Results for “threat-modeling”

Run a structured threat-modeling session for a new feature, system, or architecture — STRIDE, attack trees, data flow diagrams, abuse cases. Use when the user mentions 'threat model,' 'threat modeling,' 'STRIDE,' 'attack tree,' 'abuse case,' 'data flow diagram,' 'DFD,' 'security architecture review,' 'security review,' 'design review,' 'pre-implementation security,' 'shift left,' 'what could go wrong,' or needs strategic security thinking before code is written.

The English summary is being prepared. Showing the original description.

Complete guide to LINDDUN privacy threat modeling methodology covering seven threat categories: Linking, Identifying, Non-repudiation, Detecting, Data Disclosure, Unawareness, and Non-compliance. Includes DFD-based analysis, threat tree catalogs, mitigation mapping to privacy design patterns, and step-by-step process.

The English summary is being prepared. Showing the original description.

Review code and infrastructure for security risks, map potential threats, and plan stronger defenses. The skill covers OWASP checks, attack and defense exercises, and incident response, with validation required for each environment.

• Reviewing code and infrastructure security
• Mapping threats with STRIDE or PASTA
• Planning stronger security settings

Assess cybersecurity risks using NIST SP 800-30 Rev 1 by examining threats, weaknesses, likelihood, and business impact. Produce a ranked risk register, a structured record of risks and recommended responses, with a summary for leadership.

• Preparing documented risk analysis for compliance frameworks
• Assessing a new system before launch
• Reporting the highest risks to leadership

Create, update, or reuse a repository threat model: a document describing its architecture, attacker capabilities, trust boundaries, and potential security failures. The result is a Markdown reference grounded in the repository's actual code and scope.

• Documenting architecture and trust boundaries
• Creating or updating a repository threat model
• Preparing a threat model for a specific security review

Create, update, or reuse a repository threat model: a document describing system architecture, attacker capabilities, trust boundaries, and potential security failures. Produce a Markdown model grounded in source evidence for standalone use or a security scan.

• Creating a threat model for a repository
• Updating a model after architecture changes
• Preparing a model for a security scan

Run an AWS Security Agent threat model review on spec/design documents. Use when the user asks to review a spec for security, run a threat model, check if a design introduces security risks, review requirements.md or design.md for security posture changes, or STRIDE analysis.

The English summary is being prepared. Showing the original description.

Identifies what could go wrong in a system before it is built or changed — the assets worth attacking, the entry points, the trust boundaries, and the controls that actually address the realistic threats. Use this when designing a feature or system, when a change touches authentication, data handling, payments, or external input, before a security review, or when deciding which security work is worth doing at all.

The English summary is being prepared. Showing the original description.

Expert in threat modeling methodologies, security architecture review, and risk assessment. Masters STRIDE, PASTA, attack trees, and security requirement extraction. Use for security architecture reviews, threat identification, and secure-by-design planning.

The English summary is being prepared. Showing the original description.

Consolidated Responsible AI standards reference: NIST AI RMF 1.0, AI STRIDE threat-modeling overlay, EU AI Act risk tiers, and an open-standards catalog with phase mapping

The English summary is being prepared. Showing the original description.

Conduct threat modeling using STRIDE methodology. Identify threats, assess risks, and design security controls. Use when designing secure systems or assessing application security.

The English summary is being prepared. Showing the original description.

STRIDE threat modeling, DREAD risk scoring, secret detection, and secure architecture design. Use when conducting threat models, reviewing code for vulnerabilities, designing defense-in-depth, or scanning for hardcoded secrets.

The English summary is being prepared. Showing the original description.

Use when an application or system — including one built quickly with AI coding agents — needs a security review with regulatory grounding: a STRIDE threat model, a LINDDUN privacy threat model, a dependency exposure screen against live CVE / CISA-KEV / EPSS data, or a selected, non-exhaustive screen of which EU security obligations (GDPR, NIS2, Cyber Resilience Act, AI Act) may apply and which need determination. Orchestrates the server-enforced threat-modeling workflows of the Ansvar Gateway MCP connector and grounds every regulatory statement in officially published text fetched at answer time — scope, role, and application-date limits stated, never a compliance verdict. Never simulates a workflow and never answers legal questions from model memory.

The English summary is being prepared. Showing the original description.

Create a repository-grounded AppSec threat model covering assets, trust boundaries, attackers, abuse paths, and mitigations. Use only for explicit threat-modeling requests, not general architecture or code review.

The English summary is being prepared. Showing the original description.

Conduct LINDDUN privacy threat modeling across all seven categories: Linking, Identifying, Non-repudiation, Detecting, Data Disclosure, Unawareness, and Non-compliance. Includes DFD-based analysis, threat trees, privacy-specific mitigation strategies, and integration with STRIDE security threat modeling.

The English summary is being prepared. Showing the original description.

Security audit, hardening, threat modeling (STRIDE/PASTA), Red/Blue Team, OWASP checks, code review, incident response, and infrastructure security for any project.

The English summary is being prepared. Showing the original description.

Conduct structured threat modeling for software systems using established methodologies to identify, prioritize, and mitigate security threats before they are exploited. Use when the user requests threat modeling or provides relevant inputs for this workflow.

The English summary is being prepared. Showing the original description.

Perform a broad, authorized security audit across application, infrastructure, identity, dependencies, and operations. Use when the user needs a scoped security posture review; use the SAST, DAST, dependency-scanning, or threat-modeling skill when the request is limited to one specialist activity.

The English summary is being prepared. Showing the original description.

Perform threat modeling for a system or feature. Use when a senior developer needs security risk assessment.

The English summary is being prepared. Showing the original description.

Perform STRIDE threat modeling for each component and trust boundary and produce a threat register. Use when reviewing a feature for security.

The English summary is being prepared. Showing the original description.

威胁建模时使用。适用于新功能 / 新系统的安全设计评审。融合 STRIDE + Attack Tree + Microsoft SDL。

The English summary is being prepared. Showing the original description.

Use when Codex is already in the threat-modeling phase of a security scan, the user explicitly invokes $threat-model, or the user explicitly asks to create, update, or persist a repository threat model. Do not use as the primary trigger for full PR, commit, branch, patch, or repository scans.

The English summary is being prepared. Showing the original description.

Build a mental and visual map of the target application before hunting — entry points, trust boundaries, data flows, and high-value functionality. Use when user has scope parsed and wants to plan WHERE to hunt rather than diving into recon.

The English summary is being prepared. Showing the original description.

Full penetration test using MCP tools — recon, scanning, exploitation, and reporting. Tailored for OpenCode (BYO LLM). Supports network/web targets and local codebases. Chains into analyze-cve, threat-modeling, and remediate skills automatically.

The English summary is being prepared. Showing the original description.