threat-model
Audits application architecture for vulnerabilities using STRIDE mapping and trust boundary analysis.
Install
mkdir -p .claude/skills/threat-model && curl -L -o skill.zip "https://agentskills.codes/api/skills/download/17986" && unzip -o skill.zip -d .claude/skills/threat-model && rm skill.zipInstalls to .claude/skills/threat-model
Activation
This is the description your AI agent reads to decide when to run this skill — the better it matches your request, the more reliably it fires.
Hometower's security threat model — architecture trust boundaries, known previously-fixed vulnerabilities, and STRIDE threat lanes mapped to specific files. Read this when performing security audits or reviewing auth/data-handling code.Key capabilities
- →Apply STRIDE per-element to security reviews.
- →Perform attack surface analysis on user input paths.
- →Identify trust boundaries in the application architecture.
- →Verify previously fixed vulnerabilities against new code.
- →Map STRIDE threat lanes to specific files and hunt for weaknesses.
How it works
The skill applies security review methodologies like STRIDE and Attack Surface Analysis to identify vulnerabilities. It maps threat lanes to specific files and checks for regressions of previously fixed issues.
Inputs & outputs
When to use threat-model
- →Security audit of routes
- →Review authentication flow
- →Check data handling security
- →Threat model application layers
About threat-model
Identifies attack surfaces and trust boundaries within the codebase. Provides a structured review framework for auth, data flow, and rendering security.
Hometower's security threat model — architecture trust boundaries, known previously-fixed vulnerabilities, and STRIDE threat lanes mapped to specific files. Read this when performing security audits or reviewing auth/data-handling code.
When not to use it
- →When not performing security audits or reviewing auth/data-handling code.
- →When the goal is not to identify vulnerabilities or exploit paths.
- →When a general code review is needed, not a security-focused one.
Limitations
- →The skill focuses on Hometower's security threat model.
- →Findings without a clear boundary, target file, or failure mode are treated as incomplete.
- →The skill prefers believable exploit paths over speculative warnings.
How it compares
This skill provides a structured, evidence-based framework for security threat modeling and auditing, focusing on specific exploit paths and trust boundaries, which is more targeted than a general security assessment.
Compared to similar skills
threat-model side by side with the closest alternatives in the catalog.
| Skill | Installs | Updated | Safety | Difficulty |
|---|---|---|---|---|
| threat-model (this skill) | 0 | 6mo | Review | Advanced |
| app-builder | 16 | 9mo | No flags | Beginner |
| templates | 4 | 9mo | No flags | Beginner |
| backend-architect | 10 | 6mo | No flags | Advanced |
Try saying
Example prompts that trigger this skill in your AI assistant.
More by blazengreen360
View all by blazengreen360 →You might also like
app-builder
davila7
Main application building orchestrator. Creates full-stack applications from natural language requests. Determines project type, selects tech stack, coordinates agents.
templates
davila7
Project scaffolding templates for new applications. Use when creating new projects from scratch. Contains 12 templates for various tech stacks.
backend-architect
sickn33
Expert backend architect specializing in scalable API design, microservices architecture, and distributed systems. Masters REST/GraphQL/gRPC APIs, event-driven architectures, service mesh patterns, and modern backend frameworks. Handles service boundary definition, inter-service communication, resilience patterns, and observability. Use PROACTIVELY when creating new backend services or APIs.
agent-v3-security-architect
ruvnet
Agent skill for v3-security-architect - invoke with $agent-v3-security-architect
pytm
rohunj
Python-based threat modeling using pytm library for programmatic STRIDE analysis, data flow diagram generation, and automated security threat identification. Use when: (1) Creating threat models programmatically using Python code, (2) Generating data flow diagrams (DFDs) with automatic STRIDE threat identification, (3) Integrating threat modeling into CI/CD pipelines and shift-left security practices, (4) Analyzing system architecture for security threats across trust boundaries, (5) Producing threat reports with STRIDE categories and mitigation recommendations, (6) Maintaining threat models as code for version control and automation.
python-development-python-scaffold
sickn33
You are a Python project architecture expert specializing in scaffolding production-ready Python applications. Generate complete project structures with modern tooling (uv, FastAPI, Django), type hint