Threat modeling

Analyze and design a Flexport integration that separates REST v3 resources, MCP tools, webhook ingress, approval, and reconciliation.

jeremylongshore/tons-of-skills-marketplace

Analyze and harden Flexport credentials, tokens, webhook verification, data exposure, and mutation controls.

jeremylongshore/tons-of-skills-marketplace

Harden an Ideogram integration across credentials, untrusted media, content safety, copyright controls, storage, and tenant authorization.

jeremylongshore/tons-of-skills-marketplace

Harden Instantly API v2 keys, scopes, tenant boundaries, logs, webhooks, and operational access.

jeremylongshore/tons-of-skills-marketplace

Harden Linear credentials, OAuth, team access, webhook verification, logging, and rotation.

jeremylongshore/tons-of-skills-marketplace

Threat-model and harden Lucid API, Standard Import, editor extension, and data connector integrations.

jeremylongshore/tons-of-skills-marketplace

Threat-model Mistral credentials, untrusted content, model output, tools, files, and tenant access.

jeremylongshore/tons-of-skills-marketplace

Threat-model a Navan integration across identity, travel, expense, payment, file, and downstream systems.

jeremylongshore/tons-of-skills-marketplace

Threat-model a Procore integration across OAuth credentials, company routing, DMSA permissions, webhooks, files, logs, and revocation.

jeremylongshore/tons-of-skills-marketplace

Establish least-privilege OAuth, secret, webhook, data, card, and financial-write controls for a Ramp integration.

jeremylongshore/tons-of-skills-marketplace

Harden Runway keys, organization access, prompts, media, generated outputs, and support evidence.

jeremylongshore/tons-of-skills-marketplace

Threat-model a WebContainer or StackBlitz embed across host, runtime, user-code, filesystem, dependency, network, preview, secret, and persistence boundaries.

jeremylongshore/tons-of-skills-marketplace

Harden Snagit and Camtasia automation around capture consent, license secrecy, local storage, share destinations, least privilege, and artifact review.

jeremylongshore/tons-of-skills-marketplace

Secure Together AI integrations with project-scoped keys, environment isolation, prompt/output data controls, bounded model behavior, safe logging, rotation, and incident response.

jeremylongshore/tons-of-skills-marketplace

Harden Webflow tokens, scopes, webhook verification, logs, and live-write boundaries.

jeremylongshore/tons-of-skills-marketplace

Identifies what could go wrong in a system before it is built or changed — the assets worth attacking, the entry points, the trust boundaries, and the controls that actually address the realistic…

cbrock84/headcount

STRIDE threat modeling, DREAD risk scoring, secret detection, and secure architecture design.

borghei/Claude-Skills

Audit or harden a defined application-security attack surface when the user explicitly requests a security audit, vulnerability investigation, or scoped security-hardening pass.

swyxio/skills

Chief Security Officer mode. An agent skill from mr-daedalium/ostack-saas.

mr-daedalium/ostack-saas

A skill your agent uses when writing, reviewing, testing, or shipping Go code and HTTP services: idioms, %w error wrapping, goroutine/context/errgroup concurrency, net/http 1.22 routing, log/slog…

ericrisco/rsc-harness

A skill your agent uses when automated scanners drive a security sweep of a repo or app — SAST, dependency/lockfile CVEs, secrets in the tree or git history, IaC misconfig — and the raw output has…

ericrisco/rsc-harness

Hack23 ISMS organization-wide compliance requirements, policy enforcement, audit preparation

Hack23/cia

MCP gateway security patterns, token management, request validation, and audit logging for MCP communications

Hack23/cia

Threat modeling before coding, STRIDE methodology, defense in depth, security controls in SDLC

Hack23/cia

Maintain comprehensive security documentation including SECURITYARCHITECTURE.md, THREATMODEL.md per Hack23 ISMS standards

Hack23/cia

Focused static audit of device firmware and IoT software for update, boot, provisioning, credential, debug-interface and device-communication boundary failures, using an ISVS-informed threat model.

alpha-omega-security/scrutineer

Audit package manager clients, registries, and proxies against a bundled threat model.

alpha-omega-security/scrutineer

Focused static audit of web applications and APIs for session, browser-origin, upload and business-workflow boundary failures, using an ASVS-informed threat model.

alpha-omega-security/scrutineer

Full security audit for public repositories across 12 attack surfaces: git history, secrets, CI/CD, containers, dependencies, licenses.

Mathews-Tom/armory

Diagnose and operate Spring AI projects with version-aware Maven or Gradle checks for ChatClient, advisors, retrieval, conversation memory, tool/MCP boundaries, streaming, configuration, and…

magnus919/agent-skills

Conduct LINDDUN privacy threat modeling across all seven categories: Linking, Identifying, Non-repudiation, Detecting, Data Disclosure, Unawareness, and Non-compliance.

mukul975/Privacy-Data-Protection-Skills

Comprehensive threat modeling for multi-agent systems using CSA MAESTRO 7-layer framework and OWASP Multi-Agentic System Threat Modeling Guide v1.0.

OWASP/secure-agent-playbook

Build or challenge an application threat model from architecture, dataflows, identities, trust boundaries, business invariants, dependencies, and deployment context.

cyberful/cyberful

Generates complete conventional oncology bulk-transcriptome biomarker and hub-gene research designs from a user-provided cancer type and study direction.

aipoch/medical-research-skills

Derive a project's security contract from its source and docs, then emit it as structured data other skills can cite.

alpha-omega-security/scrutineer

Re-run a finding's reproduction against current HEAD, test its attack tree, grade five fixed evidence criteria, and account for every matched design control.

alpha-omega-security/scrutineer

Analyze attack surface analyzer operations. An agent skill from jeremylongshore/tons-of-skills-marketplace.

jeremylongshore/tons-of-skills-marketplace

Threat-model and harden a Mindtickle tenant and its identity, connector, API, content, and reporting integrations.

jeremylongshore/tons-of-skills-marketplace

Threat-model SerpAPI credentials, query data, result retention, browser exposure, logs, and ZeroTrace tradeoffs.

jeremylongshore/tons-of-skills-marketplace

Create threat model creator operations. An agent skill from jeremylongshore/tons-of-skills-marketplace.

jeremylongshore/tons-of-skills-marketplace

Produce a threat model — assets, ranked threats, mitigations, accepted risks.

jeremylongshore/tons-of-skills-marketplace

Financial risk modeling including VaR, stress testing, and credit risk

wentorai/research-plugins

Reusable writing-style contract for agent outputs (reports, ARCH docs, verdicts, threat models).

avelikiy/great_cto

Produce a repository-grounded application security threat model with assets, boundaries, abuse paths, priorities, and mitigations.

nightly-labs/openbot

Conduct systematic threat modeling using STRIDE framework, attack trees, and security architecture analysis for CIA platform

Hack23/cia

Write a STRIDE-based threat model for a service or feature. An agent skill from mohitagw15856/pm-claude-skills.

mohitagw15856/pm-claude-skills

Threat-model a system or feature to find where it could be attacked, before you build it.

mohitagw15856/pm-claude-skills

Assess the physical attack surface of embedded devices — finding and using UART consoles, JTAG/SWD debug, and SPI/I2C flash; dumping firmware off-chip; triaging secure boot; and studying sub-GHz RF…

trilwu/secskills