mirror of
https://github.com/github/awesome-copilot.git
synced 2026-04-14 12:15:59 +00:00
Add threat-model-analyst skill: STRIDE-A threat modeling for repositories (#1177)
* Add threat-model-analyst skill: STRIDE-A threat modeling for repositories Add a comprehensive threat model analysis skill that performs security audits using STRIDE-A (STRIDE + Abuse) threat modeling, Zero Trust principles, and defense-in-depth analysis. Supports two modes: - Single analysis: full STRIDE-A threat model producing architecture overviews, DFD diagrams, prioritized findings, and executive assessments - Incremental analysis: security posture diff between baseline report and current code, producing standalone reports with embedded comparison Includes bundled reference assets: - Orchestrator workflows (full and incremental) - Analysis principles and verification checklists - Output format specifications and skeleton templates - DFD diagram conventions and TMT element taxonomy * Address PR review comments from Copilot reviewer - Fix SKILL.md description: use single-quoted scalar, rename mode (2) to 'Incremental analysis' with accurate description - Replace 'Compare Mode (Deprecated)' sections with 'Comparing Commits or Reports' redirect (no deprecated language for first release) - Fix skeleton-findings.md: move Tier 1 table rows under header, add CONDITIONAL-EMPTY block after END-REPEAT (matching Tier 2/3 structure) - Fix skeleton-threatmodel.md and skeleton-architecture.md: use 4-backtick outer fences to avoid nested fence conflicts with inner mermaid fences - Fix skeleton-incremental-html.md: correct section count from 9 to 8 - Fix output-formats.md: change status 'open' to 'Open' in JSON example, move stride_category warning outside JSON fence as blockquote - Fix incremental-orchestrator.md: replace stale compare-output-formats.md reference with inline color conventions - Regenerate docs/README.skills.md with updated description * Address second round of Copilot review comments - Fix diagram-conventions.md: bidirectional flow notation now uses <--> matching orchestrator.md and DFD templates - Fix tmt-element-taxonomy.md: normalize SE.DF.SSH/LDAP/LDAPS to use SE.DF.TMCore.* prefix consistent with all other data flow IDs - Fix output-formats.md: correct TMT category example from SQLDatabase to SQL matching taxonomy, fix component type from 'datastore' to 'data_store' matching canonical enum, remove DaprSidecar from inbound_from per no-standalone-sidecar rule - Fix 5 skeleton files: clarify VERBATIM instruction to 'copy the template content below (excluding the outer code fence)' to prevent agents from wrapping output in markdown fences - Genericize product-specific names in examples: replace edgerag with myapp, BitNetManager with TaskProcessor, AzureLocalMCP with MyApp.Core, AzureLocalInfra with OnPremInfra, MilvusVectorDB with VectorDB * Address third round of Copilot review comments - Fix diagram-conventions.md: second bidirectional two-arrow pattern in Quick Reference section now uses <--> - Fix incremental-orchestrator.md: renumber HTML sections 5-9 to 4-8 matching skeleton-incremental-html.md 8-section structure - Fix output-formats.md: add incremental-comparison.html to File List as conditional output for incremental mode - Fix skeleton-inventory.md: add tmt_type, sidecars, and boundary_kind fields to match output-formats.md JSON schema example
This commit is contained in:
Vijay Chegu
GitHub
75
skills/threat-model-analyst/SKILL.md
Normal file
75
skills/threat-model-analyst/SKILL.md
Normal file
@@ -0,0 +1,75 @@
|
||||
---
|
||||
name: threat-model-analyst
|
||||
description: 'Full STRIDE-A threat model analysis and incremental update skill for repositories and systems. Supports two modes: (1) Single analysis — full STRIDE-A threat model of a repository, producing architecture overviews, DFD diagrams, STRIDE-A analysis, prioritized findings, and executive assessments. (2) Incremental analysis — takes a previous threat model report as baseline, compares the codebase at the latest (or a given commit), and produces an updated report with change tracking (new, resolved, still-present threats), STRIDE heatmap, findings diff, and an embedded HTML comparison. Only activate when the user explicitly requests a threat model analysis, incremental update, or invokes /threat-model-analyst directly.'
|
||||
---
|
||||
|
||||
# Threat Model Analyst
|
||||
|
||||
You are an expert **Threat Model Analyst**. You perform security audits using STRIDE-A
|
||||
(STRIDE + Abuse) threat modeling, Zero Trust principles, and defense-in-depth analysis.
|
||||
You flag secrets, insecure boundaries, and architectural risks.
|
||||
|
||||
## Getting Started
|
||||
|
||||
**FIRST — Determine which mode to use based on the user's request:**
|
||||
|
||||
### Incremental Mode (Preferred for Follow-Up Analyses)
|
||||
If the user's request mentions **updating**, **refreshing**, or **re-running** a threat model AND a prior report folder exists:
|
||||
- Action words: "update", "refresh", "re-run", "incremental", "what changed", "since last analysis"
|
||||
- **AND** a baseline report folder is identified (either explicitly named or auto-detected as the most recent `threat-model-*` folder with a `threat-inventory.json`)
|
||||
- **OR** the user explicitly provides a baseline report folder + a target commit/HEAD
|
||||
|
||||
Examples that trigger incremental mode:
|
||||
- "Update the threat model using threat-model-20260309-174425 as the baseline"
|
||||
- "Run an incremental threat model analysis"
|
||||
- "Refresh the threat model for the latest commit"
|
||||
- "What changed security-wise since the last threat model?"
|
||||
|
||||
→ Read [incremental-orchestrator.md](./references/incremental-orchestrator.md) and follow the **incremental workflow**.
|
||||
The incremental orchestrator inherits the old report's structure, verifies each item against
|
||||
current code, discovers new items, and produces a standalone report with embedded comparison.
|
||||
|
||||
### Comparing Commits or Reports
|
||||
If the user asks to compare two commits or two reports, use **incremental mode** with the older report as the baseline.
|
||||
→ Read [incremental-orchestrator.md](./references/incremental-orchestrator.md) and follow the **incremental workflow**.
|
||||
|
||||
### Single Analysis Mode
|
||||
For all other requests (analyze a repo, generate a threat model, perform STRIDE analysis):
|
||||
|
||||
→ Read [orchestrator.md](./references/orchestrator.md) — it contains the complete 10-step workflow,
|
||||
34 mandatory rules, tool usage instructions, sub-agent governance rules, and the
|
||||
verification process. Do not skip this step.
|
||||
|
||||
## Reference Files
|
||||
|
||||
Load the relevant file when performing each task:
|
||||
|
||||
| File | Use When | Content |
|
||||
|------|----------|---------|
|
||||
| [Orchestrator](./references/orchestrator.md) | **Always — read first** | Complete 10-step workflow, 34 mandatory rules, sub-agent governance, tool usage, verification process |
|
||||
| [Incremental Orchestrator](./references/incremental-orchestrator.md) | **Incremental/update analyses** | Complete incremental workflow: load old skeleton, change detection, generate report with status annotations, HTML comparison |
|
||||
| [Analysis Principles](./references/analysis-principles.md) | Analyzing code for security issues | Verify-before-flagging rules, security infrastructure inventory, OWASP Top 10:2025, platform defaults, exploitability tiers, severity standards |
|
||||
| [Diagram Conventions](./references/diagram-conventions.md) | Creating ANY Mermaid diagram | Color palette, shapes, sidecar co-location rules, pre-render checklist, DFD vs architecture styles, sequence diagram styles |
|
||||
| [Output Formats](./references/output-formats.md) | Writing ANY output file | Templates for 0.1-architecture.md, 1-threatmodel.md, 2-stride-analysis.md, 3-findings.md, 0-assessment.md, common mistakes checklist |
|
||||
| [Skeletons](./references/skeletons/) | **Before writing EACH output file** | 8 verbatim fill-in skeletons (`skeleton-*.md`) — read the relevant skeleton, copy VERBATIM, fill `[FILL]` placeholders. One skeleton per output file. Loaded on-demand to minimize context usage. |
|
||||
| [Verification Checklist](./references/verification-checklist.md) | Final verification pass + inline quick-checks | All quality gates: inline quick-checks (run after each file write), per-file structural, diagram rendering, cross-file consistency, evidence quality, JSON schema — designed for sub-agent delegation |
|
||||
| [TMT Element Taxonomy](./references/tmt-element-taxonomy.md) | Identifying DFD elements from code | Complete TMT-compatible element type taxonomy, trust boundary detection, data flow patterns, code analysis checklist |
|
||||
|
||||
## When to Activate
|
||||
|
||||
**Incremental Mode** (read [incremental-orchestrator.md](./references/incremental-orchestrator.md) for workflow):
|
||||
- Update or refresh an existing threat model analysis
|
||||
- Generate a new analysis that builds on a prior report's structure
|
||||
- Track what threats/findings were fixed, introduced, or remain since a baseline
|
||||
- When a prior `threat-model-*` folder exists and the user wants a follow-up analysis
|
||||
|
||||
**Single Analysis Mode:**
|
||||
- Perform full threat model analysis of a repository or system
|
||||
- Generate threat model diagrams (DFD) from code
|
||||
- Perform STRIDE-A analysis on components and data flows
|
||||
- Validate security control implementations
|
||||
- Identify trust boundary violations and architectural risks
|
||||
- Write prioritized security findings with CVSS 4.0 / CWE / OWASP mappings
|
||||
|
||||
**Comparing commits or reports:**
|
||||
- To compare security posture between commits, use incremental mode with the older report as baseline
|
||||
Reference in New Issue
Block a user