Execute qualquer Skill no Manus
com um clique

Execute qualquer Skill no Manus com um clique

Começar

threat-model

Estrelas4

Forks0

Atualizado1 de junho de 2026 às 05:35

Generate threat models using STRIDE methodology

Instalação

Instalar com Codex ou Claude Copie este prompt, cole no Codex, Claude ou outro assistente e deixe que ele revise a página da skill e instale para você.

Executar no Manus

Fonte

Lira-tron

Lira-tron/dotfiles

Abrir repositório GitHub Ver repositórios do creator

Download

Executar no Manus

Ocupações relacionadasSOC

Baseado na classificação ocupacional SOC

Analistas de segurança da informaçãoInformática e Matemática·SOC 15-1212

SKILL.md

readonly

name	threat-model
description	Generate threat models using STRIDE methodology

Threat Model

When asked to create a threat model, analyze threats, or prepare for a security review:

Process

Understand the system — Read the README, design docs, and service code to identify:
- Components and services involved
- Data flows (what data moves where, and how)
- Trust boundaries (internal vs external, service-to-service, user-facing)
- Data classification (public, internal, confidential, restricted)
- Cloud resources used (storage, databases, compute, API gateways)
Apply STRIDE — For each component and data flow, enumerate threats:
- Spoofing — Can an attacker impersonate a user or service?
- Tampering — Can data be modified in transit or at rest?
- Repudiation — Can actions be denied without audit trail?
- Information Disclosure — Can sensitive data leak?
- Denial of Service — Can the service be overwhelmed?
- Elevation of Privilege — Can an attacker gain unauthorized access?
Map to CWE / OWASP — Link each threat to the relevant standard reference:
- Spoofing → CWE-287 (Authentication), CWE-308 (MFA)
- Tampering → CWE-345 (Insufficient Verification), CWE-311 (Encryption at rest)
- Repudiation → CWE-778 (Insufficient Logging)
- Info Disclosure → CWE-311, CWE-319 (Cleartext transmission), CWE-532 (Sensitive data in logs)
- DoS → CWE-770 (Allocation without limits)
- EoP → CWE-269 (Improper privilege management), CWE-285 (Improper authorization)
Identify mitigations — For each threat, document existing controls and gaps.
Generate output — Produce a structured threat model document.

Output Format

# Threat Model: [Service Name]

## System Overview
- Components: ...
- Data Classification: ...
- Trust Boundaries: ...

## Data Flow Diagram
[Describe the data flows in text form, or include a Mermaid/PlantUML diagram]

## Threats

| ID | Component | STRIDE | Threat | Likelihood | Impact | Mitigation | Reference |
|----|-----------|--------|--------|------------|--------|------------|-----------|
| T1 | API GW    | S      | ...    | High       | High   | ...        | CWE-287   |

## Gaps and Recommendations
- ...

References

CWE: https://cwe.mitre.org/
OWASP Top 10: https://owasp.org/Top10/
OWASP ASVS: https://owasp.org/www-project-application-security-verification-standard/

Mais deste repositório

mesmo repositório

commit

Lira-tron/dotfiles

Analyze, group, and commit uncommitted changes as atomic conventional commits. Use this skill whenever the user says 'commit', 'commit this', 'commit these changes', 'commit my changes', 'smart commit', wants their diff split into logical commits, or asks to create a commit in any way. Always use this skill for committing — never run git commit directly.

2026-06-014

config-audit

Lira-tron/dotfiles

Audit Claude Code configuration for security: check permissions, hooks, MCP servers, and settings

2026-06-014

daily-notes

Lira-tron/dotfiles

Create or update today's daily note at `~/knowledge/notes/journal/YYYY/MM-MMM/YYYY-MM-DD-DayName.md`, appending or replacing a session entry under `## Agent Summary`. Use when the user asks to update the daily note, log a session, append to the journal, or when invoked by the session-history hook after a session summary is written.

2026-06-014

edit-dotfiles

Lira-tron/dotfiles

Edit config files inside the stow-based dotfiles repo and re-stow them with `make link`. Use this skill whenever the user asks to modify, add, or tweak any config under `$HOME` that lives in dotfiles — `.zshrc`, `.zshenv`, `.zprofile`, anything under `.config/`, `.local/`, `.claude/`, `.kiro/`, `.meshclaw/`, `.aws/`, `.unison/`, the `Makefile`, or any other tracked dotfile. Trigger even if the user phrases it as "change my config", "update my zshrc", "add this to claude settings", "tweak my tmux config", "modify my aliases", etc. — direct edits to `$HOME` are wrong because they bypass version control and get clobbered by the next `make link`.

2026-06-014

email-digest

Lira-tron/dotfiles

Summarize unread emails via Outlook MCP, group by priority, draft replies

2026-06-014

iam-audit

Lira-tron/dotfiles

Audit IAM policies in CDK/CloudFormation/Terraform for least-privilege violations

2026-06-014

Threat Model

When asked to create a threat model, analyze threats, or prepare for a security review:

Process

Understand the system — Read the README, design docs, and service code to identify:

Components and services involved
Data flows (what data moves where, and how)
Trust boundaries (internal vs external, service-to-service, user-facing)
Data classification (public, internal, confidential, restricted)
Cloud resources used (storage, databases, compute, API gateways)

Apply STRIDE — For each component and data flow, enumerate threats:

Spoofing — Can an attacker impersonate a user or service?
Tampering — Can data be modified in transit or at rest?
Repudiation — Can actions be denied without audit trail?
Information Disclosure — Can sensitive data leak?
Denial of Service — Can the service be overwhelmed?
Elevation of Privilege — Can an attacker gain unauthorized access?

Map to CWE / OWASP — Link each threat to the relevant standard reference:

Spoofing → CWE-287 (Authentication), CWE-308 (MFA)
Tampering → CWE-345 (Insufficient Verification), CWE-311 (Encryption at rest)
Repudiation → CWE-778 (Insufficient Logging)
Info Disclosure → CWE-311, CWE-319 (Cleartext transmission), CWE-532 (Sensitive data in logs)
DoS → CWE-770 (Allocation without limits)
EoP → CWE-269 (Improper privilege management), CWE-285 (Improper authorization)

Identify mitigations — For each threat, document existing controls and gaps.

Generate output — Produce a structured threat model document.

Output Format

# Threat Model: [Service Name] ## System Overview - Components: ... - Data Classification: ... - Trust Boundaries: ... ## Data Flow Diagram [Describe the data flows in text form, or include a Mermaid/PlantUML diagram] ## Threats | ID | Component | STRIDE | Threat | Likelihood | Impact | Mitigation | Reference | |----|-----------|--------|--------|------------|--------|------------|-----------| | T1 | API GW | S | ... | High | High | ... | CWE-287 | ## Gaps and Recommendations - ...

References