Skip to main content

DevOps & Security

Threat Model Generator

Generates a STRIDE threat model from a system architecture, identifying trust boundaries, per-component threats, and a prioritized risk register with mitigations. Useful for shifting threat modeling left in the development cycle. Security-conscious engineering teams starting a new service or feature, startup CTOs preparing for SOC 2 or enterprise security reviews, and architects who want a structured security analysis as input to design review. Also useful for security engineers accelerating threat modeling across a backlog of services. Even security-aware teams defer it until late in a project — at which point the architecture is harder to change and the model produces more regret than insight. The fundamental problem is time: a full STRIDE pass takes hours of expert effort, the output format varies across teams, and the resulting document often lives in a wiki and goes stale. An AI-generated first draft flips the economics: threat modeling becomes a 15-minute review of a structured artifact rather than a four-hour workshop.

Nexus CertifiedClaude CodeCodexOpenClawGoogle Antigravity
securitythreat-modelingstridearchitecturerisk

One-Time Purchase

$19.99

Sample Output

STRIDE Threat Model — MedTrack Patient Portal

System. Patient SPA + Admin Console → API Gateway → three microservices (Auth, Records, Messaging) → shared Postgres + Redis. A Notification Worker polls Postgres and dispatches email via SendGrid.

Verdict

Two unmitigated criticals. No mTLS between the API Gateway and internal services means PHI traverses the internal network in cleartext (T-04). The Auth Service trusts an X-Internal-Role header forwarded from the gateway, which is injectable from any external caller (T-15) — a one-line role-escalation primitive. Three additional high-severity items (T-06, T-10, T-12) are inexpensive and should land alongside the criticals.

Threats by STRIDE category

Spoofing (S) — T-01, T-07, T-133
Tampering (T) — T-02, T-082
Repudiation (R) — T-03, T-142
Info Disclosure (I) — T-04, T-09, T-10, T-124
Denial of Service (D) — T-05, T-112
Elevation of Privilege (E) — T-06, T-152

Trust Boundaries

IDBoundaryBetween
TB-1Internet → DMZBrowser / Admin Console → API Gateway
TB-2DMZ → InternalAPI Gateway → Auth / Records / Messaging
TB-3Internal → Data TierServices → Postgres, Redis
TB-4Internal → External SaaSNotification Worker → SendGrid

STRIDE Threat Table

IDComponentSTRIDEThreatSeverityStatus
T-04Gateway → Records (TB-2)INo mTLS; PHI in cleartext on internal networkCriticalUnmitigated
T-15Gateway → Auth (TB-2)EAuth trusts injectable X-Internal-Role headerCriticalUnmitigated
T-06Admin Console (TB-1)EAdmin JWT scope not re-checked; no step-up MFAHighPartial
T-10Redis (TB-3)IPHI cached in plaintext; broad network reachHighUnmitigated
T-09Records ServiceISQL injection on filter paramsHighPartial (ORM, no SAST)
T-12Worker → SendGrid (TB-4)IHardcoded SMTP credentialsHighUnmitigated
T-13Worker → DBSForged notification via direct queue writeMediumUnmitigated
T-07Auth ServiceSCredential stuffing on /loginMediumPartial
T-01Browser → Gateway (TB-1)SForged/stolen JWTMediumMitigated
T-08Postgres (TB-3)TOverprivileged service accountsMediumUnmitigated
T-03API GatewayRNo audit trail tying calls to identityMediumUnmitigated
T-14Messaging ServiceRClinician messages not tamper-evidentLowUnmitigated
T-05API GatewayDUnauthenticated DDoSLowMitigated
T-11Redis (TB-3)DMemory exhaustion / cache poisoningLowPartial
T-02Browser → Gateway (TB-1)TIn-transit tamperingLowMitigated

Top-3 Threats

T-04 — mTLS gap

PHI cleartext on internal RPC

Severity Critical · Effort Medium

STRIDE: Info DisclosureI
BoundaryTB-2
Time to mitigatequarter
service meshrequired investment

T-15 — header injection

X-Internal-Role spoofable

Severity Critical · Effort Low

STRIDE: Elevation of PrivilegeE
BoundaryTB-2
Time to mitigatehours
strip headersrequired fix

T-15 detail

The API Gateway forwards X-Internal-Role to the Auth Service. The gateway does not strip client-supplied versions of that header — any external caller can include X-Internal-Role: admin and have it propagated. Fix today: add a header-allowlist at gateway ingress and strip every X-Internal-* header before forwarding. This is a config change, not a code change.


Mitigation Coverage

Quick wins (≤ 1 sprint)

Strip `X-Internal-*` headers at gateway ingressT-15
Move SendGrid credentials into secrets manager + quarterly rotationT-12
Encrypt PHI values before `SET` into Redis; tighten Redis network policyT-10
Replace Worker DB write access with a read-only `notifications_queue` viewT-13
Add SAST parameterized-query rule to CIT-09

Architectural (next quarter)

mTLS via service mesh (Istio / Linkerd) on TB-2T-04
Per-service Postgres roles with schema-level GRANTsT-08
Immutable audit log to SIEM with WORM retentionT-03 / T-14
Step-up MFA for Admin Console via OIDC ACR claimsT-06
Split Redis: one instance for sessions, one for cacheT-11

Residual Risk

After quick wins land

Five quick wins close T-09, T-10, T-12, T-13, and T-15. Residual criticals: T-04 (mTLS) remains open until the service-mesh rollout. Plan a compensating control in the meantime — at minimum, force all inter-service traffic through a single VPC peer with a network policy that denies cross-namespace traffic.

Open questions blocking full coverage

Six components were underspecified — the model cannot close until these resolve: API Gateway vendor (affects T-05/T-15 plugin options), Auth Service SSO federation support (introduces IdP-spoofing class not modeled), Notification Worker runtime (Lambda vs container changes the T-13 attack surface), Postgres managed vs self-hosted (patch ownership), Redis cluster mode with AUTH, and whether the Admin Console shares a domain with the patient portal (CSRF cross-contamination).


Model is a structured first draft against a hypothetical patient-portal architecture. Treat as input to a 15-minute review with the team owning each component, not as a finished artifact.

This sample illustrates the skill's output format. Names, metrics, and operational details are illustrative unless the artifact explicitly analyzes public information.

View full sample →

All sales final. No refunds on digital products.

Includes support for Claude Code, Codex, OpenClaw, and Google Antigravity in the same license.

Also in Security Scanning

Bundle price: $55. Compare this skill with the full workflow bundle or Pro access.

Best for

Engineering teams starting a new service or significant feature who want a STRIDE first-draft they can review in 15 minutes instead of running a four-hour workshop, and startup CTOs assembling threat-modeling evidence for SOC 2 or enterprise security review. Especially valuable when threat modeling tends to get deferred until late, when the architecture is harder to change.

Not ideal for

Adversarial high-stakes systems (cryptocurrency custody, election infrastructure, safety-critical control systems) where the threat model must be authored by a specialist and reviewed against documented adversary capabilities. Also a poor fit for systems where the architecture is genuinely novel and a generic STRIDE pass would miss the threats specific to the design.

Included in this purchase

  • Claude Code, Codex, OpenClaw, and Google Antigravity skill files.
  • Setup guidance for the right adapter in your workspace.
  • One-time license for the purchased skill version.

Setup

Plan for a short setup in the repository or workspace where the skill will run. Some coding familiarity helps for implementation-heavy outputs.

Claude CodeCodexOpenClawGoogle Antigravity

Related Skills

Incident Response
Outage Response Playbook
Generates structured, role-clear incident response playbooks for specific failure scenarios. Covers detection through resolution and post-mortem — ready to use when an incident actually happens.
Claude CodeCodexOpenClawGoogle Antigravity
outage-responsereliabilityrunbooks

$19.99

One-time license

View Skill
Incident Response
Incident Postmortem Writer
Generates a structured blameless postmortem from incident timelines, alerts, and deploy logs with root cause analysis, impact assessment, and owned action items. Useful for producing first-draft postmortems under operational pressure.
Claude CodeCodexOpenClawGoogle Antigravity
postmortemsincident-responseoperations

$19.99

One-time license

View Skill
Security Scanning
OWASP Top 10 Scanner
Scans code for OWASP Top 10 vulnerability patterns including injection, XSS, IDOR, and insecure deserialization with severity ratings and remediation snippets. Useful for pre-commit security checks and enterprise compliance.
Claude CodeCodexOpenClawGoogle Antigravity
securityowaspvulnerabilities

$19.99

One-time license

View Skill

Future Updates

This purchase includes the current version of the skill. If you want future adapter updates — meaning compatibility and packaging updates as supported platforms evolve — plus new catalog additions included automatically, upgrade to Pro.

Upgrade to Pro