Agent skill · security · davila7
regulatory-threat-model
Use when an application or system — including one built quickly with AI coding agents — needs a security review with regulatory grounding: a STRIDE threat model, a LINDDUN privacy threat model, a dependency exposure screen against live CVE / CISA-KEV / EPSS data, or a selected, non-exhaustive screen of which EU security obligations (GDPR, NIS2, Cyber Resilience Act, AI Act) may apply and which need determination. Orchestrates the server-enforced threat-modeling workflows of the Ansvar Gateway MCP connector and grounds every regulatory statement in officially published text fetched at answer time — scope, role, and application-date limits stated, never a compliance verdict. Never simulates a workflow and never answers legal questions from model memory.
Why this skill is useful
Adds executable workflows for STRIDE and LINDDUN threat modeling that are not available in public documentation.
What it needs
Requires ansvar account access. About 12k tokens when loaded. Last updated 2026-08-06. 30,138 stars on the source repository.
What this skill does
Regulatory Threat Model (STRIDE + LINDDUN) Software gets built faster than it gets reviewed — especially software built by prompting an AI agent. This skill turns the same agent into the orchestrator of a real security review: a server-enforced STRIDE threat model, a LINDDUN privacy threat model when personal data flows, a dependency exposure screen against live vulnerability data, and a selected, non-exhaustive screen of EU security obligations — each obligation cited from served legal text with its scope, role, and application-date limits stated. The deliverable is a report the user can put in front of a customer, an auditor, or an investor — with its sources and unresolved items visible; not a chat transcript, and not a compliance verdict. The threat-modeling workflows run on the Ansvar Gateway's workflow engine, which enforces steps and quality gates server-side. The agent's job is to feed the engine well and to ground the regulatory layer; it is never the engine. Requirements The Ansvar Gateway MCP connector must be connected: https://gateway.ansvar.eu/mcp (OAuth 2.1 with Dynamic Client Registration; signup at https://ansvar.eu). Works in MCP-capable agents (Claude, ChatGPT, Microsoft Copilot, Gemini and others — see the setup guides at https://ansvar.eu/setup for exact supported surfaces and prerequisites per client). Tools this skill uses on every plan: getmycapabilities, search, getprovision, searchcve, getcvedetails, getepssscore, checkkevstatus, getdatafreshness — and listworkflowtypes (the workflow directory answers on every plan, with availabletocaller flags telling the truth per caller). Tools for the modeling runs (Premium plan and above): startworkflow, getcurrentstep, submitresponse, getprogress, generatereport, resumeworkflow, cancelworkflow. If the gateway tools are not available, stop and tell the user to connect the gateway. Do not produce a substitute review from model knowledge. Ground rules (non-negotiable) 1. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills davila7/regulatory-threat-model