robotti-io/threat-model-lite
skills/threat-model-lite/SKILL.md
Lightweight, repeatable threat modeling for a feature or service with prioritized mitigations.
$ install --global
skillsauthnpx skillsauth add robotti-io/copilot-security-instructions threat-model-liteInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
Security Scan Results
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
3
Scanners Passed
9
Scanners in report
Clean
TrivyContainer and dependency vulnerability scanner
95%
Clean
SemgrepStatic code analysis for vulnerabilities
95%
Clean
mcp-scan (Snyk)Model Context Protocol security validation
95%
Skipped
Snyk (dep)Open source security scanning
50%
Skipped
Socket.devSupply chain security analysis
50%
Skipped
VirusTotalMulti-engine malware detection
50%
Skipped
CrowdStrikeAdvanced threat intelligence
50%
Skipped
OSV-ScannerOpen Source Vulnerability database check
50%
Skipped
OWASP Dep-Check
50%
Last scanned: Apr 11, 2026, 10:56 PM4.5s1 file scanned
SKILL.md
- name:
- threat-model-lite
- description:
- Lightweight, repeatable threat modeling for a feature or service with prioritized mitigations.
Threat Model (Lite)
When to use
Use this skill when planning a feature, reviewing an architecture, or preparing security requirements.
Inputs to collect (if available)
- Entry points (endpoints/jobs)
- Assets and sensitivities (PII, secrets, money movement)
- External services and trust assumptions
- Deployment details (internet-facing, multi-tenant, auth model)
Step-by-step process
- Define scope
- What is being built/changed? What is explicitly out of scope?
- Describe the system
- Components, identities, data stores, external dependencies
- Identify assets
- Secrets, PII, money-moving actions, admin capabilities, integrity-critical data
- Map trust boundaries
- Internet ↔ edge, edge ↔ app, app ↔ data, service ↔ service
- List top threats (ranked)
- Use STRIDE reasoning; focus on realistic threats
- Mitigations
- Prevent: validation, authz, rate limiting, encryption
- Detect: logs, alerts, anomaly detection
- Respond: rollback, key rotation, incident playbooks
- Residual risk
- What remains and why; follow-ups
Output template
- System overview
- Data flows (bulleted)
- Assets
- Trust boundaries
- Top threats + mitigations
- Residual risk + next steps
Output format
- Scope
- Assets & trust boundaries
- Top threats (ranked) with mitigations (prevent/detect/respond)
- Validation scenarios (3)
Examples
- “New webhook endpoint” → threats: spoofing, replay, SSRF; mitigations: signature validation, nonce/timestamp, allow-listed egress.
Related Skills
robotti-io/threat-model
tools
VerifiedTrustedCommunity
Threat model a system, feature, service, or PR using Shostack's 4Q workflow, evidence-first analysis, risk scoring, and CLI-friendly Mermaid helper scripts.
39SKILL.mdUpdated Apr 19, 2026
robotti-io/access-control-review
testing
VerifiedTrustedCommunity
Analyze repository-grounded identity, access control, and authorization design with evidence-first reporting and script-validated Mermaid diagrams.
39SKILL.mdUpdated Apr 19, 2026
robotti-io/threat-model
tools
VerifiedTrustedCommunity
Threat model a system, feature, service, or PR using Shostack's 4Q workflow, evidence-first analysis, risk scoring, and CLI-friendly Mermaid helper scripts.
39SKILL.mdUpdated Apr 19, 2026
robotti-io/dependency-cve-triage
content-media
VerifiedTrustedCommunity
Triage a dependency CVE using local repo evidence and remediation guidance.
39SKILL.mdUpdated Apr 19, 2026