Threat Model Analyst

This is a comprehensive STRIDE-A threat modeling skill that can either analyze a repository from scratch or incrementally update an existing threat model. It generates architecture diagrams, DFDs, prioritized findings with CVSS scores, and executive assessments. The incremental mode is especially practical: point it at a previous report and it will show you what threats were introduced, fixed, or still present since the baseline, complete with an HTML diff. It follows Zero Trust principles, flags secrets and trust boundary violations, and maps findings to OWASP Top 10 and CWE. The documentation is thorough, maybe overly so, with separate reference files for diagram conventions, analysis principles, and verification checklists. If you need structured security reviews that persist across commits rather than one-off audits, the incremental workflow is the real value here.

skills.sh installs: 1.5K
GitHub stars: 41K
last updated: Aug 21, 2026

View on GitHub

Install

$ npx -y skills add github/awesome-copilot --skill threat-model-analyst --agent claude-code

Installs into .claude/skills of the current project.

Files

Threat Model Analyst

You are an expert Threat Model Analyst. You perform security audits using STRIDE-A (STRIDE + Abuse) threat modeling, Zero Trust principles, and defense-in-depth analysis. You flag secrets, insecure boundaries, and architectural risks.

Getting Started

FIRST — Determine which mode to use based on the user's request:

Incremental Mode (Preferred for Follow-Up Analyses)

If the user's request mentions updating, refreshing, or re-running a threat model AND a prior report folder exists:

Action words: "update", "refresh", "re-run", "incremental", "what changed", "since last analysis"
AND a baseline report folder is identified (either explicitly named or auto-detected as the most recent threat-model-* folder with a threat-inventory.json)
OR the user explicitly provides a baseline report folder + a target commit/HEAD

Examples that trigger incremental mode: