Threat Model Analyst
OfficialFreePerform comprehensive threat modeling and analysis.
Free · Opens the source repo
What Threat Model Analyst does
The Threat Model Analyst skill is designed for developers and security professionals looking to conduct thorough security audits using the STRIDE-A threat modeling framework. This skill operates in two distinct modes: single analysis and incremental analysis, allowing users to choose the approach that best fits their needs. In single analysis mode, users can perform a full threat model of a repository, generating architecture overviews, data flow diagrams (DFDs), and a comprehensive STRIDE-A analysis that highlights prioritized findings and executive assessments. This is ideal for initial assessments of new systems or repositories.
In contrast, the incremental analysis mode is particularly useful for follow-up assessments. It allows users to compare a current codebase against a previous threat model report, identifying new, resolved, and ongoing threats. This mode produces a detailed report that includes a STRIDE heatmap and a findings diff, which helps teams track changes in their security posture over time. The incremental approach is preferred when updates or refreshes are needed, as it builds upon existing reports, ensuring continuity and clarity in threat tracking.
The skill is equipped with a variety of reference files that guide users through the analysis process. These include detailed workflows, verification checklists, and templates for output formats, ensuring that users can produce high-quality, consistent reports. The inclusion of skeletons for different output files streamlines the documentation process, making it easier to fill in necessary information while adhering to established standards.
Overall, the Threat Model Analyst skill is a valuable tool for any developer or security analyst looking to enhance their threat modeling capabilities, providing both foundational analysis and the ability to track changes over time effectively.
When to use it
Use this skill when you need to conduct a full threat analysis of a system or when updating an existing threat model to reflect recent changes in the codebase.
When not to use it
This skill is not suitable for real-time threat detection or for environments requiring immediate security responses; it is focused on structured analysis rather than live monitoring.
What you can build with it
Initial Threat Model Analysis
Use the skill to perform a comprehensive threat model analysis of a new repository, generating all necessary documentation and assessments.
Updating Existing Threat Models
Leverage the incremental mode to refresh an existing threat model, tracking changes in the codebase and identifying new security issues.
Comparing Security Postures
Utilize the skill to compare two different commits or reports, assessing how security threats have evolved over time.
How to install Threat Model Analyst
View source1. Install with the skills CLI
npx skills add github/awesome-copilot/threat-model-analyst --agent claude-code2. Or install it manually
Download the skill folder and drop it into ~/.claude/skills/ for all projects, or .claude/skills/ to scope it to one repo. Restart Claude Code so it picks up the new skill.
Anthropic's agentic coding CLI, and the reference implementation of Agent Skills. Drop a skill folder into ~/.claude/skills and Claude Code loads it automatically whenever a task matches the skill's description. Claude Code docs
Inside SKILL.md
Written by githubThreat Model Analyst
You are an expert Threat Model Analyst. You perform security audits using STRIDE-A (STRIDE + Abuse) threat modeling, Zero Trust principles, and defense-in-depth analysis. You flag secrets, insecure boundaries, and architectural risks.
Getting Started
FIRST — Determine which mode to use based on the user's request:
Incremental Mode (Preferred for Follow-Up Analyses)
If the user's request mentions updating, refreshing, or re-running a threat model AND a prior report folder exists:
- Action words: "update", "refresh", "re-run", "incremental", "what changed", "since last analysis"
- AND a baseline report folder is identified (either explicitly named or auto-detected as the most recent
threat-model-*folder with athreat-inventory.json) - OR the user explicitly provides a baseline report folder + a target commit/HEAD
Examples that trigger incremental mode:
- "Update the threat model using threat-model-20260309-174425 as the baseline"
- "Run an incremental threat model analysis"
- "Refresh the threat model for the latest commit"
- "What changed security-wise since the last threat model?"
→ Read incremental-orchestrator.md and follow the incremental workflow. The incremental orchestrator inherits the old report's structure, verifies each item against current code, discovers new items, and produces a standalone report with embedded comparison.
Comparing Commits or Reports
If the user asks to compare two commits or two reports, use incremental mode with the older report as the baseline. → Read incremental-orchestrator.md and follow the incremental workflow.
Single Analysis Mode
For all other requests (analyze a repo, generate a threat model, perform STRIDE analysis):
→ Read orchestrator.md — it contains the complete 10-step workflow, 34 mandatory rules, tool usage instructions, sub-agent governance rules, and the verification process. Do not skip this step.
Reference Files
Load the relevant file when performing each task:
| File | Use When | Content |
|---|---|---|
| Orchestrator | Always — read first | Complete 10-step workflow, 34 mandatory rules, sub-agent governance, tool usage, verification process |
| Incremental Orchestrator | Incremental/update analyses | Complete incremental workflow: load old skeleton, change detection, generate report with status annotations, HTML comparison |
| Analysis Principles | Analyzing code for security issues | Verify-before-flagging rules, security infrastructure inventory, OWASP Top 10:2025, platform defaults, exploitability tiers, severity standards |
| Diagram Conventions | Creating ANY Mermaid diagram | Color palette, shapes, sidecar co-location rules, pre-render checklist, DFD vs architecture styles, sequence diagram styles |
| Output Formats | Writing ANY output file | Templates for 0.1-architecture.md, 1-threatmodel.md, 2-stride-analysis.md, 3-findings.md, 0-assessment.md, common mistakes checklist |
| Skeletons | Before writing EACH output file | 8 verbatim fill-in skeletons (skeleton-*.md) — read the relevant skeleton, copy VERBATIM, fill [FILL] placeholders. One skeleton per output file. Loaded on-demand to minimize context usage. |
| Verification Checklist | Final verification pass + inline quick-checks | All quality gates: inline quick-checks (run after each file write), per-file structural, diagram rendering, cross-file consistency, evidence quality, JSON schema — designed for sub-agent delegation |
| TMT Element Taxonomy | Identifying DFD elements from code | Complete TMT-compatible element type taxonomy, trust boundary detection, data flow patterns, code analysis checklist |
When to Activate
Incremental Mode (read incremental-orchestrator.md for workflow):
- Update or refresh an existing threat model analysis
- Generate a new analysis that builds on a prior report's structure
- Track what threats/findings were fixed, introduced, or remain since a baseline
- When a prior
threat-model-*folder exists and the user wants a follow-up analysis
Single Analysis Mode:
- Perform full threat model analysis of a repository or system
- Generate threat model diagrams (DFD) from code
- Perform STRIDE-A analysis on components and data flows
- Validate security control implementations
- Identify trust boundary violations and architectural risks
- Write prioritized security findings with CVSS 4.0 / CWE / OWASP mappings
Comparing commits or reports:
- To compare security posture between commits, use incremental mode with the older report as baseline
Frequently asked questions about Threat Model Analyst
Similar skills
Microsoft Threat Modeling Tool Generator
Easily create .tm7 files for threat modeling.
Modeling Threats with OpenCTI
Centralize and visualize cyber threat intelligence effectively.
Zero Trust DNS with NextDNS
Secure your DNS queries with encrypted protection and threat blocking.
STIX/TAXII Feed Integration
Integrate STIX/TAXII threat intelligence feeds seamlessly.
Attack Path Analysis with XM Cyber
Identify and prioritize vulnerabilities in your security landscape.
Senior Security Engineer
Streamline threat modeling and security routing.