AutoGineer
Generated banner for Threat Model Analyst
Generated logo for Threat Model Analyst

Threat Model Analyst

GitHubOfficialFirst committed by cheguvDistributed by GitHub

  • Skill
  • Review and audit
  • Security
  • MIT
  • No issues found
Download ZIP

From the author

Full STRIDE-A threat model analysis and incremental update skill for repositories and systems. Supports two modes: (1) Single analysis — full STRIDE-A threat model of a repository, producing architecture overviews, DFD diagrams, STRIDE-A analysis, prioritized findings, and executive assessments. (2) Incremental analysis — takes a previous threat model report as baseline, compares the codebase at the latest (or a given commit), and produces an updated report with change tracking (new, resolved, still-present threats), STRIDE heatmap, findings diff, and an embedded HTML comparison. Only activate when the user explicitly requests a threat model analysis, incremental update, or invokes /threat-model-analyst directly.
— the description by cheguv

AutoGineer summary

Written by AutoGineer from the skill’s own files, not by the author

Threat Model Analyst is a specialized agent skill designed to perform rigorous security audits using the STRIDE-A (STRIDE + Abuse) methodology. It operates in two primary modes: a full initial analysis for new systems and an incremental mode for tracking security posture changes over time. The skill enforces strict architectural modeling rules, particularly regarding Kubernetes sidecar co-location, and provides structured, evidence-based reporting including DFD diagrams, prioritized findings, and executive assessments.

What it does

  • Performs full STRIDE-A threat modeling including DFD generation and architectural risk assessment.
  • Executes incremental analysis to track new, resolved, and persistent threats between code versions.
  • Identifies security gaps by verifying infrastructure components and platform defaults before flagging.
  • Generates standardized security reports including architecture overviews and prioritized findings.
  • Maps security findings to industry standards like CVSS 4.0, CWE, and OWASP.
  • Enforces consistent diagramming conventions for complex system architectures.

When to use it

  • When you need a comprehensive security audit of a new repository or system architecture.
  • When you need to update an existing threat model to reflect recent code changes.
  • When you need to compare the security posture between two specific commits or report versions.
  • When you need to identify trust boundary violations or architectural security risks.

Advantages

  • Reduces false positives by requiring evidence-based verification of security controls.
  • Maintains continuity in security documentation through incremental change tracking.
  • Ensures architectural diagrams accurately reflect Kubernetes pod-level sidecar co-location.
  • Provides actionable, prioritized security findings mapped to recognized industry frameworks.

Usage examples

“Perform a full STRIDE-A threat model analysis on this repository.”
The agent will analyze the codebase, generate architecture diagrams, identify threats, and produce a comprehensive security report.
“Run an incremental threat model analysis using the report from last week as a baseline.”
The agent will compare the current codebase against the previous report to identify new, fixed, or remaining security threats.

Install

  1. Download the skill as a ZIP:

    https://autogineer.com/agent-skills/github/threat-model-analyst/download

  2. Unzip it into the cross-client skills folder of your project:

    mkdir -p .agents/skills && unzip threat-model-analyst.zip -d .agents/skills

Documentation by cheguv

Threat Model Analyst

You are an expert Threat Model Analyst. You perform security audits using STRIDE-A (STRIDE + Abuse) threat modeling, Zero Trust principles, and defense-in-depth analysis. You flag secrets, insecure boundaries, and architectural risks.

Getting Started

FIRST — Determine which mode to use based on the user's request:

Incremental Mode (Preferred for Follow-Up Analyses)

If the user's request mentions updating, refreshing, or re-running a threat model AND a prior report folder exists:

  • Action words: "update", "refresh", "re-run", "incremental", "what changed", "since last analysis"

  • AND a baseline report folder is identified (either explicitly named or auto-detected as the most recent threat-model-* folder with a threat-inventory.json)

  • OR the user explicitly provides a baseline report folder + a target commit/HEAD

Examples that trigger incremental mode:

  • "Update the threat model using threat-model-20260309-174425 as the baseline"

  • "Run an incremental threat model analysis"

  • "Refresh the threat model for the latest commit"

  • "What changed security-wise since the last threat model?"

→ Read incremental-orchestrator.md and follow the incremental workflow. The incremental orchestrator inherits the old report's structure, verifies each item against current code, discovers new items, and produces a standalone report with embedded comparison.

Comparing Commits or Reports

If the user asks to compare two commits or two reports, use incremental mode with the older report as the baseline. → Read incremental-orchestrator.md and follow the incremental workflow.

Single Analysis Mode

For all other requests (analyze a repo, generate a threat model, perform STRIDE analysis):

→ Read orchestrator.md — it contains the complete 10-step workflow, 34 mandatory rules, tool usage instructions, sub-agent governance rules, and the verification process. Do not skip this step.

Reference Files

Load the relevant file when performing each task:

FileUse WhenContent
OrchestratorAlways — read firstComplete 10-step workflow, 34 mandatory rules, sub-agent governance, tool usage, verification process
Incremental OrchestratorIncremental/update analysesComplete incremental workflow: load old skeleton, change detection, generate report with status annotations, HTML comparison
Analysis PrinciplesAnalyzing code for security issuesVerify-before-flagging rules, security infrastructure inventory, OWASP Top 10:2025, platform defaults, exploitability tiers, severity standards
Diagram ConventionsCreating ANY Mermaid diagramColor palette, shapes, sidecar co-location rules, pre-render checklist, DFD vs architecture styles, sequence diagram styles
Output FormatsWriting ANY output fileTemplates for 0.1-architecture.md, 1-threatmodel.md, 2-stride-analysis.md, 3-findings.md, 0-assessment.md, common mistakes checklist
SkeletonsBefore writing EACH output file8 verbatim fill-in skeletons (skeleton-*.md) — read the relevant skeleton, copy VERBATIM, fill [FILL] placeholders. One skeleton per output file. Loaded on-demand to minimize context usage.
Verification ChecklistFinal verification pass + inline quick-checksAll quality gates: inline quick-checks (run after each file write), per-file structural, diagram rendering, cross-file consistency, evidence quality, JSON schema — designed for sub-agent delegation
TMT Element TaxonomyIdentifying DFD elements from codeComplete TMT-compatible element type taxonomy, trust boundary detection, data flow patterns, code analysis checklist

When to Activate

Incremental Mode (read incremental-orchestrator.md for workflow):

  • Update or refresh an existing threat model analysis

  • Generate a new analysis that builds on a prior report's structure

  • Track what threats/findings were fixed, introduced, or remain since a baseline

  • When a prior threat-model-* folder exists and the user wants a follow-up analysis

Single Analysis Mode:

  • Perform full threat model analysis of a repository or system

  • Generate threat model diagrams (DFD) from code

  • Perform STRIDE-A analysis on components and data flows

  • Validate security control implementations

  • Identify trust boundary violations and architectural risks

  • Write prioritized security findings with CVSS 4.0 / CWE / OWASP mappings

Comparing commits or reports:

  • To compare security posture between commits, use incremental mode with the older report as baseline

Files

references/skeletons/skeleton-incremental-html.md

Skeleton: incremental-comparison.html

⛔ Self-contained HTML — ALL CSS inline. No CDN links. Follow this exact 8-section structure.

The HTML report has exactly 8 sections in this order. Each section MUST be present.

Section 1: Header + Comparison Cards

<div class="header">
  <div class="report-badge">INCREMENTAL THREAT MODEL COMPARISON</div>
  <h1>[FILL: repo name]</h1>
</div>
<div class="comparison-cards">
  <div class="compare-card baseline">
    <div class="card-label">BASELINE</div>
    <div class="card-hash">[FILL: baseline SHA]</div>
    <div class="card-date">[FILL: baseline commit date from git log]</div>
    <div class="risk-badge [FILL: old-class]">[FILL: old rating]</div>
  </div>
  <div class="compare-arrow">→</div>
  <div class="compare-card target">
    <div class="card-label">TARGET</div>
    <div class="card-hash">[FILL: target SHA]</div>
    <div class="card-date">[FILL: target commit date from git log]</div>
    <div class="risk-badge [FILL: new-class]">[FILL: new rating]</div>
  </div>
  <div class="compare-card trend">
    <div class="card-label">TREND</div>
    <div class="trend-direction [FILL: color]">[FILL: Improving / Worsening / Stable]</div>
    <div class="trend-duration">[FILL: N months]</div>
  </div>
</div>

<!-- SKELETON INSTRUCTION: Section 2 (Risk Shift) is merged into Section 1 above. The old separate risk-shift div is removed. The comparison-cards div replaces both the old subtitle + risk-shift + time-between box. -->

Section 2: Metrics Bar (5 boxes)

<div class="metrics-bar">
  [FILL: Components: old → new (±N)]
  [FILL: Trust Boundaries: old → new (±N)]
  [FILL: Threats: old → new (±N)]
  [FILL: Findings: old → new (±N)]
  [FILL: Code Changes: N commits, M PRs — use git rev-list --count and git log --oneline --merges --grep="Merged PR"]
</div>

MUST include Trust Boundaries as one of the 5 metrics. 5th box is Code Changes (NOT Time Between).

Section 3: Status Summary Cards (colored)

<div class="status-cards">
  <!-- Green card --> Fixed: [FILL: count] [FILL: 1-sentence summary, NO IDs]
  <!-- Red card --> New: [FILL: count] [FILL: 1-sentence summary, NO IDs]
  <!-- Amber card --> Previously Unidentified: [FILL: count] [FILL: 1-sentence summary, NO IDs]
  <!-- Gray card --> Still Present: [FILL: count] [FILL: 1-sentence summary, NO IDs]
</div>

<!-- SKELETON INSTRUCTION: Status cards show COUNT + a short human-readable sentence ONLY. DO NOT include threat IDs (T06.S, T02.E), finding IDs (FIND-14), or component names. Good: "1 credential handling vulnerability remediated" Good: "4 new components with 21 new threats identified" Good: "No new threats or findings introduced" Bad: "T06.S: DefaultAzureCredential → ManagedIdentityCredential" Bad: "ConfigurationOrchestrator — 5 threats (T16.*), LLMService — 6 threats (T17.*)" The detailed item-by-item breakdown with IDs belongs in Section 5 (Threat/Finding Status Breakdown). -->

Status info appears ONLY here — NOT also in the metrics bar.

Section 4: Component Status Grid

<table class="component-grid">
  <tr><th>Component</th><th>Type</th><th>Status</th><th>Source Files</th></tr>
  [REPEAT: one row per component with color-coded status badge]
  <tr><td>[FILL]</td><td>[FILL]</td><td><span class="badge-[FILL: status]">[FILL]</span></td><td>[FILL]</td></tr>
  [END-REPEAT]
</table>

Section 5: Threat/Finding Status Breakdown

<div class="status-breakdown">
  [FILL: Grouped by status — Fixed items, New items, etc.]
  [REPEAT: Each item: ID | Title | Component | Status]
  [END-REPEAT]
</div>

Section 6: STRIDE Heatmap with Deltas

<table class="stride-heatmap">
  <thead>
    <tr>
      <th>Component</th>
      <th>S</th><th>T</th><th>R</th><th>I</th><th>D</th><th>E</th><th>A</th>
      <th>Total</th>
      <th class="divider"></th>
      <th>T1</th><th>T2</th><th>T3</th>
    </tr>
  </thead>
  <tbody>
    [REPEAT: one row per component]
    <tr>
      <td>[FILL: component]</td>
      <td>[FILL: S value] [FILL: delta indicator ▲/▼]</td>
      ... [same for T, R, I, D, E, A, Total] ...
      <td class="divider"></td>
      <td>[FILL: T1]</td><td>[FILL: T2]</td><td>[FILL: T3]</td>
    </tr>
    [END-REPEAT]
  </tbody>
</table>

MUST have 13 columns: Component + S + T + R + I + D + E + A + Total + divider + T1 + T2 + T3

Section 7: Needs Verification

<div class="needs-verification">
  [REPEAT: items where analysis disagrees with old report]
  [FILL: item description]
  [END-REPEAT]
</div>

Section 8: Footer

<div class="footer">
  Model: [FILL] | Duration: [FILL]
  Baseline: [FILL: folder] at [FILL: SHA]
  Generated: [FILL: timestamp]
</div>

Fixed CSS variables (use in <style> block):

--red: #dc3545;    /* new vulnerability */
--green: #28a745;  /* fixed/improved */
--amber: #fd7e14;  /* previously unidentified */
--gray: #6c757d;   /* still present */
--accent: #2171b5; /* modified/info */

Fixed rules:

  • ALL CSS in inline <style> block — no external stylesheets

  • Include @media print styles

  • Heatmap MUST have T1/T2/T3 columns after divider

  • Metrics bar MUST include Trust Boundaries

  • Status data in cards ONLY — not duplicated in metrics bar

  • HTML threat/finding totals MUST match markdown STRIDE summary totals

Requirements and compatibility

Written for: GitHub Copilot

Works with: Claude Code, Claude apps, OpenAI Codex, GitHub Copilot, Cursor, Gemini CLI, Kiro, OpenCode, Goose, Amp, Roo Code, JetBrains Junie, Factory Droid, Devin (ex-Windsurf), Mistral Vibe, OpenHands, Letta

“Works with” means the tool reads the open Agent Skills format; a skill written for one tool may use features others lack.

Security

No issues found by our static scan· No issues found

A static scan is not a guarantee. Skills are third-party content: review a skill before you let an agent use it.

Attribution and licence

First committed by
GitHub avatar of cheguvcheguv
Publisher
GitHub (Official)
Distributed by
GitHub
Source
github/awesome-copilot · skills/threat-model-analyst · commit 797337f
Licence
MIT License (redistribution allowed)
  • LICENSE (added by AutoGineer from LICENSE)
  • ATTRIBUTION.md (written by AutoGineer)
Synced
Contributors
cheguv, stbenjam

AutoGineer is not affiliated with or endorsed by cheguv or GitHub.

Download ZIP

The ZIP holds the skill’s files, its licence files and an ATTRIBUTION.md. Download threat-model-analyst.zip