Threat Modeling

Name: Threat Modeling
Author: awarexone

ASecurity

Lightweight threat modeling for an application before deep scanning — map assets, trust boundaries, and abuse cases; feeds /axguard-audit.

15 stars

0 votes

0 copies

0 views

Added 9/22/2026

securityrustgoapisecurity

Works with

api

Security Analysis

A100/100

Scanned 9/22/2026

Install to Claude Code

$npx -y skills add awarexone/AXguard --skill threat-modeling --agent claude-code

Installs into .claude/skills of the current project.

Are you the author of Threat Modeling?

Add the live security badge to your README — it updates automatically with every re-scan.

Security grade badge for Threat Modeling

[![Security: A — Skills Directory](https://www.skillsdirectory.com/api/skills/awarexone-threat-modeling/badge)](https://www.skillsdirectory.com/skills/awarexone-threat-modeling)

More formats (shields.io, HTML) on the badges page.

Download Zip

Files

SKILL.md

---
name: threat-modeling
description: Lightweight threat modeling for an application before deep scanning — map assets, trust boundaries, and abuse cases; feeds /axguard-audit.
version: "1.0.0"
author: AwareXone
license: MIT
domain: discovery
subcategory: threat-modeling
tags: [threat-model, stride, design-review]
frameworks:
  cwe: []
  owasp_top10: [A04:2021]
  owasp_api_top10: []
  owasp_llm_top10: []
  owasp_wstg: []
  owasp_asvs: []
  mitre_attack: []
  mitre_atlas: []
  nist_csf: []
  nist_ai_rmf: []
related_skills: [attack-surface-mapping, security-architecture-review, security-triage]
related_commands: [/axguard-threat-model, /axguard-audit, /axguard-cso]
related_rules: []
references:
  - https://owasp.org/Top10/A04_2021-Insecure_Design/
last_reviewed: "2026-09-15"
---

# Threat Modeling

## Purpose

Produce a short, actionable threat model that guides which AXGuard skills and scans to run next.

## When to Use

- New codebase / first audit
- Major feature (auth, payments, agents, file import)
- Before `/axguard-audit` on unfamiliar systems

## When Not to Use

- Single-line bugfix with known sink (go straight to the class skill)

## Analysis Workflow

1. **Assets**: data, secrets, admin, money movement, model tools.
2. **Actors**: anonymous, user, admin, attacker, malicious model/tool output.
3. **Trust boundaries**: browser↔API, API↔DB, API↔cloud, agent↔tools, CI↔prod.
4. **STRIDE-lite** per boundary (spoof, tamper, repudiate, info disclosure, DoS, elevation) — keep to realistic top abuses.
5. Rank top 5 abuse cases.
6. Map each to an AXGuard command/skill (`/axguard-auth`, `ssrf-analysis`, etc.).
7. Hand off to `axguard audit` + focused skills.

## Evidence Requirements

Threat models are **design artifacts**, not vulns. Do not report a CVE from modeling alone.

## Remediation

Insecure design findings become backlog controls (authZ checks, allowlists, least privilege) tracked into remediation skills.

## Related Skills

`attack-surface-mapping`, `security-architecture-review`, `axguard-cso`

## Framework Mapping

- OWASP A04:2021 Insecure Design

## References

- https://owasp.org/Top10/A04_2021-Insecure_Design/

## Research Provenance

Primary: OWASP Top 10:2021 A04 (2026-09-15).  
Internal: AXGuard `/axguard-threat-model` command + CSO skill.

Attribution

awarexone

View source More from awarexone →

SSkills DirectorySkills Directory

Ship a skill? Prove it's safe.

Free 120-pattern security scan, letter grade, and an embeddable README badge.

Submit a skill

Is this your skill, or is something wrong with this listing? Request removal or report an issue. Author removals are honored within 72 hours.

Comments (0)

No comments yet. Be the first to comment!

--- name: threat-modeling description: Lightweight threat modeling for an application before deep scanning — map assets, trust boundaries, and abuse cases; feeds /axguard-audit. version: "1.0.0" author: AwareXone license: MIT domain: discovery subcategory: threat-modeling tags: [threat-model, stride, design-review] frameworks: cwe: [] owasp_top10: [A04:2021] owasp_api_top10: [] owasp_llm_top10: [] owasp_wstg: [] owasp_asvs: [] mitre_attack: [] mitre_atlas: [] nist_csf: [] nist_ai_rmf: [] related_skills: [attack-surface-mapping, security-architecture-review, security-triage] related_commands: [/axguard-threat-model, /axguard-audit, /axguard-cso] related_rules: [] references: - https://owasp.org/Top10/A04_2021-Insecure_Design/ last_reviewed: "2026-09-15" --- # Threat Modeling ## Purpose Produce a short, actionable threat model that guides which AXGuard skills and scans to run next. ## When to Use - New codebase / first audit - Major feature (auth, payments, agents, file import) - Before `/axguard-audit` on unfamiliar systems ## When Not to Use - Single-line bugfix with known sink (go straight to the class skill) ## Analysis Workflow 1. **Assets**: data, secrets, admin, money movement, model tools. 2. **Actors**: anonymous, user, admin, attacker, malicious model/tool output. 3. **Trust boundaries**: browser↔API, API↔DB, API↔cloud, agent↔tools, CI↔prod. 4. **STRIDE-lite** per boundary (spoof, tamper, repudiate, info disclosure, DoS, elevation) — keep to realistic top abuses. 5. Rank top 5 abuse cases. 6. Map each to an AXGuard command/skill (`/axguard-auth`, `ssrf-analysis`, etc.). 7. Hand off to `axguard audit` + focused skills. ## Evidence Requirements Threat models are **design artifacts**, not vulns. Do not report a CVE from modeling alone. ## Remediation Insecure design findings become backlog controls (authZ checks, allowlists, least privilege) tracked into remediation skills. ## Related Skills `attack-surface-mapping`, `security-architecture-review`, `axguard-cso` ## Framework Mapping - OWASP A04:2021 Insecure Design ## References - https://owasp.org/Top10/A04_2021-Insecure_Design/ ## Research Provenance Primary: OWASP Top 10:2021 A04 (2026-09-15). Internal: AXGuard `/axguard-threat-model` command + CSO skill.