New: 98,000+ skills indexed from GitHub repos with 100+ stars · every skill safety-checkedBrowse top skillsTop skills
Esc to closeBrowse all skills
Submit a skillBrowse skills
Submit a skillBrowse skills

Agent skill

Threat Modelling

by vinayaklatthe in vinayaklatthe/microsoft-security-skills

Guidance for threat modelling using STRIDE and the Microsoft Security Development Lifecycle (SDL).

MITAuto-check passedSecurity

Install Threat Modelling

skills CLI
$ npx skills add vinayaklatthe/microsoft-security-skills --skill threat-modelling -a claude-code

Project install by default; add -g for ~/.claude/skills/.

GitHub CLI
$ gh skill install vinayaklatthe/microsoft-security-skills threat-modelling --agent claude-code

Project scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).

Manual copy
$ git clone --depth 1 https://github.com/vinayaklatthe/microsoft-security-skills.git skills-src && mkdir -p .claude/skills && cp -r skills-src/skills/threat-modelling .claude/skills/threat-modelling && rm -rf skills-src

Use ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.

Claude Code skills documentation · loads skills from .claude/skills/

Facts

Skill name
threat-modelling
GitHub stars
175
Token cost
~1.8k tokens
SKILL.md length
817 words
Files
1
Skills in repo
50
Repo updated
First seen
Licence
MIT

At a glance

Guidance for threat modelling using STRIDE and the Microsoft Security Development Lifecycle (SDL).

  • Works in 8 steps: Define scope and assumptions - State… → Build the data-flow diagram (DFD) - Draw… → Enumerate threats with STRIDE per… → …
  • Org-wide security architecture (use security-architecture)
  • SKILL.md covers When to use, STRIDE - the six categories at…, Approach and Guardrails, plus 3 more sections
  • Instructions only: no scripts, shell commands, URLs or credentials in SKILL.md

What it does

Threat Modelling is an agent skill from vinayaklatthe/microsoft-security-skills. Guidance for threat modelling using STRIDE and the Microsoft Security Development Lifecycle (SDL). Covers data-flow diagrams, trust boundaries, the STRIDE categories, mitigation mapping, and tooling (Microsoft Threat Modeling Tool). WHEN: threat modeling, STRIDE, data flow diagram, trust boundary, identify threats, SDL threat modeling, security design review, threat model a system, mitigation mapping, Microsoft Threat Modeling Tool, secure design review, design-time security. DO NOT USE for org-wide security…

Its SKILL.md is about 1.8k tokens, which your agent loads only when the skill is triggered. It is a single SKILL.md file with no bundled scripts.

It sits in Security, covering Threat modeling. It works with Microsoft Defender. The repository describes itself as: Curated Microsoft Security skills for AI agents - Defender, Sentinel, Entra, Purview, Intune, Security Copilot. The licence is MIT.

When your agent uses it

  • Org-wide security architecture (use security-architecture)
  • For runtime detection (use sentinel / defender-xdr)

Example prompts

  • “/threat-modelling”

Workflow steps

8 steps, taken from the first numbered list in SKILL.md.

  1. Define scope and assumptions - State what is in scope, what is out, the trust model
  2. Build the data-flow diagram (DFD) - Draw external entities, processes, data stores, data
  3. Enumerate threats with STRIDE per element - For each element/flow, walk through all six
  4. Rank threats by risk - Use DREAD or a simple high/medium/low based on likelihood and
  5. Map each threat to a concrete mitigation - Mitigation = a specific control (MFA, input
  6. Validate mitigations are implemented - During build, confirm each mitigation lands in
  7. Re-model on material change - Treat threat modelling as iterative. Every new trust
  8. Use tooling where it helps - The Microsoft Threat Modeling Tool generates STRIDE

What it can do on your machine

Read from SKILL.md and the folder at commit 15f16df. It shows what the files ask for, not the result of running them.

  • Tool permissions

    Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.

    From allowed-tools in the SKILL.md frontmatter.

  • Runs code

    No scripts in the folder and no shell commands in SKILL.md.

    From the folder's file list and the shell code blocks in SKILL.md.

  • Network

    Links to these hosts (documentation or services it may open):

    • learn.microsoft.com
    • microsoft.com

    From URLs in SKILL.md, links to its own repository left out.

  • Credentials

    Names no API keys, tokens, secrets or passwords.

    From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.

Context cost

Threat Modelling loads about 1.8k tokens when it runs. Until then it costs about 157 tokens; SKILL.md has 817 words of instructions outside code blocks.

Always · name and description, kept in context so the agent knows when to use it
~157
When it runs · the whole SKILL.md, loaded when a task matches
~1.8k

Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.

Safety

Auto-check passed

The automated check found no risky patterns in SKILL.md.

Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); files beside SKILL.md are not scanned.

SKILL.md

The full file from vinayaklatthe/microsoft-security-skills at commit 15f16df, republished under its MIT licence (© vinayaklatthe). 817 words, ~1,751 tokens.

Download SKILL.mdSave it as .claude/skills/threat-modelling/SKILL.md (or your agent's skills folder).
name
threat-modelling
description
Guidance for threat modelling using STRIDE and the Microsoft Security Development Lifecycle (SDL). Covers data-flow diagrams, trust boundaries, the STRIDE categories, mitigation mapping, and tooling (Microsoft Threat Modeling Tool). WHEN: threat modeling, STRIDE, data flow diagram, trust boundary, identify threats, SDL threat modeling, security design review, threat model a system, mitigation mapping, Microsoft Threat Modeling Tool, secure design review, design-time security. DO NOT USE for org-wide security architecture (use security-architecture) or for runtime detection (use sentinel / defender-xdr).
license
MIT
metadata.author
Microsoft
metadata.version
0.1.0

Threat Modelling (STRIDE / SDL)

Threat modelling is a structured Microsoft Security Development Lifecycle (SDL) practice for identifying, communicating, and mitigating threats early in design - before code is written, and re-applied whenever the design materially changes.

When to use

Designing a new system, significantly changing an existing one, evaluating an architecture for security, or running a formal security design review.

Do not use this skill for:

  • Org-wide security architecture or roadmap (use security-architecture)
  • Runtime detection or incident response (use sentinel / defender-xdr)
  • Code-level vulnerability scanning (use SAST/DAST tooling)

STRIDE - the six categories at a glance

LetterThreatSecurity property it breaksTypical mitigation
SSpoofingAuthenticationMFA, mutual TLS, signed tokens
TTamperingIntegritySigning, hashing, write-protected stores
RRepudiationNon-repudiationAudit logging, signed transactions
IInformation disclosureConfidentialityEncryption (rest+transit), authorization
DDenial of serviceAvailabilityRate limiting, quotas, autoscale, WAF
EElevation of privilegeAuthorizationLeast privilege, input validation, sandboxing

Rule of thumb: walk each element of the data-flow diagram against all six STRIDE categories. Skipping categories because "they don't apply here" is the most common way real threats are missed.

Approach

  1. Define scope and assumptions - State what is in scope, what is out, the trust model (who you trust to do what), and the assets being protected. A threat model without scope is an opinion. Verify: a one-page scope statement names assets, actors, in-scope components, and explicit out-of-scope items.
  2. Build the data-flow diagram (DFD) - Draw external entities, processes, data stores, data flows, and trust boundaries. Trust boundaries are where authority/data crosses between principals - that is where most threats live. Verify: every data flow crossing a trust boundary is highlighted; no boundary-crossing flow is missing.
  3. Enumerate threats with STRIDE per element - For each element/flow, walk through all six STRIDE categories. For each applicable threat, write a one-line description. Verify: every element has been evaluated against all six letters; you can show the coverage matrix.
  4. Rank threats by risk - Use DREAD or a simple high/medium/low based on likelihood and impact. Triage so the team works the top tier first. Verify: top 10 threat list is risk-ranked, not order-of-discovery.
  5. Map each threat to a concrete mitigation - Mitigation = a specific control (MFA, input validation, signing, encryption, rate limiting, least privilege) plus an owner and a target date. Abstract "we should secure that" is not a mitigation. Verify: every top-tier threat has a named mitigation, an owner, and an implementation target.
  6. Validate mitigations are implemented - During build, confirm each mitigation lands in code, configuration, or process. During review, test that the mitigation actually blocks the threat (negative test). Verify: mitigation tests exist in the test suite or in a security review checklist.
  7. Re-model on material change - Treat threat modelling as iterative. Every new trust boundary, new external integration, new data classification, or major refactor is a trigger to re-model the affected slice. Verify: the team has a written trigger list and the model is updated after the most recent trigger event.
  8. Use tooling where it helps - The Microsoft Threat Modeling Tool generates STRIDE threats per DFD element automatically. Threat-modelling cards / templates work well for workshops without tooling.
Show full SKILL.md (296 more words)Show less

Guardrails

  • Threat modelling is iterative - revisit each major design change, not once at project start. A model frozen at design time has no relationship to the shipped system.
  • Capture assumptions and out-of-scope items explicitly - undocumented assumptions are the next year's security incidents.
  • Tie threats to actionable mitigations with owners and dates, not abstract risks.
  • Walk all six STRIDE letters per element - skipping categories is the most common gap.
  • Threat modelling is not a substitute for code review, dependency scanning, or pen testing. It complements them by shaping what to test.
  • The output is the shared understanding, not the document. If the dev team cannot explain the top threats verbally, the model has not landed.

Common anti-patterns

  • "We did a threat model at project kickoff" - and never updated it. The system being threat-modelled no longer exists.
  • A 200-threat spreadsheet with no ranking. Nothing gets fixed because everything looks equal. Triage is the deliverable.
  • STRIDE letters skipped because "they don't apply." Force the walk; document why a category genuinely does not apply rather than skipping silently.
  • Mitigation = "use TLS". Not a mitigation. Mitigation = TLS 1.2+ enforced on the gateway with cipher suite X, validated by test Y, owned by Z.
  • Threat model as a security-team artefact that engineering never reads. The dev team must own the model; security facilitates.

Example prompts

  • Run a STRIDE threat model with a data flow diagram and trust boundaries.
  • Use the Microsoft Threat Modeling Tool for a design review.
  • How do I identify threats and map mitigations for a new system?
  • Conduct an SDL threat modelling session.
  • What does the E in STRIDE cover and how is it mitigated?

Microsoft Learn

© vinayaklatthe, MIT. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file

Files

Just SKILL.md in skills/threat-modelling of vinayaklatthe/microsoft-security-skills.

Open the folder on GitHubat commit 15f16df

Compare with similar skills

Threat Modelling next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.

Threat Modelling compared with similar skills
SkillStarsUsed inTokensAuto-checkLicenceRepo updated
Threat Modelling this skillvinayaklatthe/microsoft-security-skills175—~1.8kAutomated safety check: PassMIT
Configuring Windows Defender Advanced Settingsmukul975/Anthropic-Cybersecurity-Skills34k—~3.1kAutomated safety check: PassApache-2.0
Azure External Attack Surface ManagementMicrosoftDocs/Agent-Skills776—~935Automated safety check: PassCC-BY-4.0
Forensifyalexgreensh/repo-forensics190—~2.5kAutomated safety check: NotesCustom licence
Create Rulecartography-cncf/cartography4.1k—~3kAutomated safety check: PassApache-2.0
Commit Security Scancodexstar69/bug-hunter520—~629Automated safety check: PassMIT

Similar skills

  • Configuring Windows Defender Advanced Settings

    mukul975/Anthropic-Cybersecurity-Skills

    Configures Microsoft Defender for Endpoint (MDE) advanced protection settings including attack surface reduction rules, controlled folder access, network protection, and exploit protection.

    34k GitHub stars~3.1k tokensUpdated 1 mo ago
    SecurityAuto-check passed

  • Azure External Attack Surface Management

    MicrosoftDocs/Agent-Skills

    Official

    Expert knowledge for Azure External Attack Surface Management development including configuration.

    776 GitHub stars~935 tokensUpdated 5 days ago
    SecurityAuto-check passed

  • Forensify

    alexgreensh/repo-forensics

    Cross-agent self-inspection of your AI-agent stack. An agent skill from alexgreensh/repo-forensics.

    190 GitHub stars~2.5k tokensUpdated 14 days ago
    SecurityAuto-check: notes

  • Create Rule

    cartography-cncf/cartography

    Author a Cartography security rule (one or more Cypher Facts plus a Pydantic Finding output model) under cartography/rules/data/rules/.

    4.1k GitHub stars~3k tokensUpdated today
    SecurityAuto-check passed

  • Commit Security Scan

    codexstar69/bug-hunter

    Scan code changes for security vulnerabilities using Bug Hunter-native artifacts and STRIDE context.

    520 GitHub stars~629 tokensUpdated 1 mo ago
    SecurityAuto-check passed

  • Auditing Code For Vulnerabilities

    trilwu/secskills

    Audit source code for exploitable vulnerabilities using threat-model-driven review, taint tracing, invariant checking, and variant analysis.

    157 GitHub stars~3.2k tokensUpdated 1 mo ago
    SecurityAuto-check passed

More from vinayaklatthe/microsoft-security-skills

All 50 skills in this repo

  • API Security Design

    vinayaklatthe/microsoft-security-skills

    Guidance for designing secure APIs on Azure - authentication, authorization, gateway controls, input validation, rate limiting, secret management, and runtime threat detection - aligned to OWASP API…

    175 GitHub stars~2.2k tokensUpdated 3 mo ago
    Auto-check passed

  • Azure App Service Security

    vinayaklatthe/microsoft-security-skills

    Guidance for securing Azure App Service web apps and APIs — managed identity, Easy Auth with Microsoft Entra ID, network isolation via private endpoints + VNet integration, HTTPS / TLS hardening…

    175 GitHub stars~1.9k tokensUpdated 3 mo ago
    Auto-check passed

  • Azure Arc

    vinayaklatthe/microsoft-security-skills

    Guidance for Azure Arc — projecting on-premises, multicloud (AWS/GCP), and edge servers, Kubernetes, and data services into Azure Resource Manager for unified governance, security, and management.

    175 GitHub stars~1.9k tokensUpdated 3 mo ago
    Auto-check passed

  • Azure Bastion Jit

    vinayaklatthe/microsoft-security-skills

    Guidance for secure remote VM management in Azure using Azure Bastion combined with Defender for Cloud just-in-time (JIT) VM access.

    175 GitHub stars~2.2k tokensUpdated 3 mo ago
    Auto-check passed

  • Azure Confidential Computing

    vinayaklatthe/microsoft-security-skills

    Guidance for Azure Confidential Computing — protecting data in use through hardware-based Trusted Execution Environments (TEEs).

    175 GitHub stars~2.4k tokensUpdated 3 mo ago
    Auto-check passed

  • Azure Ddos Protection

    vinayaklatthe/microsoft-security-skills

    Guidance for Azure DDoS Protection — Network Protection (per-VNet) and IP Protection (per public IP) tiers built on the same always-on Microsoft platform.

    175 GitHub stars~2k tokensUpdated 3 mo ago
    Auto-check passed

Works with

Categories

Questions about Threat Modelling

What does Threat Modelling do?

Guidance for threat modelling using STRIDE and the Microsoft Security Development Lifecycle (SDL). Threat Modelling is an agent skill from vinayaklatthe/microsoft-security-skills. Guidance for threat modelling using STRIDE and the Microsoft Security Development Lifecycle (SDL).

When should I use Threat Modelling?

Threat Modelling fits situations like: org-wide security architecture (use security-architecture); for runtime detection (use sentinel / defender-xdr).

How do I install Threat Modelling in Claude Code?

Run `npx skills add vinayaklatthe/microsoft-security-skills --skill threat-modelling -a claude-code`. Or copy the skill folder (skills/threat-modelling in vinayaklatthe/microsoft-security-skills) into .claude/skills/threat-modelling in your project. Claude Code loads it when a task matches its description.

How do I install Threat Modelling in Codex?

Run `npx skills add vinayaklatthe/microsoft-security-skills --skill threat-modelling -a codex`. Or copy the skill folder (skills/threat-modelling in vinayaklatthe/microsoft-security-skills) into .agents/skills/threat-modelling in your project. Codex loads it when a task matches its description.

Can I use Threat Modelling in Cursor, Gemini CLI or GitHub Copilot?

Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add vinayaklatthe/microsoft-security-skills --skill threat-modelling -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/threat-modelling, .gemini/skills/threat-modelling, .github/skills/threat-modelling and .opencode/skills/threat-modelling in your project.

What does Threat Modelling need to run?

SKILL.md names no scripts, command-line tools or credentials: Threat Modelling is instructions for the agent only.

Does Threat Modelling access the network?

SKILL.md names 2 domains. As links in the text: learn.microsoft.com and microsoft.com. This is read from the text; nothing was executed.

Is Threat Modelling safe to install?

Our automated static check of SKILL.md found no risky patterns, such as piping downloads into a shell, reading credential files or hidden Unicode. It is not a guarantee. Review the folder before installing.

What licence does Threat Modelling use?

Threat Modelling is published under the MIT licence (declared in SKILL.md). It allows redistribution, so the full SKILL.md is shown on this page.

How many tokens does Threat Modelling use?

About 1.8k tokens (SKILL.md is roughly 7k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full.

What are the alternatives to Threat Modelling?

Skills that share tags, products or a category with Threat Modelling: Configuring Windows Defender Advanced Settings (mukul975/Anthropic-Cybersecurity-Skills, 34k stars), Azure External Attack Surface Management (MicrosoftDocs/Agent-Skills, 776 stars), Forensify (alexgreensh/repo-forensics, 190 stars) and Create Rule (cartography-cncf/cartography, 4.1k stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.

Who maintains Threat Modelling?

vinayaklatthe (a GitHub user) maintains it in vinayaklatthe/microsoft-security-skills, which has 175 GitHub stars. The repository holds 50 skills in this directory. The repository was last updated on June 18, 2026.

Source: vinayaklatthe/microsoft-security-skills on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.