threat-modeling-with-aws-security-agent

Name: threat-modeling-with-aws-security-agent
Author: aws

252installs190forks

How to install threat-modeling-with-aws-security-agent?

aws/agent-toolkit-for-aws/threat-modeling-with-aws-security-agent

$npx -y skills add aws/agent-toolkit-for-aws --skill threat-modeling-with-aws-security-agent

Installs into the current project.

Summary

Run an AWS Security Agent threat model review on spec/design documents. Use when the user asks to review a spec for security, run a threat model, check if a design introduces security risks, review requirements.md or design.md for security posture changes, or STRIDE analysis.

Files · 1

View on GitHub

SKILL.md

1	# AWS Security Agent — Threat Model Review
2
3	Analyze spec documents (`requirements.md`, `design.md`) against the source code to identify security-posture changes using STRIDE methodology. No prior scan needed.
4
5	## Local state
6
7	Read `.security-agent/config.json` for `agent_space_id` and `region`. If missing, run the `setup-security-agent` workflow inline first.
8
9	### Resolving the values you need
10
11	\| Placeholder \| How to resolve \|
12	\|-------------\|----------------\|
13	\| `<id>` (agent space) \| `config.agent_space_id` \|
14	\| `<region>` \| `config.region` (default `us-east-1`) \|
15	\| `<account>` \| `aws sts get-caller-identity --query Account --output text` \|
16	\| `<role-arn>` \| `arn:aws:iam::<account>:role/SecurityAgentScanRole` \|
17	\| `<bucket>` \| `security-agent-scans-<account>-<region>` \|
18
19	---
20
21	## Workflow
22
23	1. Pre-checks. Read config, verify agent space, resolve values.
24
25	2. Collect spec files. Identify the `requirements.md` and/or `design.md` the user is working on. Use absolute paths. Ask if unclear which files to review.
26
27	3. Zip the workspace (same exclusions as code scan):
28
29	```bash
30	cd <absolute-workspace-path>
31	zip -r /tmp/source.zip . \
32	-x ".git/" -x ".security-agent/" -x "node_modules/*" \
33	-x "__pycache__/" -x ".venv/" -x "venv/*" \
34	-x "dist/" -x "build/" -x "target/*" \
35	-x ".mypy_cache/" -x ".pytest_cache/" -x ".tox/*" \
36	-x ".next/" -x "cdk.out/" -x ".DS_Store" -x "*.pyc"
37	```
38
39	4. Upload source zip:
40
41	```bash
42	SCAN_ID="tm-$(date +%s)-$(openssl rand -hex 3)"
43	WORKSPACE_ID=$(printf '%s' "$(pwd)" \| md5sum \| cut -c1-12)
44	aws s3 cp /tmp/source.zip s3://<bucket>/security-scans/source/${WORKSPACE_ID}/source.zip
45	```
46
47	5. Upload spec files:
48
49	```bash
50	aws s3 cp /path/to/requirements.md s3://<bucket>/security-scans/threat-models/${SCAN_ID}/specs/requirements.md
51	aws s3 cp /path/to/design.md s3://<bucket>/security-scans/threat-models/${SCAN_ID}/specs/design.md
52	```
53
54	6. Create threat model:
55
56	```bash
57	aws securityagent create-threat-model --agent-space-id <id> --title <title> \
58	--service-role <role-arn> \
59	--assets sourceCode=[{s3Location=s3://<bucket>/security-scans/source/${WORKSPACE_ID}/source.zip}] \
60	--scope-docs '[{"s3Location":"s3://<bucket>/security-scans/threat-models/'${SCAN_ID}'/specs/requirements.md"},{"s3Location":"s3://<bucket>/security-scans/threat-models/'${SCAN_ID}'/specs/design.md"}]'
61	```
62
63	Capture `threatModelId`.
64
65	7. Start threat model job:
66
67	```bash
68	aws securityagent start-threat-model-job --agent-space-id <id> --threat-model-id <tm-id>
69	```
70
71	Capture `threatJobId`.
72
73	8. Persist to `scans.json` with `scan_type: "THREAT_MODEL"`.
74
75	9. Tell user: "Threat model review started. Runtime varies with workspace size. I'll check every 2 minutes — say 'stop polling' to opt out."
76
77	10. Poll every 2 minutes:
78
79	```bash
80	aws securityagent batch-get-threat-model-jobs --agent-space-id <id> --threat-model-job-ids <tj-id>
81	```
82
83	Only respond when status changes.
84
85	11. On COMPLETED → fetch threats:
86
87	```bash
88	aws securityagent list-threats --agent-space-id <id> --threat-job-id <tj-id>
89	```
90
91	If `nextToken`, paginate with `--next-token`.
92
93	## Findings presentation
94
95	Each threat includes: `statement`, `severity`, `stride` category, `threatImpact`, `recommendation`, `impactedAssets`.
96
97	```
98	🟣 CRITICAL: {statement}
99	STRIDE: {stride}
100	Impact: {threatImpact}
101	Assets: {impactedAssets}
102	Recommendation: {recommendation}
103
104	🔴 HIGH: {statement}
105	...
106	```
107
108	Write full report to `.security-agent/findings-{scan_id}.md`. Call out any threat that represents a regression from the prior design.
109
110	---
111
112	## Rules
113
114	- Threat model reviews are standalone — no prior scan needed
115	- Poll every 2 minutes, not faster
116	- At least one spec file is required
117	- Use absolute paths for workspace and spec files
118	- Title: `threat-model-<feature-name>` (no spaces)

People who liked this also viewed

6 picks

Type

threat-modeling-with-aws-security-agent

252installs190forks

View on GitHub

How to install threat-modeling-with-aws-security-agent?

aws/agent-toolkit-for-aws/threat-modeling-with-aws-security-agent

$npx -y skills add aws/agent-toolkit-for-aws --skill threat-modeling-with-aws-security-agent

Installs into the current project.

Summary

Files · 1

View on GitHub

SKILL.md

1	# AWS Security Agent — Threat Model Review
2
3	Analyze spec documents (`requirements.md`, `design.md`) against the source code to identify security-posture changes using STRIDE methodology. No prior scan needed.
4
5	## Local state
6
7	Read `.security-agent/config.json` for `agent_space_id` and `region`. If missing, run the `setup-security-agent` workflow inline first.
8
9	### Resolving the values you need
10
11	\| Placeholder \| How to resolve \|
12	\|-------------\|----------------\|
13	\| `<id>` (agent space) \| `config.agent_space_id` \|
14	\| `<region>` \| `config.region` (default `us-east-1`) \|
15	\| `<account>` \| `aws sts get-caller-identity --query Account --output text` \|
16	\| `<role-arn>` \| `arn:aws:iam::<account>:role/SecurityAgentScanRole` \|
17	\| `<bucket>` \| `security-agent-scans-<account>-<region>` \|
18
19	---
20
21	## Workflow
22
23	1. Pre-checks. Read config, verify agent space, resolve values.
24
25	2. Collect spec files. Identify the `requirements.md` and/or `design.md` the user is working on. Use absolute paths. Ask if unclear which files to review.
26
27	3. Zip the workspace (same exclusions as code scan):
28
29	```bash
30	cd <absolute-workspace-path>
31	zip -r /tmp/source.zip . \
32	-x ".git/" -x ".security-agent/" -x "node_modules/*" \
33	-x "__pycache__/" -x ".venv/" -x "venv/*" \
34	-x "dist/" -x "build/" -x "target/*" \
35	-x ".mypy_cache/" -x ".pytest_cache/" -x ".tox/*" \
36	-x ".next/" -x "cdk.out/" -x ".DS_Store" -x "*.pyc"
37	```
38
39	4. Upload source zip:
40
41	```bash
42	SCAN_ID="tm-$(date +%s)-$(openssl rand -hex 3)"
43	WORKSPACE_ID=$(printf '%s' "$(pwd)" \| md5sum \| cut -c1-12)
44	aws s3 cp /tmp/source.zip s3://<bucket>/security-scans/source/${WORKSPACE_ID}/source.zip
45	```
46
47	5. Upload spec files:
48
49	```bash
50	aws s3 cp /path/to/requirements.md s3://<bucket>/security-scans/threat-models/${SCAN_ID}/specs/requirements.md
51	aws s3 cp /path/to/design.md s3://<bucket>/security-scans/threat-models/${SCAN_ID}/specs/design.md
52	```
53
54	6. Create threat model:
55
56	```bash
57	aws securityagent create-threat-model --agent-space-id <id> --title <title> \
58	--service-role <role-arn> \
59	--assets sourceCode=[{s3Location=s3://<bucket>/security-scans/source/${WORKSPACE_ID}/source.zip}] \
60	--scope-docs '[{"s3Location":"s3://<bucket>/security-scans/threat-models/'${SCAN_ID}'/specs/requirements.md"},{"s3Location":"s3://<bucket>/security-scans/threat-models/'${SCAN_ID}'/specs/design.md"}]'
61	```
62
63	Capture `threatModelId`.
64
65	7. Start threat model job:
66
67	```bash
68	aws securityagent start-threat-model-job --agent-space-id <id> --threat-model-id <tm-id>
69	```
70
71	Capture `threatJobId`.
72
73	8. Persist to `scans.json` with `scan_type: "THREAT_MODEL"`.
74
75	9. Tell user: "Threat model review started. Runtime varies with workspace size. I'll check every 2 minutes — say 'stop polling' to opt out."
76
77	10. Poll every 2 minutes:
78
79	```bash
80	aws securityagent batch-get-threat-model-jobs --agent-space-id <id> --threat-model-job-ids <tj-id>
81	```
82
83	Only respond when status changes.
84
85	11. On COMPLETED → fetch threats:
86
87	```bash
88	aws securityagent list-threats --agent-space-id <id> --threat-job-id <tj-id>
89	```
90
91	If `nextToken`, paginate with `--next-token`.
92
93	## Findings presentation
94
95	Each threat includes: `statement`, `severity`, `stride` category, `threatImpact`, `recommendation`, `impactedAssets`.
96
97	```
98	🟣 CRITICAL: {statement}
99	STRIDE: {stride}
100	Impact: {threatImpact}
101	Assets: {impactedAssets}
102	Recommendation: {recommendation}
103
104	🔴 HIGH: {statement}
105	...
106	```
107
108	Write full report to `.security-agent/findings-{scan_id}.md`. Call out any threat that represents a regression from the prior design.
109
110	---
111
112	## Rules
113
114	- Threat model reviews are standalone — no prior scan needed
115	- Poll every 2 minutes, not faster
116	- At least one spec file is required
117	- Use absolute paths for workspace and spec files
118	- Title: `threat-model-<feature-name>` (no spaces)

People who liked this also viewed

6 picks

Type