New: 97,000+ skills indexed from GitHub repos with 100+ stars · every skill safety-checkedBrowse top skillsTop skills
Esc to closeBrowse all skills
Submit a skillBrowse skills
Submit a skillBrowse skills

Official agent skill

Threat Model Analyst

by github in github/awesome-copilot

Full STRIDE-A threat model analysis and incremental update skill for repositories and systems.

OfficialMITAuto-check passedSecurity

Install Threat Model Analyst

skills CLI
$ npx skills add github/awesome-copilot --skill threat-model-analyst -a claude-code

Project install by default; add -g for ~/.claude/skills/.

GitHub CLI
$ gh skill install github/awesome-copilot threat-model-analyst --agent claude-code

Project scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).

Manual copy
$ git clone --depth 1 https://github.com/github/awesome-copilot.git skills-src && mkdir -p .claude/skills && cp -r skills-src/skills/threat-model-analyst .claude/skills/threat-model-analyst && rm -rf skills-src

Use ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.

Claude Code skills documentation · loads skills from .claude/skills/

Facts

Skill name
threat-model-analyst
GitHub stars
40k
Used in
1 other repo
Token cost
~1.5k tokens
SKILL.md length
569 words
Files
17 (incl. references)
Skills in repo
417
Repo updated
First seen
Licence
MIT

At a glance

Full STRIDE-A threat model analysis and incremental update skill for repositories and systems.

  • Explicitly requests a threat model analysis
  • SKILL.md covers Getting Started, Reference Files and When to Activate
  • Instructions only: no scripts, shell commands, URLs or credentials in SKILL.md
  • Incremental update

What it does

Threat Model Analyst is an agent skill from github/awesome-copilot, published by the product's own GitHub organization. Full STRIDE-A threat model analysis and incremental update skill for repositories and systems. Supports two modes: (1) Single analysis — full STRIDE-A threat model of a repository, producing architecture overviews, DFD diagrams, STRIDE-A analysis, prioritized findings, and executive assessments. (2) Incremental analysis — takes a previous threat model report as baseline, compares the codebase at the latest (or a given commit), and produces an updated report with change tracking (new, resolved, still-present…

Its SKILL.md is about 1.5k tokens, which your agent loads only when the skill is triggered. The skill folder holds 18 other files, including reference files (for example `references/analysis-principles.md`, `references/diagram-conventions.md` and `references/incremental-orchestrator.md`).

It sits in Security, covering Threat modeling. The repository describes itself as: Community-contributed instructions, agents, skills, and configurations to help you make the most of GitHub Copilot. The licence is MIT.

When your agent uses it

  • Explicitly requests a threat model analysis
  • Incremental update
  • Invokes /threat-model-analyst directly

Example prompts

  • “/threat-model-analyst”

What it can do on your machine

Read from SKILL.md and the folder at commit 727ff2e. It shows what the files ask for, not the result of running them.

  • Tool permissions

    Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.

    From allowed-tools in the SKILL.md frontmatter.

  • Runs code

    No scripts in the folder and no shell commands in SKILL.md.

    From the folder's file list and the shell code blocks in SKILL.md.

  • Network

    No URLs in SKILL.md.

    From URLs in SKILL.md, links to its own repository left out.

  • Credentials

    Names no API keys, tokens, secrets or passwords.

    From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.

Context cost

Threat Model Analyst loads about 1.5k tokens when it runs, and up to ~84k if it reads all its reference files. Until then it costs about 186 tokens; SKILL.md has 569 words of instructions outside code blocks.

Always · name and description, kept in context so the agent knows when to use it
~186
When it runs · the whole SKILL.md, loaded when a task matches
~1.5k
With references · SKILL.md plus every file in references/, read only if the agent opens them
~84k

Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.

Safety

Auto-check passed

The automated check found no risky patterns in SKILL.md.

Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); files beside SKILL.md are not scanned.

SKILL.md

The full file from github/awesome-copilot at commit 727ff2e, republished under its MIT licence (© github). 569 words, ~1,463 tokens.

Download SKILL.mdSave it as .claude/skills/threat-model-analyst/SKILL.md (or your agent's skills folder). This skill also uses 16 other files; get the full folder from GitHub.
name
threat-model-analyst
description
Full STRIDE-A threat model analysis and incremental update skill for repositories and systems. Supports two modes: (1) Single analysis — full STRIDE-A threat model of a repository, producing architecture overviews, DFD diagrams, STRIDE-A analysis, prioritized findings, and executive assessments. (2) Incremental analysis — takes a previous threat model report as baseline, compares the codebase at the latest (or a given commit), and produces an updated report with change tracking (new, resolved, still-present threats), STRIDE heatmap, findings diff, and an embedded HTML comparison. Only activate when the user explicitly requests a threat model analysis, incremental update, or invokes /threat-model-analyst directly.

Threat Model Analyst

You are an expert Threat Model Analyst. You perform security audits using STRIDE-A (STRIDE + Abuse) threat modeling, Zero Trust principles, and defense-in-depth analysis. You flag secrets, insecure boundaries, and architectural risks.

Getting Started

FIRST — Determine which mode to use based on the user's request:

Incremental Mode (Preferred for Follow-Up Analyses)

If the user's request mentions updating, refreshing, or re-running a threat model AND a prior report folder exists:

  • Action words: "update", "refresh", "re-run", "incremental", "what changed", "since last analysis"
  • AND a baseline report folder is identified (either explicitly named or auto-detected as the most recent threat-model-* folder with a threat-inventory.json)
  • OR the user explicitly provides a baseline report folder + a target commit/HEAD

Examples that trigger incremental mode:

  • "Update the threat model using threat-model-20260309-174425 as the baseline"
  • "Run an incremental threat model analysis"
  • "Refresh the threat model for the latest commit"
  • "What changed security-wise since the last threat model?"

→ Read incremental-orchestrator.md and follow the incremental workflow. The incremental orchestrator inherits the old report's structure, verifies each item against current code, discovers new items, and produces a standalone report with embedded comparison.

Comparing Commits or Reports

If the user asks to compare two commits or two reports, use incremental mode with the older report as the baseline. → Read incremental-orchestrator.md and follow the incremental workflow.

Single Analysis Mode

For all other requests (analyze a repo, generate a threat model, perform STRIDE analysis):

→ Read orchestrator.md — it contains the complete 10-step workflow, 34 mandatory rules, tool usage instructions, sub-agent governance rules, and the verification process. Do not skip this step.

Show full SKILL.md (311 more words)Show less

Reference Files

Load the relevant file when performing each task:

FileUse WhenContent
OrchestratorAlways — read firstComplete 10-step workflow, 34 mandatory rules, sub-agent governance, tool usage, verification process
Incremental OrchestratorIncremental/update analysesComplete incremental workflow: load old skeleton, change detection, generate report with status annotations, HTML comparison
Analysis PrinciplesAnalyzing code for security issuesVerify-before-flagging rules, security infrastructure inventory, OWASP Top 10:2025, platform defaults, exploitability tiers, severity standards
Diagram ConventionsCreating ANY Mermaid diagramColor palette, shapes, sidecar co-location rules, pre-render checklist, DFD vs architecture styles, sequence diagram styles
Output FormatsWriting ANY output fileTemplates for 0.1-architecture.md, 1-threatmodel.md, 2-stride-analysis.md, 3-findings.md, 0-assessment.md, common mistakes checklist
SkeletonsBefore writing EACH output file8 verbatim fill-in skeletons (skeleton-*.md) — read the relevant skeleton, copy VERBATIM, fill [FILL] placeholders. One skeleton per output file. Loaded on-demand to minimize context usage.
Verification ChecklistFinal verification pass + inline quick-checksAll quality gates: inline quick-checks (run after each file write), per-file structural, diagram rendering, cross-file consistency, evidence quality, JSON schema — designed for sub-agent delegation
TMT Element TaxonomyIdentifying DFD elements from codeComplete TMT-compatible element type taxonomy, trust boundary detection, data flow patterns, code analysis checklist

When to Activate

Incremental Mode (read incremental-orchestrator.md for workflow):

  • Update or refresh an existing threat model analysis
  • Generate a new analysis that builds on a prior report's structure
  • Track what threats/findings were fixed, introduced, or remain since a baseline
  • When a prior threat-model-* folder exists and the user wants a follow-up analysis

Single Analysis Mode:

  • Perform full threat model analysis of a repository or system
  • Generate threat model diagrams (DFD) from code
  • Perform STRIDE-A analysis on components and data flows
  • Validate security control implementations
  • Identify trust boundary violations and architectural risks
  • Write prioritized security findings with CVSS 4.0 / CWE / OWASP mappings

Comparing commits or reports:

  • To compare security posture between commits, use incremental mode with the older report as baseline

© github, MIT. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file

Files

SKILL.md and 16 other files (references) in skills/threat-model-analyst of github/awesome-copilot.

  • SKILL.md
  • references/analysis-principles.md
  • references/diagram-conventions.md
  • references/incremental-orchestrator.md
  • references/orchestrator.md
  • references/output-formats.md
  • references/skeletons/skeleton-architecture.md
  • references/skeletons/skeleton-assessment.md
  • references/skeletons/skeleton-dfd.md
  • references/skeletons/skeleton-findings.md
  • references/skeletons/skeleton-incremental-html.md
  • references/skeletons/skeleton-inventory.md
  • references/skeletons/skeleton-stride-analysis.md
  • references/skeletons/skeleton-summary-dfd.md
  • references/skeletons/skeleton-threatmodel.md
  • references/tmt-element-taxonomy.md
  • references/verification-checklist.md

Open the folder on GitHubat commit 727ff2e

Used in 1 other repository

We found 1 copy of this SKILL.md (exact, near-identical or edited) in other folders, from 1 other GitHub owner. This page covers the copy in github/awesome-copilot, which our catalogue first saw on October 7, 2026.

Compare with similar skills

Threat Model Analyst next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.

Threat Model Analyst compared with similar skills
SkillStarsUsed inTokensAuto-checkLicenceRepo updated
Threat Model Analyst this skillgithub/awesome-copilot40k1 repos~1.5kAutomated safety check: PassMIT
Fla Ascend Performancefla-org/flash-linear-attention5.8k—~5.6kAutomated safety check: PassMIT
Forensifyalexgreensh/repo-forensics187—~2.5kAutomated safety check: NotesCustom licence
Create Rulecartography-cncf/cartography4.1k—~3kAutomated safety check: PassApache-2.0
Commit Security Scancodexstar69/bug-hunter519—~629Automated safety check: PassMIT
Auditing Code For Vulnerabilitiestrilwu/secskills156—~3.2kAutomated safety check: PassMIT

Similar skills

  • Fla Ascend Performance

    fla-org/flash-linear-attention

    Guidelines for Ascend NPU kernel / Triton-Ascend backend performance work in the FLA repo.

    5.8k GitHub stars~5.6k tokensUpdated yesterday
    SecurityAuto-check passed

  • Forensify

    alexgreensh/repo-forensics

    Cross-agent self-inspection of your AI-agent stack. An agent skill from alexgreensh/repo-forensics.

    187 GitHub stars~2.5k tokensUpdated 10 days ago
    SecurityAuto-check: notes

  • Create Rule

    cartography-cncf/cartography

    Author a Cartography security rule (one or more Cypher Facts plus a Pydantic Finding output model) under cartography/rules/data/rules/.

    4.1k GitHub stars~3k tokensUpdated today
    SecurityAuto-check passed

  • Commit Security Scan

    codexstar69/bug-hunter

    Scan code changes for security vulnerabilities using Bug Hunter-native artifacts and STRIDE context.

    519 GitHub stars~629 tokensUpdated 1 mo ago
    SecurityAuto-check passed

  • Auditing Code For Vulnerabilities

    trilwu/secskills

    Audit source code for exploitable vulnerabilities using threat-model-driven review, taint tracing, invariant checking, and variant analysis.

    156 GitHub stars~3.2k tokensUpdated 1 mo ago
    SecurityAuto-check passed

  • Audit Browser Security Boundaries

    nordstjernen-web/northstar-browser

    Audit browser-engine changes that process untrusted content or cross native-memory, origin, network, storage, extension, decoder, sandbox, or operating-system boundaries.

    112 GitHub stars~920 tokensUpdated yesterday
    SecurityAuto-check passed

More from github/awesome-copilot

All 417 skills in this repo

  • Acquire Codebase Knowledge

    github/awesome-copilot

    Official

    Maps an unfamiliar codebase into seven evidence-backed documents in docs/codebase/, using a scan script and templates, for onboarding or architecture write-ups.

    40k GitHub starsUsed in 1 repo~2.3k tokens
    Auto-check passed

  • Azure Architecture Autopilot

    github/awesome-copilot

    Official

    Designs Azure infrastructure from a natural-language description, or diagrams an existing resource group, then refines the design through conversation and deploys it with Bicep.

    40k GitHub starsUsed in 1 repo~1.9k tokens
    Auto-check passed

  • Draw.io Diagram Generator

    github/awesome-copilot

    Official

    Generates, edits and validates draw.io files with correct mxGraph XML, covering flowcharts, architecture, sequence, ER and UML class diagrams.

    40k GitHub starsUsed in 1 repo~4.9k tokens
    Auto-check passed

  • Credit Risk Data Cleaning

    github/awesome-copilot

    Official

    Cleans raw credit data and screens variables before loan modeling, dropping unstable, noisy or redundant features and writing an Excel report of every step.

    40k GitHub starsUsed in 1 repo~1.5k tokens
    Auto-check passed

  • Daily Focus Board

    github/awesome-copilot

    Official

    Builds a warm, browser-based daily focus board the user updates by talking to their agent, with Eisenhower priorities, a brain-dump box and kind not-today carryover.

    40k GitHub stars~3k tokensUpdated today
    Auto-check passed

  • Python Pypi Package Builder

    github/awesome-copilot

    Official

    End-to-end skill for building, testing, linting, versioning, and publishing a production-grade Python library to PyPI.

    40k GitHub starsUsed in 1 repo~4.6k tokens
    Auto-check passed

Categories

Questions about Threat Model Analyst

What does Threat Model Analyst do?

Full STRIDE-A threat model analysis and incremental update skill for repositories and systems. Threat Model Analyst is an agent skill from github/awesome-copilot, published by the product's own GitHub organization. Full STRIDE-A threat model analysis and incremental update skill for repositories and systems.

When should I use Threat Model Analyst?

Threat Model Analyst fits situations like: explicitly requests a threat model analysis; incremental update; invokes /threat-model-analyst directly.

How do I install Threat Model Analyst in Claude Code?

Run `npx skills add github/awesome-copilot --skill threat-model-analyst -a claude-code`. Or copy the skill folder (skills/threat-model-analyst in github/awesome-copilot) into .claude/skills/threat-model-analyst in your project. Claude Code loads it when a task matches its description.

How do I install Threat Model Analyst in Codex?

Run `npx skills add github/awesome-copilot --skill threat-model-analyst -a codex`. Or copy the skill folder (skills/threat-model-analyst in github/awesome-copilot) into .agents/skills/threat-model-analyst in your project. Codex loads it when a task matches its description.

Can I use Threat Model Analyst in Cursor, Gemini CLI or GitHub Copilot?

Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add github/awesome-copilot --skill threat-model-analyst -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/threat-model-analyst, .gemini/skills/threat-model-analyst, .github/skills/threat-model-analyst and .opencode/skills/threat-model-analyst in your project.

What does Threat Model Analyst need to run?

SKILL.md names no scripts, command-line tools or credentials: Threat Model Analyst is instructions for the agent only.

Does Threat Model Analyst access the network?

SKILL.md contains no URLs. Any network use would come from the scripts or tools the agent runs. This is read from the text; nothing was executed.

Is Threat Model Analyst safe to install?

Our automated static check of SKILL.md found no risky patterns, such as piping downloads into a shell, reading credential files or hidden Unicode. It is not a guarantee. Review the folder before installing.

What licence does Threat Model Analyst use?

Threat Model Analyst is published under the MIT licence (the repository's licence). It allows redistribution, so the full SKILL.md is shown on this page.

How many tokens does Threat Model Analyst use?

About 1.5k tokens (SKILL.md is roughly 5.9k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full. Its references folder adds about 82k tokens, read only when the agent opens those files.

What are the alternatives to Threat Model Analyst?

Skills that share tags, products or a category with Threat Model Analyst: Fla Ascend Performance (fla-org/flash-linear-attention, 5.8k stars), Forensify (alexgreensh/repo-forensics, 187 stars), Create Rule (cartography-cncf/cartography, 4.1k stars) and Commit Security Scan (codexstar69/bug-hunter, 519 stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.

Who maintains Threat Model Analyst?

github (a GitHub organization, an official publisher) maintains it in github/awesome-copilot, which has 39,748 GitHub stars. The repository holds 417 skills in this directory. The repository was last updated on October 7, 2026.

Source: github/awesome-copilot on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.