メニュー
Run the complete threat modeling workflow from initialization through reporting. Orchestrates all other skills in sequence. Use when performing full threat model analysis, running complete security assessment, or generating comprehensive threat documentation.
Codex または Claude でインストール この Prompt をコピーして Codex、Claude、または他のアシスタントに貼り付けると、Skill ページを確認してインストールできます。
SOC 職業分類に基づく
Show current threat model status including asset counts, threat distribution, control verification status, and compliance coverage. Use when checking threat model status, getting overview of security posture, or reviewing current state.
Map threats and controls to compliance frameworks like OWASP Top 10, SOC2, PCI-DSS, HIPAA, GDPR. Generates compliance reports with coverage percentages and gaps. Use when checking compliance status, mapping to security frameworks, or generating audit documentation.
Initialize a threat modeling project by analyzing architecture documentation. Creates threat model structure with asset inventory, data flows, trust boundaries, and attack surface mapping. Use when starting new threat modeling work, setting up threat model for a project, or creating initial security assessment.
Generate comprehensive prioritized risk reports with executive summaries, threat details, gap analysis, and recommendations. Use when creating security reports, generating executive summaries, documenting risk assessments, or preparing audit documentation.
Analyze threats against discovered assets using STRIDE or PASTA framework. Generates threat catalog, attack trees, abuse cases, and risk register. Use when analyzing threats, identifying attack vectors, assessing security risks, or expanding threat catalog.
Verify that security controls documented in the threat model actually exist in the codebase. Searches for control implementations, validates configurations, identifies gaps. Use when validating threat model against code, checking security control implementation, or finding security gaps.
| name | tm-full |
| description | Run the complete threat modeling workflow from initialization through reporting. Orchestrates all other skills in sequence. Use when performing full threat model analysis, running complete security assessment, or generating comprehensive threat documentation. |
| allowed-tools | Read, Write, Glob, Grep, Bash(mkdir:*), Bash(ls:*) |
Orchestrate the complete threat modeling workflow in a single command:
/tm-full [--docs <path>] [--framework stride|pasta] [--compliance <list>] [--output <path>] [--report-level executive|standard|detailed]
Arguments:
--docs: Path to architecture documentation (default: ./docs)--framework: Threat framework (default: stride)--compliance: Compliance frameworks, comma-separated (default: owasp)--output: Output directory (default: .threatmodel)--report-level: Report detail level (default: standard)┌─────────────────────────────────────────────────────────────┐
│ FULL WORKFLOW │
├─────────────────────────────────────────────────────────────┤
│ │
│ [1/5] INITIALIZATION │
│ ───────────────────── │
│ • Read architecture documentation │
│ • Extract assets and classify │
│ • Map data flows │
│ • Identify trust boundaries │
│ • Catalog attack surface │
│ • Generate architecture diagrams │
│ │
│ Output: assets.json, dataflows.json, trust-boundaries.json │
│ attack-surface.json, diagrams/*.mmd │
│ │
├─────────────────────────────────────────────────────────────┤
│ │
│ [2/5] THREAT ANALYSIS │
│ ───────────────────── │
│ • Apply STRIDE to each component │
│ • Enumerate threats per attack surface │
│ • Build attack trees for critical threats │
│ • Assess likelihood and impact │
│ • Calculate risk scores │
│ • Create risk register │
│ │
│ Output: threats.json, attack-trees.json, risk-register.json│
│ │
├─────────────────────────────────────────────────────────────┤
│ │
│ [3/5] CONTROL VERIFICATION │
│ ───────────────────────── │
│ • Identify required controls │
│ • Search codebase for implementations │
│ • Verify configurations │
│ • Collect evidence │
│ • Document gaps │
│ │
│ Output: controls.json, gaps.json, verification.json │
│ │
├─────────────────────────────────────────────────────────────┤
│ │
│ [4/5] COMPLIANCE MAPPING │
│ ─────────────────────── │
│ • Map threats to framework requirements │
│ • Map controls to requirements │
│ • Calculate coverage percentages │
│ • Identify compliance gaps │
│ │
│ Output: compliance.json, compliance-report.md │
│ │
├─────────────────────────────────────────────────────────────┤
│ │
│ [5/5] REPORT GENERATION │
│ ─────────────────────── │
│ • Aggregate all findings │
│ • Prioritize risks │
│ • Generate countermeasures │
│ • Create executive summary │
│ • Compile detailed report │
│ • Create baseline snapshot │
│ │
│ Output: risk-report.md, executive-summary.md, │
│ baseline/snapshot-{date}.json │
│ │
└─────────────────────────────────────────────────────────────┘
═══════════════════════════════════════════════════════════════
THREAT MODELING - FULL WORKFLOW
═══════════════════════════════════════════════════════════════
Project: My Application
Documentation: ./docs/architecture
Framework: STRIDE
Compliance: OWASP, SOC2
───────────────────────────────────────────────────────────────
[1/5] Initializing...
├── Scanning documentation...
├── Extracting assets... found 14
├── Mapping data flows... found 22
├── Identifying trust boundaries... found 5
├── Cataloging attack surface... found 12 entries
└── Generating diagrams... done
✓ Initialization complete
[2/5] Analyzing threats...
├── Applying STRIDE framework...
├── Processing 14 assets...
├── Analyzing 8 trust boundary crossings...
├── Building attack trees for critical threats...
└── Creating risk register...
✓ Threat analysis complete (47 threats identified)
[3/5] Verifying controls...
├── Identifying required controls... 29 needed
├── Searching codebase...
├── Verifying implementations...
└── Documenting gaps...
✓ Verification complete (18 verified, 7 partial, 4 missing)
[4/5] Mapping compliance...
├── Mapping to OWASP Top 10...
├── Mapping to SOC2...
└── Calculating coverage...
✓ Compliance mapping complete (OWASP: 82%, SOC2: 88%)
[5/5] Generating reports...
├── Aggregating findings...
├── Prioritizing risks...
├── Generating countermeasures...
├── Creating executive summary...
├── Compiling detailed report...
└── Creating baseline snapshot...
✓ Reports generated
───────────────────────────────────────────────────────────────
SUMMARY
───────────────────────────────────────────────────────────────
Discovery:
• 14 assets discovered
• 22 data flows mapped
• 5 trust boundaries identified
• 12 attack surface entries cataloged
Threats:
• 47 threats identified
• 5 critical, 12 high, 18 medium, 12 low
• 3 unmitigated critical threats
Controls:
• 29 controls required
• 62% fully implemented
• 11 gaps identified (2 critical)
Compliance:
• OWASP Top 10: 82%
• SOC2: 88%
───────────────────────────────────────────────────────────────
CRITICAL FINDINGS
───────────────────────────────────────────────────────────────
1. [CRITICAL] Credential Stuffing Attack
Risk: 8.5 | Target: Auth API | Gap: Rate limiting insufficient
2. [CRITICAL] SQL Injection in Legacy Module
Risk: 8.2 | Target: Reports API | Gap: Queries not parameterized
3. [CRITICAL] JWT Token Theft via XSS
Risk: 8.0 | Target: Session | Gap: HttpOnly not set
───────────────────────────────────────────────────────────────
FILES CREATED
───────────────────────────────────────────────────────────────
.threatmodel/
├── config.yaml
├── state/
│ ├── assets.json
│ ├── dataflows.json
│ ├── trust-boundaries.json
│ ├── attack-surface.json
│ ├── threats.json
│ ├── controls.json
│ ├── gaps.json
│ ├── risk-register.json
│ └── compliance.json
├── diagrams/
│ ├── architecture.mmd
│ ├── dataflow.mmd
│ └── trust-boundaries.mmd
├── reports/
│ ├── risk-report.md
│ ├── executive-summary.md
│ └── compliance-report.md
└── baseline/
└── snapshot-20250120.json
───────────────────────────────────────────────────────────────
NEXT STEPS
───────────────────────────────────────────────────────────────
1. Review risk report: .threatmodel/reports/risk-report.md
2. Address critical findings immediately
3. Share executive summary with stakeholders
4. Create Jira tickets for gaps
5. Schedule follow-up assessment
═══════════════════════════════════════════════════════════════
THREAT MODEL COMPLETE
═══════════════════════════════════════════════════════════════
[1/5] Initializing...
└── ERROR: No documentation found at ./docs
Please specify documentation path:
/tm-full --docs /path/to/architecture/docs
Or create documentation first.
[3/5] Verifying controls...
└── WARNING: Could not access codebase at ./src
Continuing with available information...
Control verification skipped.
To include verification:
/tm-verify --thorough
Continuing to next step...
When executing this skill:
Parse arguments:
Execute Step 1 - Initialize:
Execute Step 2 - Threat Analysis:
Execute Step 3 - Verification:
Execute Step 4 - Compliance:
Execute Step 5 - Reporting:
Handle errors gracefully:
Display final summary:
The full workflow processes multiple phases. Between phases:
This skill orchestrates: