skilld
All skills
bitwarden avatar

/threat-modeling

@d5bc17c official
by bitwardenbitwarden/ai-plugins155 stars
20

This skill should be used when the user asks to "create a threat model", "define security goals", "generate a data flow diagram", "write security definitions", "perform an initial security assessment", or needs to produce threat model artifacts for new features or architecture changes.

Ask your Agent

Use this Skill: https://skilld.dev/gh/bitwarden/ai-plugins/threat-modeling

This session only. Nothing lands on disk.

examplesdata-flow-diagram.md

≈204 tokens on demand. Your agent reads this file only when SKILL.md points to it.

Data Flow Diagram Template

Use Mermaid syntax for text-based DFDs that can be version-controlled.

Bitwarden is moving toward a Structurizr-based approach for persistent architecture diagrams. For ad-hoc threat modeling, Mermaid or Excalidraw are acceptable.

Example

graph LR
    subgraph Trust Boundary: Client
        A[Browser Extension] --> B[Client SDK]
    end

    subgraph Trust Boundary: Network
        B -->|TLS| C[API Gateway]
    end

    subgraph Trust Boundary: Server
        C --> D[Identity Service]
        C --> E[API Service]
        E --> F[(Database)]
        E --> G[Key Management]
    end

    style A fill:#e1f5fe
    style F fill:#fff3e0

Required Elements

Include: components, data stores, external entities, data flows with protocols, and trust boundaries.

Source: SKILL.md on GitHub

Third-party checks

No alerts14d3 checks · Risk SAFE
  • Gen Agent Trust Hub14d

    The threat-modeling skill is a documentation-focused framework for performing security assessments using Bitwarden's internal standards. It adheres to secure coding practices and Bitwarden's security principles, posing no risk of code execution, data exfiltration, or malicious persistence.

  • Socket14d

    No alerts

  • Snyk14d

    Risk: LOW · No issues

Provenance

Signed by skilld at d5bc17c. This ties the file your Agent reads to that commit on GitHub. It does not review the instructions.

Last checked against GitHub yesterday.

Activeupdated 2 months ago

Topics

  • Security
  • threat-modeling
  • stride
  • data-flow-diagrams
  • security-definitions
  • architecture
  • appsec
  • risk-assessment

README badge

README badge for bitwarden/ai-plugins/threat-modeling

What it does

Guides engineering teams through creating threat models, data flow diagrams, and security definitions for new features or architecture changes using Bitwarden's 4-phase engagement model. Focuses on Phase 1 activities (STRIDE-based threat identification, security goal definition) and provides templates for documenting attacker capabilities, security guarantees, and current implementation gaps.

Generated from the current SKILL.md.

Frequently asked

Does this skill generate STRIDE threat models?
The skill uses STRIDE as a framework for structured threat identification during Phase 1 (Initial Security Assessment), but its primary output is Bitwarden's Security Definitions format, which combines threat model, security goals, and accepted goal status into a single construct.
Can this skill work with existing systems or only new features?
The skill supports both greenfield projects and architecture changes. It is designed for Phase 1 (engineering-owned initial assessment) and can assist with threat modeling for new features, services, or modifications to data sharing and IPC channels.
When should I involve the AppSec team using this skill?
Perform an Initial Security Assessment using this skill first. Escalate to AppSec (#team-eng-appsec) for greenfield projects, data sharing modifications, new IPC channels, cross-domain functionality, or if you are uncertain about security implications after assessment.
What artifact formats does this skill produce?
The skill generates Security Definition documents (markdown), data flow diagrams (Mermaid, Excalidraw, or Structurizr), and threat catalogs with mitigation tracking. Templates are provided for each artifact type.
Does this skill create security definitions aligned with specific principles?
Yes. Security goals must align with Bitwarden's security principles (P01–P06), and each goal requires a rationale stating which principle it enforces, what asset it protects, and the user-visible harm if violated.

Generated from the current SKILL.md. These answers refresh after source changes.