| name | full |
| description | Complete threat modeling workflow. Discovers assets, analyzes threats (STRIDE), verifies controls, maps compliance, generates reports. |
| allowed-tools | Read, Write, Glob, Grep, Bash(mkdir:*), Bash(ls:*) |
Full Threat Model
Usage
/threatmodel:full [--docs <path>] [--compliance owasp,soc2,pci-dss]
What It Does
Runs complete threat modeling in 5 phases:
- Initialize - Read docs, discover assets, map data flows, identify trust boundaries
- Threats - Apply STRIDE to each component, build attack trees, calculate risk scores
- Verify - Search code for security controls, collect evidence, document gaps
- Compliance - Map to OWASP Top 10, SOC2, PCI-DSS frameworks
- Report - Generate risk report, executive summary, create baseline
Output Structure
.threatmodel/
├── config.yaml
├── state/
│ ├── assets.json # Discovered components
│ ├── dataflows.json # Data movement
│ ├── threats.json # STRIDE analysis
│ ├── controls.json # Security controls found
│ ├── gaps.json # Missing controls
│ └── compliance.json # Framework mapping
├── diagrams/
│ └── architecture.mmd # Mermaid diagram
├── reports/
│ ├── risk-report.md
│ └── executive-summary.md
└── baseline/
└── snapshot-{date}.json
STRIDE Categories
- Spoofing - Can attacker impersonate?
- Tampering - Can data be modified?
- Repudiation - Can actions be denied?
- Information Disclosure - Can data leak?
- Denial of Service - Can service be disrupted?
- Elevation of Privilege - Can permissions be gained?
Risk Scoring
Risk = Likelihood (1-5) × Impact (1-5)
| Score | Level |
|---|
| 16-25 | Critical |
| 10-15 | High |
| 5-9 | Medium |
| 1-4 | Low |
Process
- Scan documentation at --docs path for architecture info
- Extract assets: services, data stores, clients, integrations
- Map data flows: source → destination, protocols, encryption
- Identify trust boundaries: network, privilege, environment
- Apply STRIDE to each asset and trust boundary crossing
- Search codebase for control implementations (auth, validation, encryption)
- Document gaps where controls are missing
- Map to compliance frameworks
- Generate reports with prioritized findings
- Create baseline snapshot for drift detection
