information-security-analysts Runs a complete, framework-driven threat-modeling engagement against any system the user describes or that lives in the current repo. Inventories assets and data classifications, reconstructs a data-flow diagram with trust boundaries, enumerates threats per element with STRIDE (plus LINDDUN for personal-data flows), scores each deterministically with OWASP Risk Rating, designs concrete mitigations, runs a gap-analysis loop, and persists a versioned threat model plus a diffable remediation register (open/mitigated/accepted/transferred) tracking known risks to closure across sessions. Exports OWASP Threat Dragon JSON and a Markdown report. Use whenever the user designs, ships, reviews, or changes a feature with real attack surface — auth, sessions, payment/webhooks, file uploads, multi-tenant data, secrets/CI, LLM prompt-injection, public APIs — even if they never say "threat model": treat "is this secure?", "what could go wrong?", "did I miss anything?", or "before we launch" as triggers. Also use to revisit a
2026-06-23