菜单
Use when using OWASP Threat Dragon to create data flow diagrams, identify threats using STRIDE and LINDDUN methodologies, and generate threat model reports for secure design review.
默认使用会先检查来源的 Prompt；你也可以切换为直接命令，或下载本地副本。
决定是否安装前，请先阅读 SKILL.md，以及 SkillsMP 当前展示的配套文件。
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
直接命令不会经过审查 Prompt；运行前请先检查来源。
npx skills add https://github.com/oyi77/1ai-skills --skill performing-threat-modeling-with-owasp-threat-dragon命令会保持在同一行。复制前请横向滚动并检查完整内容。
想先保存到本地？可下载 SkillsMP 当前能够提供的文件。
正在显示 SKILL.md
基于 SOC 职业分类
| name | performing-threat-modeling-with-owasp-threat-dragon |
| description | Use when using OWASP Threat Dragon to create data flow diagrams, identify threats using STRIDE and LINDDUN methodologies, and generate threat model reports for secure design review. |
| domain | cybersecurity |
| subdomain | devsecops |
| tags | ["threat-modeling","owasp","threat-dragon","stride","linddun","secure-design","dfd","data-flow"] |
| version | 1.0 |
| author | oyi77 |
| license | Apache-2.0 |
| nist_ai_rmf | ["MEASURE-2.7","MAP-5.1","MANAGE-2.4"] |
| atlas_techniques | ["AML.T0070","AML.T0066","AML.T0082"] |
| nist_csf | ["PR.PS-01","GV.SC-07","ID.IM-04","PR.PS-04"] |
OWASP Threat Dragon is an open-source threat modeling tool that enables security teams and developers to create threat model diagrams, identify threats using established methodologies (STRIDE, LINDDUN, CIA, DIE, PLOT4ai), and generate comprehensive reports. Threat Dragon runs as both a web application and desktop application (Windows, macOS, Linux), supporting distributed teams working collaboratively on threat models. Version 2.x provides drag-and-drop diagram creation, an auto-generation rule engine for threats and mitigations, and PDF report output for documentation and GRC compliance.
Trigger phrases:
"performing threat modeling with owasp threat dragon"
"Use OWASP Threat Dragon to create data flow diagrams, identify threats using STR"
When conducting security assessments that involve performing threat modeling with owasp threat dragon
When following incident response procedures for related security events
When performing scheduled security testing or auditing activities
When validating security controls through hands-on testing
This section covers threat modeling methodologies for performing threat modeling with owasp threat dragon.
| Category | Threat Type | Description | Example |
|---|---|---|---|
| S | Spoofing | Impersonating a user or system | Stolen session tokens |
| T | Tampering | Modifying data in transit or at rest | SQL injection altering records |
| R | Repudiation | Denying an action occurred | Missing audit logs |
| I | Information Disclosure |
| Exposing sensitive data |
| API returning excessive fields |
| D | Denial of Service | Making a service unavailable | Resource exhaustion attack |
| E | Elevation of Privilege | Gaining unauthorized access | Broken access control |
| Category | Threat Type | Description |
|---|---|---|
| L | Linkability | Associating data items across contexts |
| I | Identifiability | Identifying an individual from data |
| N | Non-repudiation | Inability to deny an action (privacy risk) |
| D | Detectability | Determining if data about a subject exists |
| D | Disclosure | Exposing personal information |
| U | Unawareness | User unaware of data collection |
| N | Non-compliance | Violating privacy regulations |
Desktop Application: Download the installer from the OWASP Threat Dragon releases page for Windows (.exe), macOS (.dmg), or Linux (.AppImage/.deb/.rpm).
Web Application (Docker):
docker run -p 3000:3000 \
-e ENCRYPTION_JWT_SIGNING_KEY=$(openssl rand -hex 32) \
-e ENCRYPTION_JWT_REFRESH_SIGNING_KEY=$(openssl rand -hex 32) \
-e ENCRYPTION_KEYS='[{"isPrimary":true,"id":0,"value":"'$(openssl rand -hex 16)'"}]' \
-e NODE_ENV=production \
owasp/threat-dragon:latest
Before creating diagrams, document the scope:
In Threat Dragon, create a new threat model and add diagrams using the following DFD elements:
Processes: Applications, microservices, API endpoints that transform data. Represented as circles/rounded rectangles.
Data Stores: Databases, file systems, caches, message queues that persist data. Represented as parallel lines.
External Entities: Users, external systems, third-party services outside the trust boundary. Represented as rectangles.
Data Flows: Communication channels between elements showing data direction. Represented as arrows with labels describing the data.
Trust Boundaries: Dashed lines separating zones of different trust levels (internet/DMZ/internal network, user/admin).
For each DFD element, apply the STRIDE methodology:
| Element Type | Applicable STRIDE Categories |
|---|---|
| External Entity | Spoofing, Repudiation |
| Process | Spoofing, Tampering, Repudiation, Information Disclosure, DoS, Elevation of Privilege |
| Data Store | Tampering, Information Disclosure, DoS |
| Data Flow | Tampering, Information Disclosure, DoS |
Threat Dragon's rule engine automatically suggests threats based on element types. Review each suggestion and mark as:
For each open threat, document:
Threat Dragon produces PDF reports containing:
Threat Dragon uses JSON format for threat models, enabling version control and programmatic manipulation:
{
"version": "2.2.0",
"summary": {
"title": "E-Commerce Application",
"owner": "Security Team",
"description": "Threat model for the checkout flow"
},
"detail": {
"contributors": [
{"name": "Security Architect"}
],
"diagrams": [
{
"id": 0,
"title": "Checkout Flow",
"diagramType": "STRIDE",
"cells": []
}
]
}
}
Threat Dragon participates in the CycloneDX Threat Model Bill of Materials (TMBOM) effort, enabling export to a common format that can be consumed by other threat modeling tools and GRC platforms, preventing vendor lock-in.
| Rationalization | Reality |
|---|---|
| "We are too small to be targeted" | Automated attacks target everyone. Size does not matter. |
| "Security slows us down" | A breach slows you down 100x more. Build security in from the start. |
| "We will fix it after launch" | Vulnerabilities in production are exploited within hours. Fix before deploy. |