threat-modeling
星标7
分支5
更新时间2026年3月29日 09:25
Perform STRIDE threat modeling for new features, APIs, and architecture changes
安装
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
SKILL.md
readonly
下载
相关职业SOC
基于 SOC 职业分类
菜单
Perform STRIDE threat modeling for new features, APIs, and architecture changes
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
基于 SOC 职业分类
Run chaos security engineering tests — AI agent attempts to hack the Sprint output and reports findings to the team
Validate Java and TypeScript code against banking naming conventions, style rules, quality standards, and secure coding practices
Perform OWASP Top 10 security assessments, vulnerability scanning, and PCI-DSS compliance checks
Design test strategies including security testing, write test plans, and identify test scenarios for banking features with DevSecOps integration
Perform STRIDE threat modeling during Sprint Planning for new features and APIs
Run UX review checklist for banking user flows, validate WCAG accessibility compliance, assess security UX patterns, and review customer interface design
| name | threat-modeling |
| description | Perform STRIDE threat modeling for new features, APIs, and architecture changes |
Invoke when designing new features, APIs, or reviewing architecture changes that affect the threat surface.
# Threat Model: [Feature Name]
**Date:** [YYYY-MM-DD]
**Author:** [Security Champion / Team]
**Phase:** [Requirements / Design / Implementation]
## Feature Description
[Brief description of the feature being threat-modeled]
## Data Flow Diagram
[Describe: User → Frontend → API Gateway → Service → Database]
## STRIDE Analysis
| # | Threat | Category | Component | Likelihood | Impact | Risk | Mitigation |
|---|--------|----------|-----------|-----------|--------|------|------------|
| 1 | [desc] | Spoofing | [Component] | H/M/L | H/M/L | H/M/L | [control] |
| 2 | [desc] | Tampering | [Component] | H/M/L | H/M/L | H/M/L | [control] |
| 3 | [desc] | Repudiation | [Component] | H/M/L | H/M/L | H/M/L | [control] |
| 4 | [desc] | Info Disclosure | [Component] | H/M/L | H/M/L | H/M/L | [control] |
| 5 | [desc] | Denial of Service | [Component] | H/M/L | H/M/L | H/M/L | [control] |
| 6 | [desc] | Elevation of Privilege | [Component] | H/M/L | H/M/L | H/M/L | [control] |
## Trust Boundaries
- External → API Gateway (TLS termination, JWT validation)
- API Gateway → Internal Services (service mesh)
- Service → Database (encrypted connection, read-only app accounts)
## Residual Risks
| Risk | Justification for Acceptance | Review Date |
|------|------------------------------|-------------|
| [Risk] | [Why accepted] | [YYYY-MM-DD] |
## Action Items
| # | Action | Owner | Due | Status |
|---|--------|-------|-----|--------|
| 1 | [Action] | [Name] | [Date] | Open |
#[[file:docs/threat-models/threat-model-template.md]]