threat-model
Audits application architecture for vulnerabilities using STRIDE mapping and trust boundary analysis.
Install
mkdir -p .claude/skills/threat-model && curl -L -o skill.zip "https://agentskills.codes/api/skills/download/17986" && unzip -o skill.zip -d .claude/skills/threat-model && rm skill.zipInstalls to .claude/skills/threat-model
Activation
This is the description your AI agent reads to decide when to run this skill — the better it matches your request, the more reliably it fires.
Hometower's security threat model — architecture trust boundaries, known previously-fixed vulnerabilities, and STRIDE threat lanes mapped to specific files. Read this when performing security audits or reviewing auth/data-handling code.Key capabilities
- →Apply STRIDE per-element to security reviews.
- →Perform attack surface analysis on user input paths.
- →Identify trust boundaries in the application architecture.
- →Verify previously fixed vulnerabilities against new code.
- →Map STRIDE threat lanes to specific files and hunt for weaknesses.
How it works
The skill applies security review methodologies like STRIDE and Attack Surface Analysis to identify vulnerabilities. It maps threat lanes to specific files and checks for regressions of previously fixed issues.
Inputs & outputs
When to use threat-model
- →Security audit of routes
- →Review authentication flow
- →Check data handling security
- →Threat model application layers
About this skill
threat-model
Security Review Science
- STRIDE Per-Element (Shostack, 2014): apply STRIDE to each route, data flow, store, and client render path individually
- Attack Surface Analysis: inspect every place user input enters, crosses a trust boundary, and leaves the system
- Least Privilege: prefer the narrowest access and visibility possible at every layer
- Defense in Depth: treat single-control protection as suspicious; look for a second barrier
- CWE Mapping: name the weakness class precisely whenever possible
Use these rules to keep audits specific and actionable instead of vague.
Architecture Security Boundaries
Browser (untrusted)
|
+-- JWT in sessionStorage (accessible to XSS)
+-- Cytoscape.js canvas (renders user-supplied labels)
+-- Leaflet.js map (renders location names in popups)
|
v
FastAPI (trust boundary -- JWT + RBAC enforcement)
|
+-- src/api/middleware/auth.py -- JWT decode + role check
+-- src/api/routers/ -- Depends(require_role(...))
|
v
Service Layer (trusted -- owns transactions)
|
v
PostgreSQL (trusted -- constraints are last line of defense)
Key trust boundaries:
- Browser -> API: JWT validation, input sanitization, RBAC
- API -> Service: delegation only (no direct DB access from routers)
- Service -> DB: parameterized queries (no SQL injection)
- DB -> API response: no password hashes or secrets in response schemas
- DB -> UI render: HTML escaping before embedding in JS/HTML
Known Previously-Fixed Vulnerabilities
Regression checklist — verify fixes still hold and new code doesn't reintroduce:
| Finding | CWE | What to Check |
|---|---|---|
Hardcoded SECRET_KEY in .env | CWE-798 | .env in .gitignore? New hardcoded secrets? |
| Stateless JWT (no revocation) | CWE-613 | token_version checked on decode? New endpoints bypass? |
| Device names unescaped in Cytoscape | CWE-79 | html.escape()/_escapeHtml() on all user labels? New labels without escaping? |
Connection labels in confirm() dialogs | CWE-79 | _escapeHtml() in all dialog messages? |
| Missing DB uniqueness constraints | CWE-362 | New models without unique constraints? |
| Email logged on auth failure | CWE-532 | New log statements with user-supplied PII? |
STRIDE Threat Lanes (file targets)
| Lane | STRIDE | Target Files | Hunt For |
|---|---|---|---|
| JWT Auth | Tampering/Spoofing | src/utils/auth.py, src/api/middleware/auth.py | Algorithm confusion, expired token accepted, token_version bypass, short secret key |
| Plaintext Leaks | Info Disclosure | All logger.* calls across src/ | Device IPs/MACs in error logs, JWT payloads in debug, emails in auth failure, stack traces |
| Stored XSS | Elevation | canvas*.py, topology_data.py, map_view.py, ui.label() calls | Unescaped strings in ui.run_javascript(), innerHTML, Cytoscape/Leaflet labels without sanitization |
| RBAC Bypass | Elevation/Spoofing | All src/api/routers/*.py | Missing Depends(require_role(...)), wrong role level, IDOR on device IDs |
| Secret Lifecycle | Info Disclosure | src/utils/auth.py, src/utils/settings.py, .env, docker-compose.yml | Passwords in API responses, bcrypt hash outside User model, key reuse |
| SQL Injection | Tampering | src/repositories/, any session.execute()/session.exec() | f-string SQL, .text() with interpolation, unparameterized user strings |
| Export/Backup Auth | Info Disclosure | src/api/routers/data_transfer.py, src/services/export_service.py | Export callable by Reader, exported JSON with password_hash, secrets in custom fields |
| Geo/Leaflet Injection | Tampering | src/ui/components/map_view.py | Location names in popup HTML without escaping, innerHTML with user content |
| DB Integrity | Tampering | All src/models/*.py | Missing UNIQUE, missing ondelete="CASCADE", missing CheckConstraint for self-refs |
| Supply Chain | Mixed | requirements.txt, Dockerfile, docker-compose.yml | Known CVEs, EOL versions, missing integrity checks |
Security Orchestrator Lane Assignments
| Lane | STRIDE | Boundary |
|---|---|---|
| lane-1 | Tampering/Spoofing | JWT Auth. Browser->API. |
| lane-2 | Info Disclosure | Plaintext leaks. App->Logs. |
| lane-3 | Elevation | SQLi & Pydantic. API->DB. |
| lane-4 | Info Disclosure | Secret lifecycle. Bcrypt/JWT/.env. |
| lane-5 | Spoofing/Elevation | RBAC bypass. All routers + rbac.py. |
| lane-6 | Tampering | XSS. Canvas + map. DB->UI render. |
| lane-7 | Tampering | SQLModel integrity. DB constraints. |
| lane-8 | Info Disclosure | Backup/Export. API->External. |
| lane-9 | Elevation | RBAC wildcard. Reader data exposure. |
| lane-10 | Mixed | Supply chain & infra. Docker/deps. |
Evidentiary Bar
- prefer a believable exploit path or a concrete verification path over speculative warnings
- findings without a clear boundary, target file, or failure mode should be treated as incomplete
When not to use it
- →When not performing security audits or reviewing auth/data-handling code.
- →When the goal is not to identify vulnerabilities or exploit paths.
- →When a general code review is needed, not a security-focused one.
Limitations
- →The skill focuses on Hometower's security threat model.
- →Findings without a clear boundary, target file, or failure mode are treated as incomplete.
- →The skill prefers believable exploit paths over speculative warnings.
How it compares
This skill provides a structured, evidence-based framework for security threat modeling and auditing, focusing on specific exploit paths and trust boundaries, which is more targeted than a general security assessment.
Compared to similar skills
threat-model side by side with the closest alternatives in the catalog.
| Skill | Installs | Updated | Safety | Difficulty |
|---|---|---|---|---|
| threat-model (this skill) | 0 | 3mo | Review | Advanced |
| app-builder | 16 | 6mo | No flags | Beginner |
| templates | 4 | 6mo | No flags | Beginner |
| backend-architect | 10 | 3mo | No flags | Advanced |
Try saying
Example prompts that trigger this skill in your AI assistant.
More by blazengreen360
View all by blazengreen360 →You might also like
app-builder
davila7
Main application building orchestrator. Creates full-stack applications from natural language requests. Determines project type, selects tech stack, coordinates agents.
templates
davila7
Project scaffolding templates for new applications. Use when creating new projects from scratch. Contains 12 templates for various tech stacks.
backend-architect
sickn33
Expert backend architect specializing in scalable API design, microservices architecture, and distributed systems. Masters REST/GraphQL/gRPC APIs, event-driven architectures, service mesh patterns, and modern backend frameworks. Handles service boundary definition, inter-service communication, resilience patterns, and observability. Use PROACTIVELY when creating new backend services or APIs.
agent-v3-security-architect
ruvnet
Agent skill for v3-security-architect - invoke with $agent-v3-security-architect
pytm
rohunj
Python-based threat modeling using pytm library for programmatic STRIDE analysis, data flow diagram generation, and automated security threat identification. Use when: (1) Creating threat models programmatically using Python code, (2) Generating data flow diagrams (DFDs) with automatic STRIDE threat identification, (3) Integrating threat modeling into CI/CD pipelines and shift-left security practices, (4) Analyzing system architecture for security threats across trust boundaries, (5) Producing threat reports with STRIDE categories and mitigation recommendations, (6) Maintaining threat models as code for version control and automation.
python-development-python-scaffold
sickn33
You are a Python project architecture expert specializing in scaffolding production-ready Python applications. Generate complete project structures with modern tooling (uv, FastAPI, Django), type hint