threat-modeling-with-aws-security-agent
Run an AWS Security Agent threat model review on spec/design documents. Use when the user asks to review a spec for security, run a threat model, check if a design introduces security risks, review requirements.md or design.md for security posture changes, or STRIDE analysis.
By aws · 1,165 installs
npx skills add aws/agent-toolkit-for-aws --skill threat-modeling-with-aws-security-agent
Source repository · Upstream listing
AWS Security Agent — Threat Model Review
Analyze spec documents ( requirements.md , design.md ) against the source code to identify security posture changes using STRIDE methodology. No prior scan needed.
Local state
Read .security agent/config.json for agent space id and region . If missing, run the setup security agent workflow inline first.
Resolving the values you need
Placeholder How to resolve
<id (agent space) config.agent space id
<region config.region (default us east 1 )
<account aws sts get caller identity query Account output text
<role arn arn:aws:iam::<account :role/SecurityAgentScanRole
<bucket security agent scans <account <region
Workflow
1. Pre checks. Read config, verify agent space, resolve values.
2. Collect spec files. Identify the requirements.md and/or design.md the user is working on. Use absolute paths. Ask if unclear which files to review.
3. Zip the workspace (same exclusions as code scan):
4. Upload source zip:
5. Upload spec files:
6. Create threat model:
Capture threatModelId .
7. Start threat model job:
Capture threatJobId .
8. Persist to scans.json with scan type: "THREAT MODEL" .
9. Tell user: "Threat model review started. Runtime varies with workspace size. I'll check every 2 minutes — say 'stop polling' to opt out."
10. Poll every 2 minutes:
Only respond when status changes.
11. On COMPLETED → fetch threats:
If nextToken , paginate with next token .
Findings presentation
Each threat includes: statement , severity , stride category, threatImpact , recommendation , impactedAssets .
Write full report to .security agent/findings {scan id}.md . Call out any threat that represents a regression from the prior design.
Rules
Threat model reviews are standalone — no prior scan needed
Poll every 2 minutes, not faster
At least one spec file is required
Use absolute paths for workspace and spec files
Title: threat model <feature name (no spaces)