob upload/download
gRPC	Protobuf calls, gRPC streams
Named Pipe	IPC via named pipes
SSH	SSH tunnels, SFTP, SCP transfers
LDAP/LDAPS	Directory queries, AD lookups

4. Code Analysis Checklist

When analyzing code, systematically identify:

Entry Points → External Interactors + inbound flows
- API controllers, event handlers, webhook endpoints
Services/Logic → Processes
- Business logic classes, service layers, workers
Data Access → Data Stores + flows
- Repository classes, DB contexts, cache clients
External Calls → External Interactors + outbound flows
- HTTP clients, SDK integrations, third-party APIs
Security Boundaries → Trust Boundaries
- Auth middleware, network segments, deployment units
Kubernetes Pod Composition → Sidecar co-location
- Look for Helm charts, K8s manifests, deployment YAMLs
- Common sidecars: Dapr, MISE, Envoy, Istio proxy, Linkerd, log collectors
- Apply rules from diagram-conventions.md Rule 1 — annotate host nodes, never create standalone sidecar nodes

5. Naming Conventions

See diagram-conventions.md Naming Conventions section for the full table with quoting rules.

6. Output Files

Generate TWO files for maximum flexibility:

File 1: Pure Mermaid (`.mmd`)

Raw Mermaid code only, no markdown wrapper
Used for: CLI tools, editors, CI/CD, direct rendering

File 2: Markdown (`.md`)

Mermaid in ```mermaid code fence
Include element, flow, and boundary summary tables
Used for: GitHub, VS Code, documentation

Format Comparison

Format	Extension	Contents	Best For
Pure Mermaid	`.mmd`	Raw diagram code	CLI, editors, tools
Markdown	`.md`	Diagram + tables	GitHub, docs, viewing

Requirements and compatibility

Written for: GitHub Copilot

Works with: Claude Code, Claude apps, OpenAI Codex, GitHub Copilot, Cursor, Gemini CLI, Kiro, OpenCode, Goose, Amp, Roo Code, JetBrains Junie, Factory Droid, Devin (ex-Windsurf), Mistral Vibe, OpenHands, Letta

“Works with” means the tool reads the open Agent Skills format; a skill written for one tool may use features others lack.

Security

No issues found by our static scan· No issues found

A static scan is not a guarantee. Skills are third-party content: review a skill before you let an agent use it.

Attribution and licence

First committed by

cheguv

Publisher

GitHub (Official)

Distributed by

GitHub

Source

github/awesome-copilot · skills/threat-model-analyst · commit 797337f

Licence

MIT License (redistribution allowed)

LICENSE (added by AutoGineer from LICENSE)
ATTRIBUTION.md (written by AutoGineer)

Synced

2026-11-08

Contributors

cheguv, stbenjam

AutoGineer is not affiliated with or endorsed by cheguv or GitHub.

Download ZIP

The ZIP holds the skill’s files, its licence files and an ATTRIBUTION.md. Download threat-model-analyst.zip

From the author

AutoGineer summary

What it does

When to use it

Advantages

Usage examples

Install

Documentation by cheguv

Threat Model Analyst

Getting Started

Incremental Mode (Preferred for Follow-Up Analyses)

Comparing Commits or Reports

Single Analysis Mode

Reference Files

When to Activate

Files

references/tmt-element-taxonomy.md

TMT Element Taxonomy — Code to Threat Model DFD Reference

1. Element Types

1.1 Process Types

1.2 External Interactor Types

1.3 Data Store Types

1.4 Data Flow Types

1.5 Trust Boundary Types

2. Trust Boundary Detection

3. Data Flow Detection

4. Code Analysis Checklist

5. Naming Conventions

6. Output Files

File 1: Pure Mermaid (.mmd)

File 2: Markdown (.md)

Format Comparison

Requirements and compatibility

Security

Attribution and licence

Related skills

Security Audit

Sast Configuration

Firmware Analyst

Policy Enforcer

Backend Development Security Auditor

Memory Forensics

Download ZIP

File 1: Pure Mermaid (`.mmd`)

File 2: Markdown (`.md`)