skill

threat-modeling-expert — Claude Code skill: STRIDE and attack trees

Q: How do I install threat-modeling-expert in Claude Code?

Use the templates command: `npx claude-code-templates@latest --skill security/threat-modeling-expert`. Or add it with `npx skills add davila7/claude-code-templates --skill threat-modeling-expert -a claude-code`. The skill file lands at `~/.claude/skills/threat-modeling-expert/SKILL.md`.

A skill that walks a system through threat modeling: STRIDE per component, attack trees, risk scoring and security requirements.

Install into Claude Code · claude-code-templates All methods and platforms ↓

npx claude-code-templates@latest --skill security/threat-modeling-expert

Open on GitHub

What threat-modeling-expert does

The skill runs a fixed sequence. It starts with scope and trust boundaries, then data flow diagrams, assets and entry points. Each component gets STRIDE applied to it, critical paths get attack trees, and the findings are scored and ranked. Mitigations and residual risks come last.

Seven areas are covered: STRIDE analysis, attack tree construction, data flow diagram review, security requirement extraction, risk prioritization, mitigation design and mapping threats to controls. Use it when designing a new system, reviewing architecture before an audit, or when a team needs to see where its security requirements actually come from.

The author is explicit about the limits. Without scope or authorization for a security review, the skill is the wrong tool. It does not produce legal or compliance certification, and it is not a replacement for automated scanning when no human review is wanted. Two practical cautions: threat models should not hold sensitive details without access controls, and they need updating whenever the architecture changes.

What it helps with

map threats in a new system before writing code
find security gaps in an architecture ahead of an audit
build an attack tree for a critical path
derive security requirements from a system description
rank the risks that came out of a review

Example prompts for the agent

Run STRIDE over this payment service architecture and mark the trust boundaries
Build an attack tree for the OAuth login flow
Pull security requirements out of this data flow diagram

How to install threat-modeling-expert

1claude-code-templates

npx claude-code-templates@latest --skill security/threat-modeling-expert

2Skills CLI (Vercel)

npx skills add davila7/claude-code-templates --skill threat-modeling-expert -a claude-code

3Manually: put the files in place

~/.claude/skills/threat-modeling-expert/SKILL.md

Copy the whole skill folder; for one project use .claude/skills/threat-modeling-expert/

Manually: put the files in place

.agents/skills/threat-modeling-expert/SKILL.md

For all projects use ~/.agents/skills/

Manually: put the files in place

.cursor/skills/threat-modeling-expert/SKILL.md

Cursor also reads .agents/skills/ and .claude/skills/

1GitHub CLI

gh skill install davila7/claude-code-templates threat-modeling-expert

2Manually: put the files in place

.github/skills/threat-modeling-expert/SKILL.md

Platform CLI

gemini skills install https://github.com/davila7/claude-code-templates --path cli-tool/components/skills/security/threat-modeling-expert

Manually: put the files in place

.devin/skills/threat-modeling-expert/SKILL.md

The legacy .windsurf/skills/ path still works

Step by step, with commands for each platform: How to install skills in Claude Code: five ways

Questions about threat-modeling-expert

How do I install threat-modeling-expert in Claude Code?

Use the templates command: npx claude-code-templates@latest --skill security/threat-modeling-expert. Or add it with npx skills add davila7/claude-code-templates --skill threat-modeling-expert -a claude-code. The skill file lands at ~/.claude/skills/threat-modeling-expert/SKILL.md.

What does threat-modeling-expert do?

It applies STRIDE to each component, builds attack trees for critical paths, reviews data flow diagrams and scores the resulting risks. It also extracts security requirements and proposes mitigations.

When should I not use this skill?

When you have no authorization for a security review, when you need legal or compliance certification, or when automated scanning without human review is enough.

Similar skills

All skills for Security →

stride-threat-modeling securityskills Run a structured STRIDE threat modeling workshop during system design. The skill maps trust boundaries, catalogs attack vectors per component, and generates backlog tickets. CX Codex +1 2,700installs threat-modeling-with-aws-security-agent aws Runs a STRIDE threat model review on spec files and codebases using AWS Security Agent to detect architectural security risks. CX Codex +1 1,600installs threat-modeling Claude MPM Team Threat modeling workflow using the STRIDE framework. Maps system data flows, evaluates risks, and translates mitigations into backlog items and test cases. CX Codex +1 460installs threat-modeling-techniques NickCrew A skill for threat modeling: walks the system through STRIDE, builds attack trees and scores risk with DREAD. Best used before the code exists. CX Codex +1 356installs threat-model-analyst official github Runs STRIDE-A threat modeling for a repository or system. It can also update an earlier report against the current code or a chosen commit. 1,500installs tm7-threat-model official github Creates .tm7 threat model files for Microsoft Threat Modeling Tool and adds STRIDE threats. Use it when a system description must become an editable threat model diagram. 29installs

From the same set361

The whole set →

server-management A Claude skill that gives the agent a decision framework for processes, monitoring, logs and scaling instead of a command cheat sheet. 76installs resume-ats-optimizer Reads your resume the way screening software does: pulls keywords from the job post, flags layout that breaks parsing, and scores the match. 75installs android-cicd This skill wires up a GitHub Actions pipeline that builds your Android app and pushes it to Google Play, detecting the framework and handling signing secrets for you. 74installs gws-admin A Claude slash command that runs Google Workspace Admin SDK operations: users, groups, devices, domains. 74installs gws-workflow-meeting-prep Pulls the agenda, attendee list and linked docs for your next calendar event. Handy right before a call when you don't want to dig through the invite. 72installs gws-apps-script Command for managing Google Apps Script projects via CLI: create, update code, run scripts, and check execution metrics. 72installs fine-tuning-peft A skill that walks through fine-tuning large language models with LoRA, QLoRA and other adapter methods when GPU memory is tight. 71installs gws-gmail-watch A slash command that watches for new Gmail messages and streams them as NDJSON. Useful when incoming mail has to land in files or a pipeline. 71installs