📘

Threat Modeling

Find attacks before attackers do.

v1 security curated

🤖

Install 安装

curl -sSL https://updating.cc/skills/security/threat-modeling/SKILL.md -o ~/.agents/skills/security__threat-modeling/SKILL.md

📄

Raw Source

https://updating.cc/skills/security/threat-modeling/SKILL.md

← Back to profession page

SKILL.md Preview 技能内容预览

---
name: Threat Modeling
description: Find attacks before attackers do.
---
# Threat Modeling

Threat modeling finds vulnerabilities by walking the system from an attacker's perspective — before code ships, when fixes are cheap. Done at design time, it's the highest-ROI security activity.

## Method (STRIDE-flavored)
Walk each component and trust boundary asking:
- **Spoofing.** Can someone pretend to be someone else?
- **Tampering.** Can data be modified in transit or at rest?
- **Repudiation.** Can an actor deny an action they took?
- **Information disclosure.** Can data leak to unauthorized parties?
- **Denial of service.** Can the system be made unavailable?
- **Elevation of privilege.** Can a user get capabilities they shouldn't have?

## Output
A prioritized list of threats with mitigations. Prioritize by likelihood × impact; address the high ones in design, accept the low ones consciously.