Run any Skill in Manus with one click

apiiro-threat-model

Stars0

Forks1

UpdatedApril 26, 2026 at 11:02

Apiiro CLI command for STRIDE-based threat modeling: analyze feature specs, requirements, or architectural changes for security threats. Use this skill whenever the user wants a threat model, threat analysis, STRIDE analysis, or security review of a design or feature spec before implementation. Also trigger when they ask "what are the threats in this design", "threat model this feature", "what could go wrong with this approach", "is this architecture secure", or want to understand the security implications of a proposed change. This is different from guardian (which answers freeform security questions about existing code) — use threat-model when the user has a design, spec, or feature description they want analyzed for threats.

Installation

Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.

Run Skill in Manus

Source

apiiro

apiiro/marketplace

View GitHub Repository View Creator Repositories

Download

Run Skill in Manus

Related occupationsSOC

Based on SOC occupation classification

Information Security AnalystsComputer and Mathematical Occupations·SOC 15-1212

SKILL.md

readonly

name

apiiro-threat-model

description

Apiiro Threat Model

Analyze a design, feature spec, or architectural change for security threats using STRIDE methodology. This is for proactive analysis of proposed changes — for questions about existing code, use the apiiro-guardian skill instead.

Usage

Pass the content to analyze as the first argument. For longer specs, pipe from a file or use quotes.

apiiro threat-model "Add a new REST API endpoint that accepts file uploads and stores them in S3"
apiiro threat-model "Implement OAuth2 authorization code flow with PKCE" --title "Auth redesign"
apiiro threat-model "Add webhook support for third-party integrations" -o json
apiiro threat-model "Migrate user sessions from cookies to JWT tokens" -f threat-report.md

Options: -t, --title <title> (summary of what is analyzed), -o, --output <json|text> (default: text), -f, --file <path>, --timeout <seconds> (default: 360).

Text output returns the analysis directly. JSON output includes success, analysis, and error fields.

More from this repository

same repository

apiiro-setup

apiiro/marketplace

Install Apiiro CLI, authenticate, verify version, check available features, and configure hooks

2026-06-090

apiiro-diff-scan

apiiro/marketplace

Apiiro CLI command for comparing two git references for security risks — the primary CI/CD integration point. Use this skill whenever the user mentions diff scanning, comparing branches or commits for security issues, CI/CD security gates, blocking PRs on risk, or wants to wire Apiiro into a build pipeline. Even if the user doesn't say "apiiro", trigger when they say things like "scan this PR", "compare main to my branch for security", "block merges on critical risks", or want to set up security gating in CI. For local secrets/OSS scanning, use apiiro-fast-scan instead.

2026-05-140

apiiro-secure-prompt

apiiro/marketplace

Apiiro CLI command for enhancing developer prompts with security considerations before coding begins. Takes a coding task description and returns the same task with security requirements injected — preserving the original business intent while adding security guardrails. Use this skill whenever the user wants to improve a coding task with security guidance, add security requirements to a task before starting implementation, or get a security-enhanced version of a prompt. Trigger on phrases like "make this prompt more secure", "add security to my task", "what security should I consider for this feature", or when the user is about to start a coding task and wants security baked in. This is different from threat-model (which produces a full STRIDE analysis report) — secure-prompt enhances a *task description* the user is about to implement.

2026-04-290

apiiro-fast-scan

apiiro/marketplace

Apiiro CLI command for quick local security scanning: fast-scan for secrets and OSS vulnerabilities, plus pre-commit hooks. Use this skill whenever the user mentions scanning code locally, secrets detection, OSS vulnerabilities, pre-commit hooks, or wants to check files for security issues before committing. Even if the user doesn't say "apiiro", trigger when they say things like "scan for secrets", "check my code before I push", "are there any leaked credentials", "check dependencies for vulnerabilities", or want to set up local security scanning. For comparing git references in CI/CD, use apiiro-diff-scan instead.

2026-04-260

apiiro-fix

apiiro/marketplace

Apiiro CLI commands for remediating and fixing security risks: get remediation prompts and use Guardian AI to fix findings. Use this skill whenever the user wants to fix, remediate, patch, or resolve a security risk or vulnerability in their repository. Also trigger when they ask "how do I fix this risk", "remediate this finding", "resolve this vulnerability", or want actionable guidance on resolving a security issue. For listing or inspecting risks, use the apiiro-risks skill instead.

2026-04-260

apiiro-guardian

apiiro/marketplace

Apiiro CLI commands for querying the Guardian AI agent: ask security questions, get analysis and insights about a repository, and manage repository detection. Use this skill whenever the user wants AI-powered security analysis, security posture review, or wants to ask questions about their codebase's security. Also trigger when they need deep analysis of authentication flows, attack surfaces, or want an AI to explain security concepts. Even without mentioning "apiiro" or "guardian", trigger when the user asks things like "is this code secure?", "what's the attack surface here?", or "explain this vulnerability". For dedicated STRIDE threat modeling of a design or feature spec, use the apiiro-threat-model skill instead. For fixing a known risk, use apiiro-fix.

2026-04-260

name

apiiro-threat-model

description

Apiiro Threat Model

Usage

Pass the content to analyze as the first argument. For longer specs, pipe from a file or use quotes.

apiiro threat-model "Add a new REST API endpoint that accepts file uploads and stores them in S3"
apiiro threat-model "Implement OAuth2 authorization code flow with PKCE" --title "Auth redesign"
apiiro threat-model "Add webhook support for third-party integrations" -o json
apiiro threat-model "Migrate user sessions from cookies to JWT tokens" -f threat-report.md

Options: -t, --title <title> (summary of what is analyzed), -o, --output <json|text> (default: text), -f, --file <path>, --timeout <seconds> (default: 360).

Text output returns the analysis directly. JSON output includes success, analysis, and error fields.