Skill UI

Delivers repository-grounded AppSec threat models that map components, boundaries, assets, entry points, and attacker capabilities to abuse paths, along with prioritized mitigations tailored to codebase evidence and explicit assumptions.

A comprehensive toolkit for professional security engineers. It covers the entire security lifecycle, including systematic threat modeling using STRIDE, designing secure architectures based on Zero Trust and Defense-in-Depth, conducting detailed vulnerability assessments (SAST/DAST), and implementing secure coding practices. Ideal for security audits, compliance reviews, and building resilient systems.

Automates SIEM rule generation within advanced security workflows, guiding through industry best practices, compliance checks, and threat modeling to deliver production-ready configurations verified against common standards.

This skill provides a structured approach to systematically identify security threats by applying the STRIDE methodology (Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, Elevation of Privilege). It is crucial for conducting thorough threat modeling sessions, analyzing system architectures, reviewing security design decisions, and creating robust security documentation for compliance and auditing purposes.

Automates threat modeling guidance within Security Advanced: step-by-step best practices, compliance-ready code, and validation for enterprise security workflows.

A specialized skill for conducting comprehensive security architecture reviews, risk assessments, and threat identification. It masters advanced methodologies like STRIDE, PASTA, and attack tree construction. Use this to build secure-by-design systems, identify potential attack vectors, and strengthen system resilience before deployment.

Automates zero trust configuration support for advanced security operations, offering guidance, code/config generation, and validation whenever zero trust config helper topics arise during penetration testing, compliance, or threat modeling workflows.

Outlines principles and practices for building secure contracts, covering threat modeling, vulnerability mitigation, and deployment readiness to help teams reduce risk when launching automated agreements.

Functions as a Chief Security Architect assistant that performs STRIDE/PASTA threat modeling, OWASP checks, Red/Blue team simulations and incident response playbooks to harden any project before production.

Framework for planning red team operations, covering scope, rules of engagement, threat modeling, operational timelines, and documentation to ensure safe, realistic adversary simulations aligned with organizational objectives.

Implements MITRE ATT&CK-based threat modeling to map adversary TTPs, evaluate detection coverage, and prioritize defensive investments for SOCs, new environments, purple team exercises, and risk assessments.

This guide details how to use OWASP Threat Dragon, an open-source tool, for comprehensive threat modeling. It enables security teams and developers to create data flow diagrams (DFD), identify potential vulnerabilities using standard methodologies like STRIDE and LINDDUN, and generate detailed threat reports. It is crucial for secure design review, risk assessment, and continuous security validation in DevSecOps pipelines.