testland/stride-threat-modeling
Use when a design, story or architecture sketch touching login, user data, payments, file uploads or an external integration is about to be built with no threat model. Walks assets and trust boundaries through Microsoft's STRIDE categories, triages threats and writes the threat model into the repo.
86%
Does it follow best practices?
Run evals on this skill
Adds up to 20 points to the overall score
Low
Low-risk findings worth noting
W011: Third-party content exposure detected (indirect prompt injection risk).
What this means
The skill exposes the agent to untrusted, user-generated content from public third-party sources, creating a risk of indirect prompt injection. This includes browsing arbitrary URLs, reading social media posts or forum comments, and analyzing content from unknown websites.
Why it was flagged
The skill reads specs from supplied local paths or URLs when performing threat modeling, which can include outsider-authored text if an arbitrary URL is provided.
- Audited
- Security analysis