メニュー
Threat modeling workflow for software systems: scope, data flow diagrams, STRIDE analysis, risk scoring, and turning mitigations into backlog and tests
Codex または Claude でインストール この Prompt をコピーして Codex、Claude、または他のアシスタントに貼り付けると、Skill ページを確認してインストールできます。
Process documents with the Nutrient DWS API. Use this skill when the user wants to convert documents (PDF, DOCX, XLSX, PPTX, HTML, images), extract text or tables from PDFs, OCR scanned documents, redact sensitive information (PII, SSN, emails, credit cards), add watermarks, digitally sign PDFs, fill PDF forms, or check API credit usage. Activates on keywords: PDF, document, convert, extract, OCR, redact, watermark, sign, merge, compress, form fill, document processing.
When the user wants to optimize images for search engines and performance. Also use when the user mentions "image SEO," "alt text," "image captions," "figcaption," "image optimization," "WebP," "lazy loading," "LCP," "image sitemap," "responsive images," "srcset," "image format," or "hero image optimization."
Diagnose and fix bugs with root-cause analysis and verification. Use when you have a concrete issue report, failing behavior, runtime error, or test regression that should be resolved safely. For ambiguous, high-risk, or broad-scope issues, stop and route to write-plan first.
Stores decisions and patterns in knowledge graph. Use when saving patterns, remembering outcomes, or recording decisions.
Unified decision tree for web research and competitive monitoring. Auto-selects WebFetch, Tavily, or agent-browser based on target site characteristics and available API keys. Includes competitor page tracking, snapshot diffing, and change alerting. Use when researching web content, scraping, extracting raw markdown, capturing documentation, or monitoring competitor changes.
Never test mock behavior. Never add test-only methods to production classes. Understand dependencies before mocking. Language-agnostic principles with TypeScript/Jest and Python/pytest examples.
SOC 職業分類に基づく
| name | threat-modeling |
| description | Threat modeling workflow for software systems: scope, data flow diagrams, STRIDE analysis, risk scoring, and turning mitigations into backlog and tests |
| version | 1.0.0 |
| category | universal |
| author | Claude MPM Team |
| license | MIT |
| progressive_disclosure | {"entry_point":{"summary":"Run a lightweight threat modeling workshop (STRIDE) and turn risks into concrete mitigations, tests, and PR checks","when_to_use":"When designing new features, reviewing architecture changes, handling sensitive data, or hardening auth/payment/multi-tenant flows","quick_start":"1. Define scope/assets 2. Draw data flows + trust boundaries 3. STRIDE per element 4. Score + prioritize 5. Track mitigations + tests"},"token_estimate":{"entry":150,"full":8000}} |
| context_limit | 900 |
| tags | ["security","threat-modeling","stride","architecture","risk"] |
| requires_tools | [] |
Produce a data flow diagram, a threat register, and a mitigation plan that becomes tickets and tests.
references/stride-workshop.md — step-by-step workshop agenda + DFD guidancereferences/common-threats-and-mitigations.md — threat catalog with mitigationsreferences/templates.md — copy/paste templates for docs and tickets