threat-modeling
Systematically identify and prioritize security threats to a system and decide on mitigations. Use when designing new systems, reviewing architecture, or improving security posture of existing systems.
- License 许可
- MIT
- 最近更新
- 2026-07-22
- Stars
- ★ 7
- Forks
- 1
01 前言 Front Matter
- name
- threat-modeling
- description
- Systematically identify and prioritize security threats to a system and decide on mitigations. Use when designing new systems, reviewing architecture, or improving security posture of existing systems.
03 SKILL.md 正文
Threat Modeling
Overview
Threat modeling is a structured way to think about what can go wrong and what you are going to do about it.
When to Use
- Designing new features or systems with security implications
- Reviewing architecture for security weaknesses
- Prioritizing security work
Lightweight Process
- What are we building? (diagrams, data flows, trust boundaries)
- What can go wrong? (STRIDE or similar: Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, Elevation of Privilege)
- What are we going to do about it? (mitigate, accept, transfer, avoid)
- Did we do a good job? (review and iterate)
Principles
- Focus on the highest-impact, most likely threats first
- Involve people who know the system and the domain
- Keep models living — update when the system changes significantly
- Prefer concrete mitigations over generic advice
Verification
- Key assets and trust boundaries are identified
- Important threats have explicit decisions (mitigate / accept)
- Mitigations are tracked and implemented
04 同仓库更多 Skills
compliance-monitoring
Design compliance monitoring and testing programs that verify controls work in practice and surface issues before regulators do. Use when building monitoring plans, compliance testing, or continuous control monitoring.
complaints-handling
Operate complaints-handling processes that meet regulatory standards — logging, timely resolution, root-cause analysis, and fair outcomes. Use when designing or improving regulated complaints frameworks or analyzing complaint themes for conduct risk.
aml-kyc-basics
Apply AML/KYC fundamentals — customer due diligence, monitoring, suspicious activity escalation, and recordkeeping — for financial crime compliance. Use when designing onboarding controls, transaction monitoring concepts, or AML program components in financial services.
ai-model-compliance
Apply compliance controls to AI and automated decision systems — transparency, fairness, human oversight, documentation, and regulatory alignment. Use when deploying AI in regulated processes (credit, fraud, customer decisions) or responding to AI governance expectations.
data-quality-management
Manage data quality end-to-end — dimensions, rules, remediation, and prevention — beyond one-off cleaning scripts. Use when building sustained data quality programs or fixing systemic accuracy, completeness, or consistency problems.
data-lineage
Capture and use data lineage — where data comes from, how it transforms, and what depends on it — for impact analysis, debugging, and trust. Use when tracing metric origins, assessing change impact, or diagnosing broken pipelines.