Skill · em Proteger

regulatory-threat-model

Use when an application or system — including one built quickly with AI coding agents — needs a security review with regulatory grounding: a STRIDE threat model, a LINDDUN privacy threat model, a dependency exposure screen against live CVE / CISA-KEV / EPSS data, or a selected, non-exhaustive…

Procedência

Antes de instalar

1 arquivo · 25,3 KB · só texto, nenhum script

Instalar na sua CLI

O comando baixa a versão fixada (commit 57f899e) direto da origem, para a pasta que a CLI lê. Precisa de curl (macOS e Linux); no Windows não há comando, porque o Rook Labs é para macOS.

Claude Code

Neste projeto: instala em .claude/skills/regulatory-threat-model/.

d=".claude/skills/regulatory-threat-model"
u="https://raw.githubusercontent.com/davila7/claude-code-templates/57f899e5394bb8ca166f38eacae8f0853cbfe033/cli-tool/components/skills/security/regulatory-threat-model"
curl -fsSL --create-dirs \
  -o "$d/SKILL.md" "$u/SKILL.md"

Global: instala em ~/.claude/skills/regulatory-threat-model/.

d="$HOME/.claude/skills/regulatory-threat-model"
u="https://raw.githubusercontent.com/davila7/claude-code-templates/57f899e5394bb8ca166f38eacae8f0853cbfe033/cli-tool/components/skills/security/regulatory-threat-model"
curl -fsSL --create-dirs \
  -o "$d/SKILL.md" "$u/SKILL.md"

Codex

Neste projeto: instala em .agents/skills/regulatory-threat-model/.

d=".agents/skills/regulatory-threat-model"
u="https://raw.githubusercontent.com/davila7/claude-code-templates/57f899e5394bb8ca166f38eacae8f0853cbfe033/cli-tool/components/skills/security/regulatory-threat-model"
curl -fsSL --create-dirs \
  -o "$d/SKILL.md" "$u/SKILL.md"

Global: instala em ~/.agents/skills/regulatory-threat-model/.

d="$HOME/.agents/skills/regulatory-threat-model"
u="https://raw.githubusercontent.com/davila7/claude-code-templates/57f899e5394bb8ca166f38eacae8f0853cbfe033/cli-tool/components/skills/security/regulatory-threat-model"
curl -fsSL --create-dirs \
  -o "$d/SKILL.md" "$u/SKILL.md"

Antigravity

Neste projeto: instala em .agents/skills/regulatory-threat-model/.

d=".agents/skills/regulatory-threat-model"
u="https://raw.githubusercontent.com/davila7/claude-code-templates/57f899e5394bb8ca166f38eacae8f0853cbfe033/cli-tool/components/skills/security/regulatory-threat-model"
curl -fsSL --create-dirs \
  -o "$d/SKILL.md" "$u/SKILL.md"

Global: instala em ~/.gemini/antigravity-cli/skills/regulatory-threat-model/.

d="$HOME/.gemini/antigravity-cli/skills/regulatory-threat-model"
u="https://raw.githubusercontent.com/davila7/claude-code-templates/57f899e5394bb8ca166f38eacae8f0853cbfe033/cli-tool/components/skills/security/regulatory-threat-model"
curl -fsSL --create-dirs \
  -o "$d/SKILL.md" "$u/SKILL.md"

Peça ao Rook

Já usa o Rook Labs? Cole no chat do Rook: instale a skill https://rooklabs.sh/marketplace/cct.regulatory-threat-model

Prévia do SKILL.md

---
name: regulatory-threat-model
description: >
  Use when an application or system — including one built quickly with AI
  coding agents — needs a security review with regulatory grounding: a
  STRIDE threat model, a LINDDUN privacy threat model, a dependency
  exposure screen against live CVE / CISA-KEV / EPSS data, or a selected,
  non-exhaustive screen of which EU security obligations (GDPR, NIS2,
  Cyber Resilience Act, AI Act) may apply and which need determination.
  Orchestrates the server-enforced threat-modeling workflows of the
  Ansvar Gateway MCP connector and grounds every regulatory statement in
  officially published text fetched at answer time — scope, role, and
  application-date limits stated, never a compliance verdict. Never
  simulates a workflow and never answers legal questions from model
  memory.
license: CC-BY-4.0
metadata:
  author: Ansvar Systems AB
  connector: https://gateway.ansvar.eu/mcp
  version: "1.2"
---

# Regulatory Threat Model (STRIDE + LINDDUN)

Software gets built faster than it gets reviewed — especially software
built by prompting an AI agent. This skill turns the same agent into the
orchestrator of a real security review: a server-enforced STRIDE threat
model, a LINDDUN privacy threat model when personal data flows, a
dependency exposure screen against live vulnerability data, and a
selected, non-exhaustive screen of EU security obligations — each
obligation cited from served legal text with its scope, role, and
application-date limits stated. The deliverable is a report the user can
put in front of a customer, an auditor, or an investor — with its
sources and unresolved items visible; not a chat transcript, and not a
compliance verdict.

The threat-modeling workflows run on the Ansvar Gateway's workflow
engine, which enforces steps and quality gates server-side. The agent's
job is to feed the engine well and to ground the regulatory layer; it is
never the engine.
…

Ver todo o marketplace