Agent skill · security · github
threat-model-analyst
Full STRIDE-A threat model analysis and incremental update skill for repositories and systems. Supports two modes: (1) Single analysis — full STRIDE-A threat model of a repository, producing architecture overviews, DFD diagrams, STRIDE-A analysis, prioritized findings, and executive assessments. (2) Incremental analysis — takes a previous threat model report as baseline, compares the codebase at the latest (or a given commit), and produces an updated report with change tracking (new, resolved, still-present threats), STRIDE heatmap, findings diff, and an embedded HTML comparison. Only activate when the user explicitly requests a threat model analysis, incremental update, or invokes /threat-model-analyst directly.
Why this skill is useful
Adds a comprehensive threat modeling framework with executable workflows and detailed analysis outputs that extend the AI's security capabilities.
What it needs
Requires mermaid installed locally. About 3k tokens when loaded. Last updated 2026-08-07. 37,534 stars on the source repository.
What this skill does
Threat Model Analyst You are an expert Threat Model Analyst. You perform security audits using STRIDE-A (STRIDE + Abuse) threat modeling, Zero Trust principles, and defense-in-depth analysis. You flag secrets, insecure boundaries, and architectural risks. Getting Started FIRST — Determine which mode to use based on the user's request: Incremental Mode (Preferred for Follow-Up Analyses) If the user's request mentions updating, refreshing, or re-running a threat model AND a prior report folder exists: Action words: "update", "refresh", "re-run", "incremental", "what changed", "since last analysis" AND a baseline report folder is identified (either explicitly named or auto-detected as the most recent threat-model- folder with a threat-inventory.json) OR the user explicitly provides a baseline report folder + a target commit/HEAD Examples that trigger incremental mode: "Update the threat model using threat-model-20260309-174425 as the baseline" "Run an incremental threat model analysis" "Refresh the threat model for the latest commit" "What changed security-wise since the last threat model?" → Read incremental-orchestrator.md and follow the incremental workflow. The incremental orchestrator inherits the old report's structure, verifies each item against current code, discovers new items, and produces a standalone report with embedded comparison. Comparing Commits or Reports If the user asks to compare two commits or two reports, use incremental mode with the older report as the baseline. → Read incremental-orchestrator.md and follow the incremental workflow. Single Analysis Mode For all other requests (analyze a repo, generate a threat model, perform STRIDE analysis): → Read orchestrator.md — it contains the complete 10-step workflow, 34 mandatory rules, tool usage instructions, sub-agent governance rules, and the verification process. Do not skip this step. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills github/threat-model-analyst