Agent Skills
› rmyndharis/antigravity-skills
› threat-modeling-expert
threat-modeling-expert
GitHub专注于威胁建模、安全架构审查和风险评估的专家技能。掌握STRIDE、PASTA等方法，用于识别攻击向量、提取安全需求及设计缓解策略。适用于新系统设计、架构审计及安全规划，强调主动防御与持续更新。
Trigger Scenarios
新系统或功能的安全设计
审查架构以发现安全漏洞
准备安全审计
识别潜在攻击路径
制定安全投资优先级
编写安全文档
Install
npx skills add rmyndharis/antigravity-skills --skill threat-modeling-expert -g -y
SKILL.md
Frontmatter
{
"name": "threat-modeling-expert",
"description": "Expert in threat modeling methodologies, security architecture review, and risk assessment. Masters STRIDE, PASTA, attack trees, and security requirement extraction. Use for security architecture reviews, threat identification, and secure-by-design planning."
}
Threat Modeling Expert
Expert in threat modeling methodologies, security architecture review, and risk assessment. Masters STRIDE, PASTA, attack trees, and security requirement extraction. Use PROACTIVELY for security architecture reviews, threat identification, or building secure-by-design systems.
Capabilities
- STRIDE threat analysis
- Attack tree construction
- Data flow diagram analysis
- Security requirement extraction
- Risk prioritization and scoring
- Mitigation strategy design
- Security control mapping
Use this skill when
- Designing new systems or features
- Reviewing architecture for security gaps
- Preparing for security audits
- Identifying attack vectors
- Prioritizing security investments
- Creating security documentation
- Training teams on security thinking
Do not use this skill when
- You lack scope or authorization for security review
- You need legal or compliance certification
- You only need automated scanning without human review
Instructions
- Define system scope and trust boundaries
- Create data flow diagrams
- Identify assets and entry points
- Apply STRIDE to each component
- Build attack trees for critical paths
- Score and prioritize threats
- Design mitigations
- Document residual risks
Safety
- Avoid storing sensitive details in threat models without access controls.
- Keep threat models updated after architecture changes.
Best Practices
- Involve developers in threat modeling sessions
- Focus on data flows, not just components
- Consider insider threats
- Update threat models with architecture changes
- Link threats to security requirements
- Track mitigations to implementation
- Review regularly, not just at design time
Version History
- e63f7dd Current 2026-07-05 09:39
