“threat-modeling”的搜索结果

Run a structured threat-modeling session for a new feature, system, or architecture — STRIDE, attack trees, data flow diagrams, abuse cases. Use when the user mentions 'threat model,' 'threat modeling,' 'STRIDE,' 'attack tree,' 'abuse case,' 'data flow diagram,' 'DFD,' 'security architecture review,' 'security review,' 'design review,' 'pre-implementation security,' 'shift left,' 'what could go wrong,' or needs strategic security thinking before code is written.

中文简介正在准备中。当前显示原文说明。

Complete guide to LINDDUN privacy threat modeling methodology covering seven threat categories: Linking, Identifying, Non-repudiation, Detecting, Data Disclosure, Unawareness, and Non-compliance. Includes DFD-based analysis, threat tree catalogs, mitigation mapping to privacy design patterns, and step-by-step process.

中文简介正在准备中。当前显示原文说明。

Review code and infrastructure for security risks, map potential threats, and plan stronger defenses. The skill covers OWASP checks, attack and defense exercises, and incident response, with validation required for each environment.

中文简介正在准备中。当前显示英语简介。

• Reviewing code and infrastructure security
• Mapping threats with STRIDE or PASTA
• Planning stronger security settings

Assess cybersecurity risks using NIST SP 800-30 Rev 1 by examining threats, weaknesses, likelihood, and business impact. Produce a ranked risk register, a structured record of risks and recommended responses, with a summary for leadership.

中文简介正在准备中。当前显示英语简介。

• Preparing documented risk analysis for compliance frameworks
• Assessing a new system before launch
• Reporting the highest risks to leadership

Create, update, or reuse a repository threat model: a document describing its architecture, attacker capabilities, trust boundaries, and potential security failures. The result is a Markdown reference grounded in the repository's actual code and scope.

中文简介正在准备中。当前显示英语简介。

• Documenting architecture and trust boundaries
• Creating or updating a repository threat model
• Preparing a threat model for a specific security review

Create, update, or reuse a repository threat model: a document describing system architecture, attacker capabilities, trust boundaries, and potential security failures. Produce a Markdown model grounded in source evidence for standalone use or a security scan.

中文简介正在准备中。当前显示英语简介。

• Creating a threat model for a repository
• Updating a model after architecture changes
• Preparing a model for a security scan

Run an AWS Security Agent threat model review on spec/design documents. Use when the user asks to review a spec for security, run a threat model, check if a design introduces security risks, review requirements.md or design.md for security posture changes, or STRIDE analysis.

中文简介正在准备中。当前显示原文说明。

Identifies what could go wrong in a system before it is built or changed — the assets worth attacking, the entry points, the trust boundaries, and the controls that actually address the realistic threats. Use this when designing a feature or system, when a change touches authentication, data handling, payments, or external input, before a security review, or when deciding which security work is worth doing at all.

中文简介正在准备中。当前显示原文说明。

Expert in threat modeling methodologies, security architecture review, and risk assessment. Masters STRIDE, PASTA, attack trees, and security requirement extraction. Use for security architecture reviews, threat identification, and secure-by-design planning.

中文简介正在准备中。当前显示原文说明。

Consolidated Responsible AI standards reference: NIST AI RMF 1.0, AI STRIDE threat-modeling overlay, EU AI Act risk tiers, and an open-standards catalog with phase mapping

中文简介正在准备中。当前显示原文说明。

Conduct threat modeling using STRIDE methodology. Identify threats, assess risks, and design security controls. Use when designing secure systems or assessing application security.

中文简介正在准备中。当前显示原文说明。

STRIDE threat modeling, DREAD risk scoring, secret detection, and secure architecture design. Use when conducting threat models, reviewing code for vulnerabilities, designing defense-in-depth, or scanning for hardcoded secrets.

中文简介正在准备中。当前显示原文说明。

Use when an application or system — including one built quickly with AI coding agents — needs a security review with regulatory grounding: a STRIDE threat model, a LINDDUN privacy threat model, a dependency exposure screen against live CVE / CISA-KEV / EPSS data, or a selected, non-exhaustive screen of which EU security obligations (GDPR, NIS2, Cyber Resilience Act, AI Act) may apply and which need determination. Orchestrates the server-enforced threat-modeling workflows of the Ansvar Gateway MCP connector and grounds every regulatory statement in officially published text fetched at answer time — scope, role, and application-date limits stated, never a compliance verdict. Never simulates a workflow and never answers legal questions from model memory.

中文简介正在准备中。当前显示原文说明。

Create a repository-grounded AppSec threat model covering assets, trust boundaries, attackers, abuse paths, and mitigations. Use only for explicit threat-modeling requests, not general architecture or code review.

中文简介正在准备中。当前显示原文说明。

Conduct LINDDUN privacy threat modeling across all seven categories: Linking, Identifying, Non-repudiation, Detecting, Data Disclosure, Unawareness, and Non-compliance. Includes DFD-based analysis, threat trees, privacy-specific mitigation strategies, and integration with STRIDE security threat modeling.

中文简介正在准备中。当前显示原文说明。

Security audit, hardening, threat modeling (STRIDE/PASTA), Red/Blue Team, OWASP checks, code review, incident response, and infrastructure security for any project.

中文简介正在准备中。当前显示原文说明。

Conduct structured threat modeling for software systems using established methodologies to identify, prioritize, and mitigate security threats before they are exploited. Use when the user requests threat modeling or provides relevant inputs for this workflow.

中文简介正在准备中。当前显示原文说明。

Perform a broad, authorized security audit across application, infrastructure, identity, dependencies, and operations. Use when the user needs a scoped security posture review; use the SAST, DAST, dependency-scanning, or threat-modeling skill when the request is limited to one specialist activity.

中文简介正在准备中。当前显示原文说明。

Perform threat modeling for a system or feature. Use when a senior developer needs security risk assessment.

中文简介正在准备中。当前显示原文说明。

Perform STRIDE threat modeling for each component and trust boundary and produce a threat register. Use when reviewing a feature for security.

中文简介正在准备中。当前显示原文说明。

威胁建模时使用。适用于新功能 / 新系统的安全设计评审。融合 STRIDE + Attack Tree + Microsoft SDL。

中文简介正在准备中。当前显示原文说明。

Use when Codex is already in the threat-modeling phase of a security scan, the user explicitly invokes $threat-model, or the user explicitly asks to create, update, or persist a repository threat model. Do not use as the primary trigger for full PR, commit, branch, patch, or repository scans.

中文简介正在准备中。当前显示原文说明。

Build a mental and visual map of the target application before hunting — entry points, trust boundaries, data flows, and high-value functionality. Use when user has scope parsed and wants to plan WHERE to hunt rather than diving into recon.

中文简介正在准备中。当前显示原文说明。

Full penetration test using MCP tools — recon, scanning, exploitation, and reporting. Tailored for OpenCode (BYO LLM). Supports network/web targets and local codebases. Chains into analyze-cve, threat-modeling, and remediate skills automatically.

中文简介正在准备中。当前显示原文说明。