菜单
Detect changes in the threat model since the last baseline snapshot. Identifies new assets, changed flows, new threats, and control status changes. Use when comparing threat model versions, tracking security drift, monitoring for new risks, or validating changes after updates.
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
基于 SOC 职业分类
Show current threat model status including asset counts, threat distribution, control verification status, and compliance coverage. Use when checking threat model status, getting overview of security posture, or reviewing current state.
Map threats and controls to compliance frameworks like OWASP Top 10, SOC2, PCI-DSS, HIPAA, GDPR. Generates compliance reports with coverage percentages and gaps. Use when checking compliance status, mapping to security frameworks, or generating audit documentation.
Initialize a threat modeling project by analyzing architecture documentation. Creates threat model structure with asset inventory, data flows, trust boundaries, and attack surface mapping. Use when starting new threat modeling work, setting up threat model for a project, or creating initial security assessment.
Generate comprehensive prioritized risk reports with executive summaries, threat details, gap analysis, and recommendations. Use when creating security reports, generating executive summaries, documenting risk assessments, or preparing audit documentation.
Analyze threats against discovered assets using STRIDE or PASTA framework. Generates threat catalog, attack trees, abuse cases, and risk register. Use when analyzing threats, identifying attack vectors, assessing security risks, or expanding threat catalog.
Verify that security controls documented in the threat model actually exist in the codebase. Searches for control implementations, validates configurations, identifies gaps. Use when validating threat model against code, checking security control implementation, or finding security gaps.
| name | tm-drift |
| description | Detect changes in the threat model since the last baseline snapshot. Identifies new assets, changed flows, new threats, and control status changes. Use when comparing threat model versions, tracking security drift, monitoring for new risks, or validating changes after updates. |
| allowed-tools | Read, Write, Glob |
Compare current threat model state against a baseline to:
/tm-drift [--baseline <path>] [--create-baseline] [--watch]
Arguments:
--baseline: Specific baseline file to compare against--create-baseline: Create new baseline after comparison--watch: Continuous monitoring mode (future feature)Baselines are snapshots of the complete threat model state:
{
"version": "1.0",
"created": "ISO-8601",
"project": "Project Name",
"snapshot": {
"assets": [...],
"dataflows": [...],
"trust_boundaries": [...],
"attack_surface": [...],
"threats": [...],
"controls": [...],
"gaps": [...]
},
"metadata": {
"commit": "git-commit-hash",
"author": "name",
"reason": "baseline reason"
}
}
# Threat Model Drift Report
**Baseline**: 2025-01-15 (snapshot-20250115.json)
**Current**: 2025-01-20
**Period**: 5 days
---
## Summary
| Category | Added | Removed | Modified |
|----------|-------|---------|----------|
| Assets | 2 | 0 | 1 |
| Data Flows | 3 | 1 | 0 |
| Attack Surface | 2 | 0 | 1 |
| Trust Boundaries | 0 | 0 | 0 |
| Controls | 1 | 0 | 2 |
**Risk Impact**: New assets and attack surfaces require threat analysis.
---
## Asset Changes
### Added Assets
#### asset-015: Redis Cache
- **Type**: data-store
- **Classification**: internal
- **Added in**: commit abc123
- **Risk**: Cache poisoning, data exposure
#### asset-016: Email Service Integration
- **Type**: integration
- **Classification**: confidential
- **Added in**: commit def456
- **Risk**: Email injection, SSRF
### Modified Assets
#### asset-005: User Database
- **Change**: Classification upgraded from internal to restricted
- **Reason**: Now stores payment data
- **Impact**: Additional controls required
---
## Attack Surface Changes
### Added Entry Points
#### as-010: Cache Invalidation API
- **Asset**: asset-015
- **Exposure**: internal
- **Authentication**: none ⚠️
- **Risk**: Unauthenticated cache manipulation
#### as-011: Email Webhook Receiver
- **Asset**: asset-016
- **Exposure**: public
- **Authentication**: signature validation
- **Risk**: Webhook forgery
### Modified Entry Points
#### as-003: Admin API
- **Change**: New endpoints added
- **Endpoints**: /api/admin/cache, /api/admin/email
- **Risk**: Expanded attack surface
---
## Control Status Changes
### Degraded Controls
#### control-005: Input Validation
- **Previous**: implemented
- **Current**: partial
- **Reason**: New endpoints missing validation
- **Files Changed**: src/routes/admin.ts
### Improved Controls
#### control-012: Rate Limiting
- **Previous**: missing
- **Current**: implemented
- **Evidence**: src/middleware/rateLimiter.ts
---
## New Potential Threats
Based on changes, the following new threats should be analyzed:
1. **Cache Poisoning** (asset-015)
- Unauthenticated cache invalidation
- Data corruption via cache
2. **Email Header Injection** (asset-016)
- Malicious email content
- SSRF via email service
3. **Admin API Abuse** (as-003)
- New endpoints may lack authorization
---
## Recommendations
1. **Immediate**: Add authentication to cache invalidation endpoint
2. **Immediate**: Run /tm-threats --focus asset-015,asset-016
3. **Short-term**: Review admin API authorization
4. **Short-term**: Update threat model with new components
---
## Baseline Created
New baseline: `.threatmodel/baseline/snapshot-20250120.json`
When executing this skill:
Load current state:
.threatmodel/state/Load baseline:
--baseline specified, use that file.threatmodel/baseline/Compare each category:
Identify changes:
Assess risk impact:
Generate recommendations:
Create baseline if requested:
Report summary:
Drift Detection Complete
========================
Compared against: baseline/snapshot-20250115.json (5 days ago)
Changes Detected:
+ 2 new assets
+ 3 new data flows
+ 2 new attack surface entries
~ 2 controls changed status
Risk Impact: MEDIUM
- New unauthenticated endpoint detected
- Control degradation in admin routes
New Potential Threats: 3
- Cache poisoning
- Email header injection
- Admin API abuse
Recommendations:
1. Run /tm-threats --focus asset-015,asset-016
2. Review authentication on as-010
3. Update input validation for admin routes
Files Created:
.threatmodel/reports/drift-report.md
.threatmodel/baseline/snapshot-20250120.json (new baseline)
Next Steps:
Address identified changes
Re-run /tm-verify after fixes