home / Security / Threat Modeling Skill by @BagelHole

Threat Modeling Skill by @BagelHole

FREE

github stars★ 1,180updatedMar 2026repo@BagelHole

$git clone https://github.com/BagelHole/DevOps-Security-Agent-Skills

The skill is the security/operations/threat-modeling folder inside that repository. Copy it into the folder your agent loads skills from; check your agent's documentation for where that is.

about Threat Modeling Skill by @BagelHole

Conduct threat modeling using STRIDE methodology. Identify threats, assess risks, and design security controls.

our take

Threat modelling with the STRIDE method: identify threats, assess risks and design controls, with a worksheet template and a data flow diagram to start from.

when to use it

You are designing a new system and want threats found early
You review an existing application's security
You need a documented risk assessment

before you install

The value comes from the team discussion, not the template
Revisit the model when the architecture changes

what's inside

The original SKILL.md is organised into these sections:

When to Use This Skill
Prerequisites
STRIDE Methodology
STRIDE Worksheet Template
Data Flow Diagram
Text-Based DFD Notation
Threat Dragon Model (JSON)
Threat Library
Risk Scoring Matrix
Likelihood Rating
Impact Rating
Risk Matrix

source and license

Written and maintained by @BagelHole. It is published under the MIT license, which allows reuse with attribution. SkillDirectory does not claim authorship: this page adds our own review and links back to the original, and the skill's text belongs to its author.

View the full SKILL.md on GitHub ↗

Read the opening of the original SKILL.md

# Threat Modeling

Identify and mitigate security threats during system design.

## When to Use This Skill

Use this skill when:
- Designing a new system, service, or feature
- Making significant architectural changes to existing systems
- Onboarding a new third-party integration or dependency
- Preparing for security audits or compliance reviews
- Responding to a security incident to improve defenses
- Reviewing infrastructure changes that affect trust boundaries

## Prerequisites

- System architecture documentation or design diagrams
- Access to development and operations teams for context
- Understanding of the system's data classification (PII, PHI, financial, etc.)
- OWASP Threat Dragon or Microsoft Threat Modeling Tool (optional but helpful)
- Whiteboard or diagramming tool for collaborative sessions

## STRIDE Methodology

| Threat | Description | Property Violated | Mitigation Examples |
|--------|-------------|-------------------|---------------------|
…

Excerpt only, quoted from the author's repository. Open the repository for the complete file.

↓ download .zip