Setup & Installation
Or with the ClawHub CLI, for registry-managed skill folders outside a full OpenClaw workspace:
What This Skill Does
Structured threat modeling using STRIDE, PASTA, attack trees, and DREAD/CVSS scoring to identify and prioritize security risks in system designs. Covers application, network, infrastructure, and human attack layers. Produces documented threat models with mitigations and a record of accepted residual risks.
Automated scanners find known vulnerabilities but miss trust boundary violations, insider threats, and logic flaws that structured threat modeling with STRIDE and attack trees catches.
When to use it
- Reviewing a new microservices architecture before deployment
- Preparing security documentation for an upcoming audit
- Identifying attack vectors in a third-party API integration
- Prioritizing which vulnerabilities to remediate first
- Running a threat modeling session with a development team
Example Workflow
Here's how your AI assistant might use this skill in practice.
User asks: Can you threat model our new customer payment API?
- 1Define scope, assets, and trust boundaries for the payment API
- 2Generate a data flow diagram covering user, API gateway, backend, and payment processor
- 3Apply STRIDE analysis across each component and data flow
- 4Build attack trees for the highest-risk goals such as credential theft and transaction tampering
- 5Score threats using DREAD and produce a prioritized mitigation table
A structured threat model document with a DFD, completed STRIDE table, ranked threat list with DREAD scores, recommended controls, and documented residual risks