[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M70KDH4TDBPBSTM7MAGN092J":3,"skill-same:01M70KDH4TDBPBSTM7MAGN092J":59},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":18,"publishedAt":30,"linkOnly":31,"markdownContent":32,"markdownBody":33,"frontMatter":34,"refName":35,"commitSha":36,"skillDirectory":37,"forksCount":38,"repositoryHtmlUrl":39,"repositoryHomepageUrl":40,"ownerHtmlUrl":41,"ownerBlogUrl":42,"ownerDescription":43,"updatedAt":44,"install":45,"resources":58},"01M70KDH4TDBPBSTM7MAGN092J","threat-mitigation-mapping",null,"Map identified threats to appropriate security controls and mitigations. Use when prioritizing security investments, creating remediation plans, or validating control effectiveness.","shengdabai\u002FTony-Claude-Code-Skills","shengdabai","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F116417419?v=4","01M70F6D2WY5PQV5A92BKYJQEW","Tony Sheng","01M70F6D3GAAAYZ5H4CC1G8VXM",3,"MIT","https:\u002F\u002Fgithub.com\u002Fshengdabai\u002FTony-Claude-Code-Skills\u002Fblob\u002Fmain\u002Fskills\u002F_collections\u002Fwshobson-agents\u002Fplugins\u002Fsecurity-scanning\u002Fskills\u002Fthreat-mitigation-mapping\u002FSKILL.md",[],[19,20,21,22,23,24,25,26,27,28,29],"mapping","threat mitigation mapping","threat","plans","map","controls","use","when","control","remediation","security","2026-11-10 10:12:30",false,"---\nname: threat-mitigation-mapping\ndescription: Map identified threats to appropriate security controls and mitigations. Use when prioritizing security investments, creating remediation plans, or validating control effectiveness.\n---\n\n# Threat Mitigation Mapping\n\nConnect threats to controls for effective security planning.\n\n## When to Use This Skill\n\n- Prioritizing security investments\n- Creating remediation roadmaps\n- Validating control coverage\n- Designing defense-in-depth\n- Security architecture review\n- Risk treatment planning\n\n## Core Concepts\n\n### 1. Control Categories\n\n```\nPreventive ────► Stop attacks before they occur\n   │              (Firewall, Input validation)\n   │\nDetective ─────► Identify attacks in progress\n   │              (IDS, Log monitoring)\n   │\nCorrective ────► Respond and recover from attacks\n                  (Incident response, Backup restore)\n```\n\n### 2. Control Layers\n\n| Layer | Examples |\n|-------|----------|\n| **Network** | Firewall, WAF, DDoS protection |\n| **Application** | Input validation, authentication |\n| **Data** | Encryption, access controls |\n| **Endpoint** | EDR, patch management |\n| **Process** | Security training, incident response |\n\n### 3. Defense in Depth\n\n```\n                    ┌──────────────────────┐\n                    │      Perimeter       │ ← Firewall, WAF\n                    │   ┌──────────────┐   │\n                    │   │   Network    │   │ ← Segmentation, IDS\n                    │   │  ┌────────┐  │   │\n                    │   │  │  Host  │  │   │ ← EDR, Hardening\n                    │   │  │ ┌────┐ │  │   │\n                    │   │  │ │App │ │  │   │ ← Auth, Validation\n                    │   │  │ │Data│ │  │   │ ← Encryption\n                    │   │  │ └────┘ │  │   │\n                    │   │  └────────┘  │   │\n                    │   └──────────────┘   │\n                    └──────────────────────┘\n```\n\n## Templates\n\n### Template 1: Mitigation Model\n\n```python\nfrom dataclasses import dataclass, field\nfrom enum import Enum\nfrom typing import List, Dict, Optional, Set\nfrom datetime import datetime\n\nclass ControlType(Enum):\n    PREVENTIVE = \"preventive\"\n    DETECTIVE = \"detective\"\n    CORRECTIVE = \"corrective\"\n\n\nclass ControlLayer(Enum):\n    NETWORK = \"network\"\n    APPLICATION = \"application\"\n    DATA = \"data\"\n    ENDPOINT = \"endpoint\"\n    PROCESS = \"process\"\n    PHYSICAL = \"physical\"\n\n\nclass ImplementationStatus(Enum):\n    NOT_IMPLEMENTED = \"not_implemented\"\n    PARTIAL = \"partial\"\n    IMPLEMENTED = \"implemented\"\n    VERIFIED = \"verified\"\n\n\nclass Effectiveness(Enum):\n    NONE = 0\n    LOW = 1\n    MEDIUM = 2\n    HIGH = 3\n    VERY_HIGH = 4\n\n\n@dataclass\nclass SecurityControl:\n    id: str\n    name: str\n    description: str\n    control_type: ControlType\n    layer: ControlLayer\n    effectiveness: Effectiveness\n    implementation_cost: str  # Low, Medium, High\n    maintenance_cost: str\n    status: ImplementationStatus = ImplementationStatus.NOT_IMPLEMENTED\n    mitigates_threats: List[str] = field(default_factory=list)\n    dependencies: List[str] = field(default_factory=list)\n    technologies: List[str] = field(default_factory=list)\n    compliance_refs: List[str] = field(default_factory=list)\n\n    def coverage_score(self) -> float:\n        \"\"\"Calculate coverage score based on status and effectiveness.\"\"\"\n        status_multiplier = {\n            ImplementationStatus.NOT_IMPLEMENTED: 0.0,\n            ImplementationStatus.PARTIAL: 0.5,\n            ImplementationStatus.IMPLEMENTED: 0.8,\n            ImplementationStatus.VERIFIED: 1.0,\n        }\n        return self.effectiveness.value * status_multiplier[self.status]\n\n\n@dataclass\nclass Threat:\n    id: str\n    name: str\n    category: str  # STRIDE category\n    description: str\n    impact: str  # Critical, High, Medium, Low\n    likelihood: str\n    risk_score: float\n\n\n@dataclass\nclass MitigationMapping:\n    threat: Threat\n    controls: List[SecurityControl]\n    residual_risk: str = \"Unknown\"\n    notes: str = \"\"\n\n    def calculate_coverage(self) -> float:\n        \"\"\"Calculate how well controls cover the threat.\"\"\"\n        if not self.controls:\n            return 0.0\n\n        total_score = sum(c.coverage_score() for c in self.controls)\n        max_possible = len(self.controls) * Effectiveness.VERY_HIGH.value\n\n        return (total_score \u002F max_possible) * 100 if max_possible > 0 else 0\n\n    def has_defense_in_depth(self) -> bool:\n        \"\"\"Check if multiple layers are covered.\"\"\"\n        layers = set(c.layer for c in self.controls if c.status != ImplementationStatus.NOT_IMPLEMENTED)\n        return len(layers) >= 2\n\n    def has_control_diversity(self) -> bool:\n        \"\"\"Check if multiple control types are present.\"\"\"\n        types = set(c.control_type for c in self.controls if c.status != ImplementationStatus.NOT_IMPLEMENTED)\n        return len(types) >= 2\n\n\n@dataclass\nclass MitigationPlan:\n    name: str\n    threats: List[Threat] = field(default_factory=list)\n    controls: List[SecurityControl] = field(default_factory=list)\n    mappings: List[MitigationMapping] = field(default_factory=list)\n\n    def get_unmapped_threats(self) -> List[Threat]:\n        \"\"\"Find threats without mitigations.\"\"\"\n        mapped_ids = {m.threat.id for m in self.mappings}\n        return [t for t in self.threats if t.id not in mapped_ids]\n\n    def get_control_coverage(self) -> Dict[str, float]:\n        \"\"\"Get coverage percentage for each threat.\"\"\"\n        return {\n            m.threat.id: m.calculate_coverage()\n            for m in self.mappings\n        }\n\n    def get_gaps(self) -> List[Dict]:\n        \"\"\"Identify mitigation gaps.\"\"\"\n        gaps = []\n        for mapping in self.mappings:\n            coverage = mapping.calculate_coverage()\n            if coverage \u003C 50:\n                gaps.append({\n                    \"threat\": mapping.threat.id,\n                    \"threat_name\": mapping.threat.name,\n                    \"coverage\": coverage,\n                    \"issue\": \"Insufficient control coverage\",\n                    \"recommendation\": \"Add more controls or improve existing ones\"\n                })\n            if not mapping.has_defense_in_depth():\n                gaps.append({\n                    \"threat\": mapping.threat.id,\n                    \"threat_name\": mapping.threat.name,\n                    \"coverage\": coverage,\n                    \"issue\": \"No defense in depth\",\n                    \"recommendation\": \"Add controls at different layers\"\n                })\n            if not mapping.has_control_diversity():\n                gaps.append({\n                    \"threat\": mapping.threat.id,\n                    \"threat_name\": mapping.threat.name,\n                    \"coverage\": coverage,\n                    \"issue\": \"No control diversity\",\n                    \"recommendation\": \"Add detective\u002Fcorrective controls\"\n                })\n        return gaps\n```\n\n### Template 2: Control Library\n\n```python\nclass ControlLibrary:\n    \"\"\"Library of standard security controls.\"\"\"\n\n    STANDARD_CONTROLS = {\n        # Authentication Controls\n        \"AUTH-001\": SecurityControl(\n            id=\"AUTH-001\",\n            name=\"Multi-Factor Authentication\",\n            description=\"Require MFA for all user authentication\",\n            control_type=ControlType.PREVENTIVE,\n            layer=ControlLayer.APPLICATION,\n            effectiveness=Effectiveness.HIGH,\n            implementation_cost=\"Medium\",\n            maintenance_cost=\"Low\",\n            mitigates_threats=[\"SPOOFING\"],\n            technologies=[\"TOTP\", \"WebAuthn\", \"SMS OTP\"],\n            compliance_refs=[\"PCI-DSS 8.3\", \"NIST 800-63B\"]\n        ),\n        \"AUTH-002\": SecurityControl(\n            id=\"AUTH-002\",\n            name=\"Account Lockout Policy\",\n            description=\"Lock accounts after failed authentication attempts\",\n            control_type=ControlType.PREVENTIVE,\n            layer=ControlLayer.APPLICATION,\n            effectiveness=Effectiveness.MEDIUM,\n            implementation_cost=\"Low\",\n            maintenance_cost=\"Low\",\n            mitigates_threats=[\"SPOOFING\"],\n            technologies=[\"Custom implementation\"],\n            compliance_refs=[\"PCI-DSS 8.1.6\"]\n        ),\n\n        # Input Validation Controls\n        \"VAL-001\": SecurityControl(\n            id=\"VAL-001\",\n            name=\"Input Validation Framework\",\n            description=\"Validate and sanitize all user input\",\n            control_type=ControlType.PREVENTIVE,\n            layer=ControlLayer.APPLICATION,\n            effectiveness=Effectiveness.HIGH,\n            implementation_cost=\"Medium\",\n            maintenance_cost=\"Medium\",\n            mitigates_threats=[\"TAMPERING\", \"INJECTION\"],\n            technologies=[\"Joi\", \"Yup\", \"Pydantic\"],\n            compliance_refs=[\"OWASP ASVS V5\"]\n        ),\n        \"VAL-002\": SecurityControl(\n            id=\"VAL-002\",\n            name=\"Web Application Firewall\",\n            description=\"Deploy WAF to filter malicious requests\",\n            control_type=ControlType.PREVENTIVE,\n            layer=ControlLayer.NETWORK,\n            effectiveness=Effectiveness.MEDIUM,\n            implementation_cost=\"Medium\",\n            maintenance_cost=\"Medium\",\n            mitigates_threats=[\"TAMPERING\", \"INJECTION\", \"DOS\"],\n            technologies=[\"AWS WAF\", \"Cloudflare\", \"ModSecurity\"],\n            compliance_refs=[\"PCI-DSS 6.6\"]\n        ),\n\n        # Encryption Controls\n        \"ENC-001\": SecurityControl(\n            id=\"ENC-001\",\n            name=\"Data Encryption at Rest\",\n            description=\"Encrypt sensitive data in storage\",\n            control_type=ControlType.PREVENTIVE,\n            layer=ControlLayer.DATA,\n            effectiveness=Effectiveness.HIGH,\n            implementation_cost=\"Medium\",\n            maintenance_cost=\"Low\",\n            mitigates_threats=[\"INFORMATION_DISCLOSURE\"],\n            technologies=[\"AES-256\", \"KMS\", \"HSM\"],\n            compliance_refs=[\"PCI-DSS 3.4\", \"GDPR Art. 32\"]\n        ),\n        \"ENC-002\": SecurityControl(\n            id=\"ENC-002\",\n            name=\"TLS Encryption\",\n            description=\"Encrypt data in transit using TLS 1.3\",\n            control_type=ControlType.PREVENTIVE,\n            layer=ControlLayer.NETWORK,\n            effectiveness=Effectiveness.HIGH,\n            implementation_cost=\"Low\",\n            maintenance_cost=\"Low\",\n            mitigates_threats=[\"INFORMATION_DISCLOSURE\", \"TAMPERING\"],\n            technologies=[\"TLS 1.3\", \"Certificate management\"],\n            compliance_refs=[\"PCI-DSS 4.1\", \"HIPAA\"]\n        ),\n\n        # Logging Controls\n        \"LOG-001\": SecurityControl(\n            id=\"LOG-001\",\n            name=\"Security Event Logging\",\n            description=\"Log all security-relevant events\",\n            control_type=ControlType.DETECTIVE,\n            layer=ControlLayer.APPLICATION,\n            effectiveness=Effectiveness.MEDIUM,\n            implementation_cost=\"Low\",\n            maintenance_cost=\"Medium\",\n            mitigates_threats=[\"REPUDIATION\"],\n            technologies=[\"ELK Stack\", \"Splunk\", \"CloudWatch\"],\n            compliance_refs=[\"PCI-DSS 10.2\", \"SOC2\"]\n        ),\n        \"LOG-002\": SecurityControl(\n            id=\"LOG-002\",\n            name=\"Log Integrity Protection\",\n            description=\"Protect logs from tampering\",\n            control_type=ControlType.PREVENTIVE,\n            layer=ControlLayer.DATA,\n            effectiveness=Effectiveness.MEDIUM,\n            implementation_cost=\"Medium\",\n            maintenance_cost=\"Low\",\n            mitigates_threats=[\"REPUDIATION\", \"TAMPERING\"],\n            technologies=[\"Immutable storage\", \"Log signing\"],\n            compliance_refs=[\"PCI-DSS 10.5\"]\n        ),\n\n        # Access Control\n        \"ACC-001\": SecurityControl(\n            id=\"ACC-001\",\n            name=\"Role-Based Access Control\",\n            description=\"Implement RBAC for authorization\",\n            control_type=ControlType.PREVENTIVE,\n            layer=ControlLayer.APPLICATION,\n            effectiveness=Effectiveness.HIGH,\n            implementation_cost=\"Medium\",\n            maintenance_cost=\"Medium\",\n            mitigates_threats=[\"ELEVATION_OF_PRIVILEGE\", \"INFORMATION_DISCLOSURE\"],\n            technologies=[\"RBAC\", \"ABAC\", \"Policy engines\"],\n            compliance_refs=[\"PCI-DSS 7.1\", \"SOC2\"]\n        ),\n\n        # Availability Controls\n        \"AVL-001\": SecurityControl(\n            id=\"AVL-001\",\n            name=\"Rate Limiting\",\n            description=\"Limit request rates to prevent abuse\",\n            control_type=ControlType.PREVENTIVE,\n            layer=ControlLayer.APPLICATION,\n            effectiveness=Effectiveness.MEDIUM,\n            implementation_cost=\"Low\",\n            maintenance_cost=\"Low\",\n            mitigates_threats=[\"DENIAL_OF_SERVICE\"],\n            technologies=[\"API Gateway\", \"Redis\", \"Token bucket\"],\n            compliance_refs=[\"OWASP API Security\"]\n        ),\n        \"AVL-002\": SecurityControl(\n            id=\"AVL-002\",\n            name=\"DDoS Protection\",\n            description=\"Deploy DDoS mitigation services\",\n            control_type=ControlType.PREVENTIVE,\n            layer=ControlLayer.NETWORK,\n            effectiveness=Effectiveness.HIGH,\n            implementation_cost=\"High\",\n            maintenance_cost=\"Medium\",\n            mitigates_threats=[\"DENIAL_OF_SERVICE\"],\n            technologies=[\"Cloudflare\", \"AWS Shield\", \"Akamai\"],\n            compliance_refs=[\"NIST CSF\"]\n        ),\n    }\n\n    def get_controls_for_threat(self, threat_category: str) -> List[SecurityControl]:\n        \"\"\"Get all controls that mitigate a threat category.\"\"\"\n        return [\n            c for c in self.STANDARD_CONTROLS.values()\n            if threat_category in c.mitigates_threats\n        ]\n\n    def get_controls_by_layer(self, layer: ControlLayer) -> List[SecurityControl]:\n        \"\"\"Get controls for a specific layer.\"\"\"\n        return [c for c in self.STANDARD_CONTROLS.values() if c.layer == layer]\n\n    def get_control(self, control_id: str) -> Optional[SecurityControl]:\n        \"\"\"Get a specific control by ID.\"\"\"\n        return self.STANDARD_CONTROLS.get(control_id)\n\n    def recommend_controls(\n        self,\n        threat: Threat,\n        existing_controls: List[str]\n    ) -> List[SecurityControl]:\n        \"\"\"Recommend additional controls for a threat.\"\"\"\n        available = self.get_controls_for_threat(threat.category)\n        return [c for c in available if c.id not in existing_controls]\n```\n\n### Template 3: Mitigation Analysis\n\n```python\nclass MitigationAnalyzer:\n    \"\"\"Analyze and optimize mitigation strategies.\"\"\"\n\n    def __init__(self, plan: MitigationPlan, library: ControlLibrary):\n        self.plan = plan\n        self.library = library\n\n    def calculate_overall_risk_reduction(self) -> float:\n        \"\"\"Calculate overall risk reduction percentage.\"\"\"\n        if not self.plan.mappings:\n            return 0.0\n\n        weighted_coverage = 0\n        total_weight = 0\n\n        for mapping in self.plan.mappings:\n            # Weight by threat risk score\n            weight = mapping.threat.risk_score\n            coverage = mapping.calculate_coverage()\n            weighted_coverage += weight * coverage\n            total_weight += weight\n\n        return weighted_coverage \u002F total_weight if total_weight > 0 else 0\n\n    def get_critical_gaps(self) -> List[Dict]:\n        \"\"\"Find critical gaps that need immediate attention.\"\"\"\n        gaps = self.plan.get_gaps()\n        critical_threats = {t.id for t in self.plan.threats if t.impact == \"Critical\"}\n\n        return [g for g in gaps if g[\"threat\"] in critical_threats]\n\n    def optimize_budget(\n        self,\n        budget: float,\n        cost_map: Dict[str, float]\n    ) -> List[SecurityControl]:\n        \"\"\"Select controls that maximize risk reduction within budget.\"\"\"\n        # Simple greedy approach - can be replaced with optimization algorithm\n        recommended = []\n        remaining_budget = budget\n        unmapped = self.plan.get_unmapped_threats()\n\n        # Sort controls by effectiveness\u002Fcost ratio\n        all_controls = list(self.library.STANDARD_CONTROLS.values())\n        controls_with_value = []\n\n        for control in all_controls:\n            if control.status == ImplementationStatus.NOT_IMPLEMENTED:\n                cost = cost_map.get(control.id, float('inf'))\n                if cost \u003C= remaining_budget:\n                    # Calculate value as threats covered * effectiveness \u002F cost\n                    threats_covered = len([\n                        t for t in unmapped\n                        if t.category in control.mitigates_threats\n                    ])\n                    if threats_covered > 0:\n                        value = (threats_covered * control.effectiveness.value) \u002F cost\n                        controls_with_value.append((control, value, cost))\n\n        # Sort by value (higher is better)\n        controls_with_value.sort(key=lambda x: x[1], reverse=True)\n\n        for control, value, cost in controls_with_value:\n            if cost \u003C= remaining_budget:\n                recommended.append(control)\n                remaining_budget -= cost\n\n        return recommended\n\n    def generate_roadmap(self) -> List[Dict]:\n        \"\"\"Generate implementation roadmap by priority.\"\"\"\n        roadmap = []\n        gaps = self.plan.get_gaps()\n\n        # Phase 1: Critical threats with low coverage\n        phase1 = []\n        for gap in gaps:\n            mapping = next(\n                (m for m in self.plan.mappings if m.threat.id == gap[\"threat\"]),\n                None\n            )\n            if mapping and mapping.threat.impact == \"Critical\":\n                controls = self.library.get_controls_for_threat(mapping.threat.category)\n                phase1.extend([\n                    {\n                        \"threat\": gap[\"threat\"],\n                        \"control\": c.id,\n                        \"control_name\": c.name,\n                        \"phase\": 1,\n                        \"priority\": \"Critical\"\n                    }\n                    for c in controls\n                    if c.status == ImplementationStatus.NOT_IMPLEMENTED\n                ])\n\n        roadmap.extend(phase1[:5])  # Top 5 for phase 1\n\n        # Phase 2: High impact threats\n        phase2 = []\n        for gap in gaps:\n            mapping = next(\n                (m for m in self.plan.mappings if m.threat.id == gap[\"threat\"]),\n                None\n            )\n            if mapping and mapping.threat.impact == \"High\":\n                controls = self.library.get_controls_for_threat(mapping.threat.category)\n                phase2.extend([\n                    {\n                        \"threat\": gap[\"threat\"],\n                        \"control\": c.id,\n                        \"control_name\": c.name,\n                        \"phase\": 2,\n                        \"priority\": \"High\"\n                    }\n                    for c in controls\n                    if c.status == ImplementationStatus.NOT_IMPLEMENTED\n                ])\n\n        roadmap.extend(phase2[:5])  # Top 5 for phase 2\n\n        return roadmap\n\n    def defense_in_depth_analysis(self) -> Dict[str, List[str]]:\n        \"\"\"Analyze defense in depth coverage.\"\"\"\n        layer_coverage = {layer.value: [] for layer in ControlLayer}\n\n        for mapping in self.plan.mappings:\n            for control in mapping.controls:\n                if control.status in [ImplementationStatus.IMPLEMENTED, ImplementationStatus.VERIFIED]:\n                    layer_coverage[control.layer.value].append(control.id)\n\n        return layer_coverage\n\n    def generate_report(self) -> str:\n        \"\"\"Generate comprehensive mitigation report.\"\"\"\n        risk_reduction = self.calculate_overall_risk_reduction()\n        gaps = self.plan.get_gaps()\n        critical_gaps = self.get_critical_gaps()\n        layer_coverage = self.defense_in_depth_analysis()\n\n        report = f\"\"\"\n# Threat Mitigation Report\n\n## Executive Summary\n- **Overall Risk Reduction:** {risk_reduction:.1f}%\n- **Total Threats:** {len(self.plan.threats)}\n- **Total Controls:** {len(self.plan.controls)}\n- **Identified Gaps:** {len(gaps)}\n- **Critical Gaps:** {len(critical_gaps)}\n\n## Defense in Depth Coverage\n{self._format_layer_coverage(layer_coverage)}\n\n## Critical Gaps Requiring Immediate Action\n{self._format_gaps(critical_gaps)}\n\n## Recommendations\n{self._format_recommendations()}\n\n## Implementation Roadmap\n{self._format_roadmap()}\n\"\"\"\n        return report\n\n    def _format_layer_coverage(self, coverage: Dict[str, List[str]]) -> str:\n        lines = []\n        for layer, controls in coverage.items():\n            status = \"✓\" if controls else \"✗\"\n            lines.append(f\"- {layer}: {status} ({len(controls)} controls)\")\n        return \"\\n\".join(lines)\n\n    def _format_gaps(self, gaps: List[Dict]) -> str:\n        if not gaps:\n            return \"No critical gaps identified.\"\n        lines = []\n        for gap in gaps:\n            lines.append(f\"- **{gap['threat_name']}**: {gap['issue']}\")\n            lines.append(f\"  - Coverage: {gap['coverage']:.1f}%\")\n            lines.append(f\"  - Recommendation: {gap['recommendation']}\")\n        return \"\\n\".join(lines)\n\n    def _format_recommendations(self) -> str:\n        recommendations = []\n        layer_coverage = self.defense_in_depth_analysis()\n\n        for layer, controls in layer_coverage.items():\n            if not controls:\n                recommendations.append(f\"- Add {layer} layer controls\")\n\n        gaps = self.plan.get_gaps()\n        if any(g[\"issue\"] == \"No control diversity\" for g in gaps):\n            recommendations.append(\"- Add more detective and corrective controls\")\n\n        return \"\\n\".join(recommendations) if recommendations else \"Current coverage is adequate.\"\n\n    def _format_roadmap(self) -> str:\n        roadmap = self.generate_roadmap()\n        if not roadmap:\n            return \"No additional controls recommended at this time.\"\n\n        lines = []\n        current_phase = 0\n        for item in roadmap:\n            if item[\"phase\"] != current_phase:\n                current_phase = item[\"phase\"]\n                lines.append(f\"\\n### Phase {current_phase}\")\n            lines.append(f\"- [{item['priority']}] {item['control_name']} (for {item['threat']})\")\n\n        return \"\\n\".join(lines)\n```\n\n### Template 4: Control Effectiveness Testing\n\n```python\nfrom dataclasses import dataclass\nfrom typing import List, Callable, Any\nimport asyncio\n\n@dataclass\nclass ControlTest:\n    control_id: str\n    test_name: str\n    test_function: Callable[[], bool]\n    expected_result: bool\n    description: str\n\n\nclass ControlTester:\n    \"\"\"Test control effectiveness.\"\"\"\n\n    def __init__(self):\n        self.tests: List[ControlTest] = []\n        self.results: List[Dict] = []\n\n    def add_test(self, test: ControlTest) -> None:\n        self.tests.append(test)\n\n    async def run_tests(self) -> List[Dict]:\n        \"\"\"Run all control tests.\"\"\"\n        self.results = []\n\n        for test in self.tests:\n            try:\n                result = test.test_function()\n                passed = result == test.expected_result\n                self.results.append({\n                    \"control_id\": test.control_id,\n                    \"test_name\": test.test_name,\n                    \"passed\": passed,\n                    \"actual_result\": result,\n                    \"expected_result\": test.expected_result,\n                    \"description\": test.description,\n                    \"error\": None\n                })\n            except Exception as e:\n                self.results.append({\n                    \"control_id\": test.control_id,\n                    \"test_name\": test.test_name,\n                    \"passed\": False,\n                    \"actual_result\": None,\n                    \"expected_result\": test.expected_result,\n                    \"description\": test.description,\n                    \"error\": str(e)\n                })\n\n        return self.results\n\n    def get_effectiveness_score(self, control_id: str) -> float:\n        \"\"\"Calculate effectiveness score for a control.\"\"\"\n        control_results = [r for r in self.results if r[\"control_id\"] == control_id]\n        if not control_results:\n            return 0.0\n\n        passed = sum(1 for r in control_results if r[\"passed\"])\n        return (passed \u002F len(control_results)) * 100\n\n    def generate_test_report(self) -> str:\n        \"\"\"Generate test results report.\"\"\"\n        if not self.results:\n            return \"No tests have been run.\"\n\n        total = len(self.results)\n        passed = sum(1 for r in self.results if r[\"passed\"])\n\n        report = f\"\"\"\n# Control Effectiveness Test Report\n\n## Summary\n- **Total Tests:** {total}\n- **Passed:** {passed}\n- **Failed:** {total - passed}\n- **Pass Rate:** {(passed\u002Ftotal)*100:.1f}%\n\n## Results by Control\n\"\"\"\n        # Group by control\n        controls = {}\n        for result in self.results:\n            cid = result[\"control_id\"]\n            if cid not in controls:\n                controls[cid] = []\n            controls[cid].append(result)\n\n        for control_id, results in controls.items():\n            score = self.get_effectiveness_score(control_id)\n            report += f\"\\n### {control_id} (Effectiveness: {score:.1f}%)\\n\"\n            for r in results:\n                status = \"✓\" if r[\"passed\"] else \"✗\"\n                report += f\"- {status} {r['test_name']}\\n\"\n                if r[\"error\"]:\n                    report += f\"  - Error: {r['error']}\\n\"\n\n        return report\n```\n\n## Best Practices\n\n### Do's\n- **Map all threats** - No threat should be unmapped\n- **Layer controls** - Defense in depth is essential\n- **Mix control types** - Preventive, detective, corrective\n- **Track effectiveness** - Measure and improve\n- **Review regularly** - Controls degrade over time\n\n### Don'ts\n- **Don't rely on single controls** - Single points of failure\n- **Don't ignore cost** - ROI matters\n- **Don't skip testing** - Untested controls may fail\n- **Don't set and forget** - Continuous improvement\n- **Don't ignore people\u002Fprocess** - Technology alone isn't enough\n\n## Resources\n\n- [NIST Cybersecurity Framework](https:\u002F\u002Fwww.nist.gov\u002Fcyberframework)\n- [CIS Controls](https:\u002F\u002Fwww.cisecurity.org\u002Fcontrols)\n- [MITRE D3FEND](https:\u002F\u002Fd3fend.mitre.org\u002F)\n","# Threat Mitigation Mapping\n\nConnect threats to controls for effective security planning.\n\n## When to Use This Skill\n\n- Prioritizing security investments\n- Creating remediation roadmaps\n- Validating control coverage\n- Designing defense-in-depth\n- Security architecture review\n- Risk treatment planning\n\n## Core Concepts\n\n### 1. Control Categories\n\n```\nPreventive ────► Stop attacks before they occur\n   │              (Firewall, Input validation)\n   │\nDetective ─────► Identify attacks in progress\n   │              (IDS, Log monitoring)\n   │\nCorrective ────► Respond and recover from attacks\n                  (Incident response, Backup restore)\n```\n\n### 2. Control Layers\n\n| Layer | Examples |\n|-------|----------|\n| **Network** | Firewall, WAF, DDoS protection |\n| **Application** | Input validation, authentication |\n| **Data** | Encryption, access controls |\n| **Endpoint** | EDR, patch management |\n| **Process** | Security training, incident response |\n\n### 3. Defense in Depth\n\n```\n                    ┌──────────────────────┐\n                    │      Perimeter       │ ← Firewall, WAF\n                    │   ┌──────────────┐   │\n                    │   │   Network    │   │ ← Segmentation, IDS\n                    │   │  ┌────────┐  │   │\n                    │   │  │  Host  │  │   │ ← EDR, Hardening\n                    │   │  │ ┌────┐ │  │   │\n                    │   │  │ │App │ │  │   │ ← Auth, Validation\n                    │   │  │ │Data│ │  │   │ ← Encryption\n                    │   │  │ └────┘ │  │   │\n                    │   │  └────────┘  │   │\n                    │   └──────────────┘   │\n                    └──────────────────────┘\n```\n\n## Templates\n\n### Template 1: Mitigation Model\n\n```python\nfrom dataclasses import dataclass, field\nfrom enum import Enum\nfrom typing import List, Dict, Optional, Set\nfrom datetime import datetime\n\nclass ControlType(Enum):\n    PREVENTIVE = \"preventive\"\n    DETECTIVE = \"detective\"\n    CORRECTIVE = \"corrective\"\n\n\nclass ControlLayer(Enum):\n    NETWORK = \"network\"\n    APPLICATION = \"application\"\n    DATA = \"data\"\n    ENDPOINT = \"endpoint\"\n    PROCESS = \"process\"\n    PHYSICAL = \"physical\"\n\n\nclass ImplementationStatus(Enum):\n    NOT_IMPLEMENTED = \"not_implemented\"\n    PARTIAL = \"partial\"\n    IMPLEMENTED = \"implemented\"\n    VERIFIED = \"verified\"\n\n\nclass Effectiveness(Enum):\n    NONE = 0\n    LOW = 1\n    MEDIUM = 2\n    HIGH = 3\n    VERY_HIGH = 4\n\n\n@dataclass\nclass SecurityControl:\n    id: str\n    name: str\n    description: str\n    control_type: ControlType\n    layer: ControlLayer\n    effectiveness: Effectiveness\n    implementation_cost: str  # Low, Medium, High\n    maintenance_cost: str\n    status: ImplementationStatus = ImplementationStatus.NOT_IMPLEMENTED\n    mitigates_threats: List[str] = field(default_factory=list)\n    dependencies: List[str] = field(default_factory=list)\n    technologies: List[str] = field(default_factory=list)\n    compliance_refs: List[str] = field(default_factory=list)\n\n    def coverage_score(self) -> float:\n        \"\"\"Calculate coverage score based on status and effectiveness.\"\"\"\n        status_multiplier = {\n            ImplementationStatus.NOT_IMPLEMENTED: 0.0,\n            ImplementationStatus.PARTIAL: 0.5,\n            ImplementationStatus.IMPLEMENTED: 0.8,\n            ImplementationStatus.VERIFIED: 1.0,\n        }\n        return self.effectiveness.value * status_multiplier[self.status]\n\n\n@dataclass\nclass Threat:\n    id: str\n    name: str\n    category: str  # STRIDE category\n    description: str\n    impact: str  # Critical, High, Medium, Low\n    likelihood: str\n    risk_score: float\n\n\n@dataclass\nclass MitigationMapping:\n    threat: Threat\n    controls: List[SecurityControl]\n    residual_risk: str = \"Unknown\"\n    notes: str = \"\"\n\n    def calculate_coverage(self) -> float:\n        \"\"\"Calculate how well controls cover the threat.\"\"\"\n        if not self.controls:\n            return 0.0\n\n        total_score = sum(c.coverage_score() for c in self.controls)\n        max_possible = len(self.controls) * Effectiveness.VERY_HIGH.value\n\n        return (total_score \u002F max_possible) * 100 if max_possible > 0 else 0\n\n    def has_defense_in_depth(self) -> bool:\n        \"\"\"Check if multiple layers are covered.\"\"\"\n        layers = set(c.layer for c in self.controls if c.status != ImplementationStatus.NOT_IMPLEMENTED)\n        return len(layers) >= 2\n\n    def has_control_diversity(self) -> bool:\n        \"\"\"Check if multiple control types are present.\"\"\"\n        types = set(c.control_type for c in self.controls if c.status != ImplementationStatus.NOT_IMPLEMENTED)\n        return len(types) >= 2\n\n\n@dataclass\nclass MitigationPlan:\n    name: str\n    threats: List[Threat] = field(default_factory=list)\n    controls: List[SecurityControl] = field(default_factory=list)\n    mappings: List[MitigationMapping] = field(default_factory=list)\n\n    def get_unmapped_threats(self) -> List[Threat]:\n        \"\"\"Find threats without mitigations.\"\"\"\n        mapped_ids = {m.threat.id for m in self.mappings}\n        return [t for t in self.threats if t.id not in mapped_ids]\n\n    def get_control_coverage(self) -> Dict[str, float]:\n        \"\"\"Get coverage percentage for each threat.\"\"\"\n        return {\n            m.threat.id: m.calculate_coverage()\n            for m in self.mappings\n        }\n\n    def get_gaps(self) -> List[Dict]:\n        \"\"\"Identify mitigation gaps.\"\"\"\n        gaps = []\n        for mapping in self.mappings:\n            coverage = mapping.calculate_coverage()\n            if coverage \u003C 50:\n                gaps.append({\n                    \"threat\": mapping.threat.id,\n                    \"threat_name\": mapping.threat.name,\n                    \"coverage\": coverage,\n                    \"issue\": \"Insufficient control coverage\",\n                    \"recommendation\": \"Add more controls or improve existing ones\"\n                })\n            if not mapping.has_defense_in_depth():\n                gaps.append({\n                    \"threat\": mapping.threat.id,\n                    \"threat_name\": mapping.threat.name,\n                    \"coverage\": coverage,\n                    \"issue\": \"No defense in depth\",\n                    \"recommendation\": \"Add controls at different layers\"\n                })\n            if not mapping.has_control_diversity():\n                gaps.append({\n                    \"threat\": mapping.threat.id,\n                    \"threat_name\": mapping.threat.name,\n                    \"coverage\": coverage,\n                    \"issue\": \"No control diversity\",\n                    \"recommendation\": \"Add detective\u002Fcorrective controls\"\n                })\n        return gaps\n```\n\n### Template 2: Control Library\n\n```python\nclass ControlLibrary:\n    \"\"\"Library of standard security controls.\"\"\"\n\n    STANDARD_CONTROLS = {\n        # Authentication Controls\n        \"AUTH-001\": SecurityControl(\n            id=\"AUTH-001\",\n            name=\"Multi-Factor Authentication\",\n            description=\"Require MFA for all user authentication\",\n            control_type=ControlType.PREVENTIVE,\n            layer=ControlLayer.APPLICATION,\n            effectiveness=Effectiveness.HIGH,\n            implementation_cost=\"Medium\",\n            maintenance_cost=\"Low\",\n            mitigates_threats=[\"SPOOFING\"],\n            technologies=[\"TOTP\", \"WebAuthn\", \"SMS OTP\"],\n            compliance_refs=[\"PCI-DSS 8.3\", \"NIST 800-63B\"]\n        ),\n        \"AUTH-002\": SecurityControl(\n            id=\"AUTH-002\",\n            name=\"Account Lockout Policy\",\n            description=\"Lock accounts after failed authentication attempts\",\n            control_type=ControlType.PREVENTIVE,\n            layer=ControlLayer.APPLICATION,\n            effectiveness=Effectiveness.MEDIUM,\n            implementation_cost=\"Low\",\n            maintenance_cost=\"Low\",\n            mitigates_threats=[\"SPOOFING\"],\n            technologies=[\"Custom implementation\"],\n            compliance_refs=[\"PCI-DSS 8.1.6\"]\n        ),\n\n        # Input Validation Controls\n        \"VAL-001\": SecurityControl(\n            id=\"VAL-001\",\n            name=\"Input Validation Framework\",\n            description=\"Validate and sanitize all user input\",\n            control_type=ControlType.PREVENTIVE,\n            layer=ControlLayer.APPLICATION,\n            effectiveness=Effectiveness.HIGH,\n            implementation_cost=\"Medium\",\n            maintenance_cost=\"Medium\",\n            mitigates_threats=[\"TAMPERING\", \"INJECTION\"],\n            technologies=[\"Joi\", \"Yup\", \"Pydantic\"],\n            compliance_refs=[\"OWASP ASVS V5\"]\n        ),\n        \"VAL-002\": SecurityControl(\n            id=\"VAL-002\",\n            name=\"Web Application Firewall\",\n            description=\"Deploy WAF to filter malicious requests\",\n            control_type=ControlType.PREVENTIVE,\n            layer=ControlLayer.NETWORK,\n            effectiveness=Effectiveness.MEDIUM,\n            implementation_cost=\"Medium\",\n            maintenance_cost=\"Medium\",\n            mitigates_threats=[\"TAMPERING\", \"INJECTION\", \"DOS\"],\n            technologies=[\"AWS WAF\", \"Cloudflare\", \"ModSecurity\"],\n            compliance_refs=[\"PCI-DSS 6.6\"]\n        ),\n\n        # Encryption Controls\n        \"ENC-001\": SecurityControl(\n            id=\"ENC-001\",\n            name=\"Data Encryption at Rest\",\n            description=\"Encrypt sensitive data in storage\",\n            control_type=ControlType.PREVENTIVE,\n            layer=ControlLayer.DATA,\n            effectiveness=Effectiveness.HIGH,\n            implementation_cost=\"Medium\",\n            maintenance_cost=\"Low\",\n            mitigates_threats=[\"INFORMATION_DISCLOSURE\"],\n            technologies=[\"AES-256\", \"KMS\", \"HSM\"],\n            compliance_refs=[\"PCI-DSS 3.4\", \"GDPR Art. 32\"]\n        ),\n        \"ENC-002\": SecurityControl(\n            id=\"ENC-002\",\n            name=\"TLS Encryption\",\n            description=\"Encrypt data in transit using TLS 1.3\",\n            control_type=ControlType.PREVENTIVE,\n            layer=ControlLayer.NETWORK,\n            effectiveness=Effectiveness.HIGH,\n            implementation_cost=\"Low\",\n            maintenance_cost=\"Low\",\n            mitigates_threats=[\"INFORMATION_DISCLOSURE\", \"TAMPERING\"],\n            technologies=[\"TLS 1.3\", \"Certificate management\"],\n            compliance_refs=[\"PCI-DSS 4.1\", \"HIPAA\"]\n        ),\n\n        # Logging Controls\n        \"LOG-001\": SecurityControl(\n            id=\"LOG-001\",\n            name=\"Security Event Logging\",\n            description=\"Log all security-relevant events\",\n            control_type=ControlType.DETECTIVE,\n            layer=ControlLayer.APPLICATION,\n            effectiveness=Effectiveness.MEDIUM,\n            implementation_cost=\"Low\",\n            maintenance_cost=\"Medium\",\n            mitigates_threats=[\"REPUDIATION\"],\n            technologies=[\"ELK Stack\", \"Splunk\", \"CloudWatch\"],\n            compliance_refs=[\"PCI-DSS 10.2\", \"SOC2\"]\n        ),\n        \"LOG-002\": SecurityControl(\n            id=\"LOG-002\",\n            name=\"Log Integrity Protection\",\n            description=\"Protect logs from tampering\",\n            control_type=ControlType.PREVENTIVE,\n            layer=ControlLayer.DATA,\n            effectiveness=Effectiveness.MEDIUM,\n            implementation_cost=\"Medium\",\n            maintenance_cost=\"Low\",\n            mitigates_threats=[\"REPUDIATION\", \"TAMPERING\"],\n            technologies=[\"Immutable storage\", \"Log signing\"],\n            compliance_refs=[\"PCI-DSS 10.5\"]\n        ),\n\n        # Access Control\n        \"ACC-001\": SecurityControl(\n            id=\"ACC-001\",\n            name=\"Role-Based Access Control\",\n            description=\"Implement RBAC for authorization\",\n            control_type=ControlType.PREVENTIVE,\n            layer=ControlLayer.APPLICATION,\n            effectiveness=Effectiveness.HIGH,\n            implementation_cost=\"Medium\",\n            maintenance_cost=\"Medium\",\n            mitigates_threats=[\"ELEVATION_OF_PRIVILEGE\", \"INFORMATION_DISCLOSURE\"],\n            technologies=[\"RBAC\", \"ABAC\", \"Policy engines\"],\n            compliance_refs=[\"PCI-DSS 7.1\", \"SOC2\"]\n        ),\n\n        # Availability Controls\n        \"AVL-001\": SecurityControl(\n            id=\"AVL-001\",\n            name=\"Rate Limiting\",\n            description=\"Limit request rates to prevent abuse\",\n            control_type=ControlType.PREVENTIVE,\n            layer=ControlLayer.APPLICATION,\n            effectiveness=Effectiveness.MEDIUM,\n            implementation_cost=\"Low\",\n            maintenance_cost=\"Low\",\n            mitigates_threats=[\"DENIAL_OF_SERVICE\"],\n            technologies=[\"API Gateway\", \"Redis\", \"Token bucket\"],\n            compliance_refs=[\"OWASP API Security\"]\n        ),\n        \"AVL-002\": SecurityControl(\n            id=\"AVL-002\",\n            name=\"DDoS Protection\",\n            description=\"Deploy DDoS mitigation services\",\n            control_type=ControlType.PREVENTIVE,\n            layer=ControlLayer.NETWORK,\n            effectiveness=Effectiveness.HIGH,\n            implementation_cost=\"High\",\n            maintenance_cost=\"Medium\",\n            mitigates_threats=[\"DENIAL_OF_SERVICE\"],\n            technologies=[\"Cloudflare\", \"AWS Shield\", \"Akamai\"],\n            compliance_refs=[\"NIST CSF\"]\n        ),\n    }\n\n    def get_controls_for_threat(self, threat_category: str) -> List[SecurityControl]:\n        \"\"\"Get all controls that mitigate a threat category.\"\"\"\n        return [\n            c for c in self.STANDARD_CONTROLS.values()\n            if threat_category in c.mitigates_threats\n        ]\n\n    def get_controls_by_layer(self, layer: ControlLayer) -> List[SecurityControl]:\n        \"\"\"Get controls for a specific layer.\"\"\"\n        return [c for c in self.STANDARD_CONTROLS.values() if c.layer == layer]\n\n    def get_control(self, control_id: str) -> Optional[SecurityControl]:\n        \"\"\"Get a specific control by ID.\"\"\"\n        return self.STANDARD_CONTROLS.get(control_id)\n\n    def recommend_controls(\n        self,\n        threat: Threat,\n        existing_controls: List[str]\n    ) -> List[SecurityControl]:\n        \"\"\"Recommend additional controls for a threat.\"\"\"\n        available = self.get_controls_for_threat(threat.category)\n        return [c for c in available if c.id not in existing_controls]\n```\n\n### Template 3: Mitigation Analysis\n\n```python\nclass MitigationAnalyzer:\n    \"\"\"Analyze and optimize mitigation strategies.\"\"\"\n\n    def __init__(self, plan: MitigationPlan, library: ControlLibrary):\n        self.plan = plan\n        self.library = library\n\n    def calculate_overall_risk_reduction(self) -> float:\n        \"\"\"Calculate overall risk reduction percentage.\"\"\"\n        if not self.plan.mappings:\n            return 0.0\n\n        weighted_coverage = 0\n        total_weight = 0\n\n        for mapping in self.plan.mappings:\n            # Weight by threat risk score\n            weight = mapping.threat.risk_score\n            coverage = mapping.calculate_coverage()\n            weighted_coverage += weight * coverage\n            total_weight += weight\n\n        return weighted_coverage \u002F total_weight if total_weight > 0 else 0\n\n    def get_critical_gaps(self) -> List[Dict]:\n        \"\"\"Find critical gaps that need immediate attention.\"\"\"\n        gaps = self.plan.get_gaps()\n        critical_threats = {t.id for t in self.plan.threats if t.impact == \"Critical\"}\n\n        return [g for g in gaps if g[\"threat\"] in critical_threats]\n\n    def optimize_budget(\n        self,\n        budget: float,\n        cost_map: Dict[str, float]\n    ) -> List[SecurityControl]:\n        \"\"\"Select controls that maximize risk reduction within budget.\"\"\"\n        # Simple greedy approach - can be replaced with optimization algorithm\n        recommended = []\n        remaining_budget = budget\n        unmapped = self.plan.get_unmapped_threats()\n\n        # Sort controls by effectiveness\u002Fcost ratio\n        all_controls = list(self.library.STANDARD_CONTROLS.values())\n        controls_with_value = []\n\n        for control in all_controls:\n            if control.status == ImplementationStatus.NOT_IMPLEMENTED:\n                cost = cost_map.get(control.id, float('inf'))\n                if cost \u003C= remaining_budget:\n                    # Calculate value as threats covered * effectiveness \u002F cost\n                    threats_covered = len([\n                        t for t in unmapped\n                        if t.category in control.mitigates_threats\n                    ])\n                    if threats_covered > 0:\n                        value = (threats_covered * control.effectiveness.value) \u002F cost\n                        controls_with_value.append((control, value, cost))\n\n        # Sort by value (higher is better)\n        controls_with_value.sort(key=lambda x: x[1], reverse=True)\n\n        for control, value, cost in controls_with_value:\n            if cost \u003C= remaining_budget:\n                recommended.append(control)\n                remaining_budget -= cost\n\n        return recommended\n\n    def generate_roadmap(self) -> List[Dict]:\n        \"\"\"Generate implementation roadmap by priority.\"\"\"\n        roadmap = []\n        gaps = self.plan.get_gaps()\n\n        # Phase 1: Critical threats with low coverage\n        phase1 = []\n        for gap in gaps:\n            mapping = next(\n                (m for m in self.plan.mappings if m.threat.id == gap[\"threat\"]),\n                None\n            )\n            if mapping and mapping.threat.impact == \"Critical\":\n                controls = self.library.get_controls_for_threat(mapping.threat.category)\n                phase1.extend([\n                    {\n                        \"threat\": gap[\"threat\"],\n                        \"control\": c.id,\n                        \"control_name\": c.name,\n                        \"phase\": 1,\n                        \"priority\": \"Critical\"\n                    }\n                    for c in controls\n                    if c.status == ImplementationStatus.NOT_IMPLEMENTED\n                ])\n\n        roadmap.extend(phase1[:5])  # Top 5 for phase 1\n\n        # Phase 2: High impact threats\n        phase2 = []\n        for gap in gaps:\n            mapping = next(\n                (m for m in self.plan.mappings if m.threat.id == gap[\"threat\"]),\n                None\n            )\n            if mapping and mapping.threat.impact == \"High\":\n                controls = self.library.get_controls_for_threat(mapping.threat.category)\n                phase2.extend([\n                    {\n                        \"threat\": gap[\"threat\"],\n                        \"control\": c.id,\n                        \"control_name\": c.name,\n                        \"phase\": 2,\n                        \"priority\": \"High\"\n                    }\n                    for c in controls\n                    if c.status == ImplementationStatus.NOT_IMPLEMENTED\n                ])\n\n        roadmap.extend(phase2[:5])  # Top 5 for phase 2\n\n        return roadmap\n\n    def defense_in_depth_analysis(self) -> Dict[str, List[str]]:\n        \"\"\"Analyze defense in depth coverage.\"\"\"\n        layer_coverage = {layer.value: [] for layer in ControlLayer}\n\n        for mapping in self.plan.mappings:\n            for control in mapping.controls:\n                if control.status in [ImplementationStatus.IMPLEMENTED, ImplementationStatus.VERIFIED]:\n                    layer_coverage[control.layer.value].append(control.id)\n\n        return layer_coverage\n\n    def generate_report(self) -> str:\n        \"\"\"Generate comprehensive mitigation report.\"\"\"\n        risk_reduction = self.calculate_overall_risk_reduction()\n        gaps = self.plan.get_gaps()\n        critical_gaps = self.get_critical_gaps()\n        layer_coverage = self.defense_in_depth_analysis()\n\n        report = f\"\"\"\n# Threat Mitigation Report\n\n## Executive Summary\n- **Overall Risk Reduction:** {risk_reduction:.1f}%\n- **Total Threats:** {len(self.plan.threats)}\n- **Total Controls:** {len(self.plan.controls)}\n- **Identified Gaps:** {len(gaps)}\n- **Critical Gaps:** {len(critical_gaps)}\n\n## Defense in Depth Coverage\n{self._format_layer_coverage(layer_coverage)}\n\n## Critical Gaps Requiring Immediate Action\n{self._format_gaps(critical_gaps)}\n\n## Recommendations\n{self._format_recommendations()}\n\n## Implementation Roadmap\n{self._format_roadmap()}\n\"\"\"\n        return report\n\n    def _format_layer_coverage(self, coverage: Dict[str, List[str]]) -> str:\n        lines = []\n        for layer, controls in coverage.items():\n            status = \"✓\" if controls else \"✗\"\n            lines.append(f\"- {layer}: {status} ({len(controls)} controls)\")\n        return \"\\n\".join(lines)\n\n    def _format_gaps(self, gaps: List[Dict]) -> str:\n        if not gaps:\n            return \"No critical gaps identified.\"\n        lines = []\n        for gap in gaps:\n            lines.append(f\"- **{gap['threat_name']}**: {gap['issue']}\")\n            lines.append(f\"  - Coverage: {gap['coverage']:.1f}%\")\n            lines.append(f\"  - Recommendation: {gap['recommendation']}\")\n        return \"\\n\".join(lines)\n\n    def _format_recommendations(self) -> str:\n        recommendations = []\n        layer_coverage = self.defense_in_depth_analysis()\n\n        for layer, controls in layer_coverage.items():\n            if not controls:\n                recommendations.append(f\"- Add {layer} layer controls\")\n\n        gaps = self.plan.get_gaps()\n        if any(g[\"issue\"] == \"No control diversity\" for g in gaps):\n            recommendations.append(\"- Add more detective and corrective controls\")\n\n        return \"\\n\".join(recommendations) if recommendations else \"Current coverage is adequate.\"\n\n    def _format_roadmap(self) -> str:\n        roadmap = self.generate_roadmap()\n        if not roadmap:\n            return \"No additional controls recommended at this time.\"\n\n        lines = []\n        current_phase = 0\n        for item in roadmap:\n            if item[\"phase\"] != current_phase:\n                current_phase = item[\"phase\"]\n                lines.append(f\"\\n### Phase {current_phase}\")\n            lines.append(f\"- [{item['priority']}] {item['control_name']} (for {item['threat']})\")\n\n        return \"\\n\".join(lines)\n```\n\n### Template 4: Control Effectiveness Testing\n\n```python\nfrom dataclasses import dataclass\nfrom typing import List, Callable, Any\nimport asyncio\n\n@dataclass\nclass ControlTest:\n    control_id: str\n    test_name: str\n    test_function: Callable[[], bool]\n    expected_result: bool\n    description: str\n\n\nclass ControlTester:\n    \"\"\"Test control effectiveness.\"\"\"\n\n    def __init__(self):\n        self.tests: List[ControlTest] = []\n        self.results: List[Dict] = []\n\n    def add_test(self, test: ControlTest) -> None:\n        self.tests.append(test)\n\n    async def run_tests(self) -> List[Dict]:\n        \"\"\"Run all control tests.\"\"\"\n        self.results = []\n\n        for test in self.tests:\n            try:\n                result = test.test_function()\n                passed = result == test.expected_result\n                self.results.append({\n                    \"control_id\": test.control_id,\n                    \"test_name\": test.test_name,\n                    \"passed\": passed,\n                    \"actual_result\": result,\n                    \"expected_result\": test.expected_result,\n                    \"description\": test.description,\n                    \"error\": None\n                })\n            except Exception as e:\n                self.results.append({\n                    \"control_id\": test.control_id,\n                    \"test_name\": test.test_name,\n                    \"passed\": False,\n                    \"actual_result\": None,\n                    \"expected_result\": test.expected_result,\n                    \"description\": test.description,\n                    \"error\": str(e)\n                })\n\n        return self.results\n\n    def get_effectiveness_score(self, control_id: str) -> float:\n        \"\"\"Calculate effectiveness score for a control.\"\"\"\n        control_results = [r for r in self.results if r[\"control_id\"] == control_id]\n        if not control_results:\n            return 0.0\n\n        passed = sum(1 for r in control_results if r[\"passed\"])\n        return (passed \u002F len(control_results)) * 100\n\n    def generate_test_report(self) -> str:\n        \"\"\"Generate test results report.\"\"\"\n        if not self.results:\n            return \"No tests have been run.\"\n\n        total = len(self.results)\n        passed = sum(1 for r in self.results if r[\"passed\"])\n\n        report = f\"\"\"\n# Control Effectiveness Test Report\n\n## Summary\n- **Total Tests:** {total}\n- **Passed:** {passed}\n- **Failed:** {total - passed}\n- **Pass Rate:** {(passed\u002Ftotal)*100:.1f}%\n\n## Results by Control\n\"\"\"\n        # Group by control\n        controls = {}\n        for result in self.results:\n            cid = result[\"control_id\"]\n            if cid not in controls:\n                controls[cid] = []\n            controls[cid].append(result)\n\n        for control_id, results in controls.items():\n            score = self.get_effectiveness_score(control_id)\n            report += f\"\\n### {control_id} (Effectiveness: {score:.1f}%)\\n\"\n            for r in results:\n                status = \"✓\" if r[\"passed\"] else \"✗\"\n                report += f\"- {status} {r['test_name']}\\n\"\n                if r[\"error\"]:\n                    report += f\"  - Error: {r['error']}\\n\"\n\n        return report\n```\n\n## Best Practices\n\n### Do's\n- **Map all threats** - No threat should be unmapped\n- **Layer controls** - Defense in depth is essential\n- **Mix control types** - Preventive, detective, corrective\n- **Track effectiveness** - Measure and improve\n- **Review regularly** - Controls degrade over time\n\n### Don'ts\n- **Don't rely on single controls** - Single points of failure\n- **Don't ignore cost** - ROI matters\n- **Don't skip testing** - Untested controls may fail\n- **Don't set and forget** - Continuous improvement\n- **Don't ignore people\u002Fprocess** - Technology alone isn't enough\n\n## Resources\n\n- [NIST Cybersecurity Framework](https:\u002F\u002Fwww.nist.gov\u002Fcyberframework)\n- [CIS Controls](https:\u002F\u002Fwww.cisecurity.org\u002Fcontrols)\n- [MITRE D3FEND](https:\u002F\u002Fd3fend.mitre.org\u002F)\n",{"name":5,"description":7},"main","7850740bd837adb32f0a109ab2af82482196c6f2","skills\u002F_collections\u002Fwshobson-agents\u002Fplugins\u002Fsecurity-scanning\u002Fskills\u002Fthreat-mitigation-mapping",1,"https:\u002F\u002Fgithub.com\u002Fshengdabai\u002FTony-Claude-Code-Skills","https:\u002F\u002Fzturnsgo.com","https:\u002F\u002Fgithub.com\u002Fshengdabai","https:\u002F\u002Fzturnsgo.com\u002F","AI × education creator — producer, not consumer. Taught 6,000+ learners; shipping learning tools & daily essays with Claude Code, practicing @xiaolai's way 🥋","2026-11-01 21:28:23",{"source":8,"skillName":5,"commands":46,"prompt":56,"zipAvailable":57},[47,50,53],{"tool":48,"command":49},"npx","npx skills add shengdabai\u002FTony-Claude-Code-Skills --skill threat-mitigation-mapping",{"tool":51,"command":52},"bunx","bunx skills add shengdabai\u002FTony-Claude-Code-Skills --skill threat-mitigation-mapping",{"tool":54,"command":55},"pnpm","pnpm dlx skills add shengdabai\u002FTony-Claude-Code-Skills --skill threat-mitigation-mapping","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fshengdabai\u002FTony-Claude-Code-Skills\u002Fblob\u002Fmain\u002Fskills\u002F_collections\u002Fwshobson-agents\u002Fplugins\u002Fsecurity-scanning\u002Fskills\u002Fthreat-mitigation-mapping\u002FSKILL.md",true,[],[60,79,112,137,159,179],{"skillNo":61,"name":62,"nameZh":6,"description":63,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":64,"categories":65,"keywords":71,"publishedAt":30},"01M70P17DAD4C1C47NPH6A96EM","xiaolai-methodology","以李笑来(Li Xiaolai)的思考方式、方法论与表达风格,为用户做全方位 1-on-1 教练指导,覆盖创业、赚钱、投资、学习、自学、读书写作、用 AI、以及人生心态与自我管理。当用户提到 \"李笑来\"、\"笑来\"、\"笑来老师\"、\"扮演李笑来\"、\"找笑来聊聊\"、\"笑来怎么看\"、\"xiaolai\"、\"把时间当作朋友\"、\"通往财富自由之路\"、\"定投改变命运\"、\"韭菜的自我修养\"、\"自学是门手艺\"、\"让时间陪你慢慢变富\"、\"七年就是一辈子\"、\"元认知\"、\"活在未来\"、\"复利\u002F长期主义\"、\"践行\"、\"痴迷改进\"、\"个人商业模式\u002F出售时间\"、\"睡后收入\"、\"定投\"、\"财富自由\"、\"操作系统升级\"、\"最少必要知识\"、\"北极星提示词\"、\"用 AI 该怎么学\u002F思考\" 等任一触发词,或当用户带着关于创业\u002F赚钱\u002F投资\u002F学习\u002F职业\u002F重大人生决策的困惑、希望被人用笑来式的「逻辑 + 大白话 + 类比 + 重新定义 + 践行导向」来点醒和指导时,自动进入李笑来教练模式。","https:\u002F\u002Fgithub.com\u002Fshengdabai\u002FTony-Claude-Code-Skills\u002Fblob\u002Fmain\u002Fxiaolai-methodology\u002FSKILL.md",[66],{"categoryNo":67,"categoryName":68,"taxonomyType":69,"taxonomyTypeDesc":70},"01JBSEEDCAT000000000000018","写作与文案","SCENARIO","使用场景",[72,73,74,75,76,77,78],"methodology","xiaolai","xiaolai methodology","朋友","投资","writing","收入",{"skillNo":80,"name":81,"nameZh":6,"description":82,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":83,"categories":84,"keywords":93,"publishedAt":30},"01M70P13NB9YP7ACJR1S861CDS","zread","Produce and consume a wiki-style knowledge base for a code repository via the `zread` CLI and its on-disk output under `.\u002F.zread\u002Fwiki\u002F`. Use this skill whenever the user wants to understand, onboard onto, explore, summarize, map, or get an overview of an unfamiliar codebase; asks for architecture docs, a project wiki, a repo walkthrough, module\u002Fpackage explanations, or \"what does this repo do\"; wants to generate, regenerate, resume, browse, or serve code documentation locally; or mentions zread \u002F zread.ai directly. Also use it proactively before diving into a large unknown repo — if `.\u002F.zread\u002Fwiki\u002Fcurrent` exists, read the generated pages instead of crawling source file-by-file; if it doesn't, consider offering to run `zread generate`. The trigger is the intent (understand a codebase through generated docs), not the literal word \"zread\".","https:\u002F\u002Fgithub.com\u002Fshengdabai\u002FTony-Claude-Code-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fzread\u002FSKILL.md",[85,88],{"categoryNo":86,"categoryName":87,"taxonomyType":69,"taxonomyTypeDesc":70},"01JBSEEDCAT000000000000023","Skill与智能体开发",{"categoryNo":89,"categoryName":90,"taxonomyType":91,"taxonomyTypeDesc":92},"01JBSEEDCAT000000000000030","开发工程师","PROFESSION","适用职业",[81,94,95,96,97,98,99,100,101,102,103,104,23,105,106,107,108,109,110,111],"knowledge","wiki","explore","walkthrough","project","get","knowledge base","run","generate","intent","cli","documentation","project wiki","disk","architecture","code","unknown","generated",{"skillNo":113,"name":114,"nameZh":6,"description":115,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":116,"categories":117,"keywords":122,"publishedAt":30},"01M70P10S4SWMZQ8BJAFBFDRW3","youtube","Launch the YouTube Creator Agent to auto-generate videos.\nUse when: user types \u002Fyoutube, wants to create YouTube videos,\ngenerate video content, or upload to YouTube.\nKeywords: youtube, video, 视频, 创作视频, 发布视频","https:\u002F\u002Fgithub.com\u002Fshengdabai\u002FTony-Claude-Code-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fyoutube\u002FSKILL.md",[118,119],{"categoryNo":86,"categoryName":87,"taxonomyType":69,"taxonomyTypeDesc":70},{"categoryNo":120,"categoryName":121,"taxonomyType":91,"taxonomyTypeDesc":92},"01JBSEEDCAT000000000000036","内容创作者",[114,123,124,125,126,127,128,129,102,130,131,132,26,25,133,134,135,136],"user","content","视频","creator","generate video","videos","launch","video content","create","upload","auto","types","Video","创作",{"skillNo":138,"name":139,"nameZh":6,"description":140,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":141,"categories":142,"keywords":144,"publishedAt":30},"01M70P0YE95D8BACZCGV8BK90K","youtube-script-sync","Sync, update, or optimize Tony's GetNote knowledge base `Youtube视频逐字稿` by turning each parent recording or first-person idea note into an idempotent child note containing a directly recordable YouTube long-video or Shorts script. Use when the user says “更新\u002F同步\u002F优化 Youtube视频逐字稿知识库”, or says “更新\u002F同步\u002F优化该知识库” while this knowledge base is the active context.","https:\u002F\u002Fgithub.com\u002Fshengdabai\u002FTony-Claude-Code-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fyoutube-script-sync\u002FSKILL.md",[143],{"categoryNo":86,"categoryName":87,"taxonomyType":69,"taxonomyTypeDesc":70},[145,146,114,147,148,135,149,150,151,152,153,154,155,156,100,157,26,25,94,158],"sync","script","youtube script sync","recording","shorts","first","base","person","update","active","child","optimize","idempotent","long",{"skillNo":160,"name":161,"nameZh":6,"description":162,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":163,"categories":164,"keywords":169,"publishedAt":30},"01M70P0WMV5XT0EEC0N445PW07","writing-skills","How to write SKILL.md files that trigger reliably and teach effectively. Use when creating, improving, or reviewing Claude Code skills.","https:\u002F\u002Fgithub.com\u002Fshengdabai\u002FTony-Claude-Code-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fxiaolai\u002Fnlpm\u002Fskills\u002Fnlpm\u002Fwriting-skills\u002FSKILL.md",[165,166,167,168],{"categoryNo":67,"categoryName":68,"taxonomyType":69,"taxonomyTypeDesc":70},{"categoryNo":86,"categoryName":87,"taxonomyType":69,"taxonomyTypeDesc":70},{"categoryNo":89,"categoryName":90,"taxonomyType":91,"taxonomyTypeDesc":92},{"categoryNo":120,"categoryName":121,"taxonomyType":91,"taxonomyTypeDesc":92},[170,77,171,172,173,174,109,26,25,175,176,177,178],"writing skills","how","teach","write skill","write","claude code skills","files","how to","trigger",{"skillNo":180,"name":181,"nameZh":6,"description":182,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":183,"categories":184,"keywords":187,"publishedAt":30},"01M70P0SJFR4YVJQBGMHKGSKXT","writing-rules","How to write .claude\u002Frules\u002F files that Claude actually follows. Use when creating, improving, or reviewing project rules.","https:\u002F\u002Fgithub.com\u002Fshengdabai\u002FTony-Claude-Code-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fxiaolai\u002Fnlpm\u002Fskills\u002Fnlpm\u002Fwriting-rules\u002FSKILL.md",[185,186],{"categoryNo":67,"categoryName":68,"taxonomyType":69,"taxonomyTypeDesc":70},{"categoryNo":120,"categoryName":121,"taxonomyType":91,"taxonomyTypeDesc":92},[188,77,189,98,190,176,26,171,174,25,177],"Rules","writing rules","project rules"]