Regulatory Threat Model

Use when an application or system — including one built quickly with AI coding agents — needs a security review with regulatory grounding: a STRIDE threat model, a LINDDUN privacy threat model, a dependency exposure screen against live CVE / CISA-KEV / EPSS data, or a selected, non-exhaustive screen of which EU security obligations (GDPR, NIS2, Cyber Resilience Act, AI Act) may apply and which need determination. Orchestrates the server-enforced threat-modeling workflows of the Ansvar Gateway MCP connector and grounds every regulatory statement in officially published text fetched at answer ti

1 starsSecurity

Install

skills CLI (Claude Code, Cursor, Codex and more)

npx skills add Ansvar-Systems/regulatory-threat-model-skill --skill regulatory-threat-model

Manual install

git clone --depth 1 https://github.com/Ansvar-Systems/regulatory-threat-model-skill.git /tmp/regulatory-threat-model-skill
mkdir -p ~/.claude/skills
cp -r /tmp/regulatory-threat-model-skill/. ~/.claude/skills/regulatory-threat-model

Personal skills live in ~/.claude/skills. Use .claude/skills in a project folder to share a skill with your team.

From the SKILL.md

# Regulatory Threat Model (STRIDE + LINDDUN)

Software gets built faster than it gets reviewed — especially software
built by prompting an AI agent. This skill turns the same agent into the
orchestrator of a real security review: a server-enforced STRIDE threat
model, a LINDDUN privacy threat model when personal data flows, a
dependency exposure screen against live vulnerability data, and a
selected, non-exhaustive screen of EU security obligations — each
obligation cited from served legal text with its scope, role, and
application-date limits stated. The deliverable is a report the user can
put in front of a customer, an auditor, or an investor — with its
sources and unresolved items visible; not a chat transcript, and not a
compliance verdict.

The threat-modeling workflows run on the Ansvar Gateway's workflow
engine, which enforces steps and quality gates server-side. The agent's
job is to feed the engine well and to ground the regulatory layer; it is
never the engine.

## Requirements

- The **Ansvar Gateway** MCP connector must be connected:
  `https://gateway.ansvar.eu/mcp` (OAuth 2.1 with Dynamic Client
  Registration; signup at https://ansvar.eu). Works in MCP-capable
  agents (Claude, ChatGPT, Microsoft Copilot, Gemini and others — see
  the setup guides at https://ansvar.eu/setup for exact supported
  surfaces and prerequisites per client).
- Tools this skill uses on every plan: `get_my_capabilities`,

Read the full skill on GitHub

Details

Skill name: regulatory-threat-model
Repository: Ansvar-Systems/regulatory-threat-model-skill
Repo updated: 16 August 2026
Listed in: karanb192/awesome-claude-skills

FAQ

What does the Regulatory Threat Model skill do?

How do I install the Regulatory Threat Model skill?

skills CLI (Claude Code, Cursor, Codex and more): npx skills add Ansvar-Systems/regulatory-threat-model-skill --skill regulatory-threat-model. Skills go in ~/.claude/skills (personal) or .claude/skills (project), and Claude loads them automatically when a task matches the description.

Is Regulatory Threat Model popular?

It lives in Ansvar-Systems/regulatory-threat-model-skill, which has 1 GitHub stars and 0 forks, and is included in 1 curated skill list.

Related skills

Awesome Bug Bounty

YangTech-gh/Awesome-Bug-Bounty

Use when doing bug bounty hunting, vulnerability research, security report writing/analysis, payload or WAF-bypass selection, business logic / IDOR / race / API testing, recon methodology, tool choice (Burp vs Caido vs ZAP, AI pentest agents, MCP security testing, headless browsers), or looking up writeups/programs — e.g. "find XSS payload", "business logic checklist", "SSRF bypass", "HackerOne top reports", "bug bounty methodology", "which tools to install". Merges curated knowledge with source-repo fallbacks; authorized testing only.

SecurityIn 1 list

Incident Reporting Navigator

Ansvar-Systems/incident-reporting-navigator-skill

Use when a security incident, data breach, or actively exploited vulnerability raises the question "who must we notify, where, and by when?" Screens one incident across the EU reporting regimes — NIS2, GDPR, DORA, and the Cyber Resilience Act — determines which duties fire for each involved entity's roles, resolves the receiving authority per regime and member state from served national law, and produces a deadline table in which every duty, authority, and deadline is cited from official publisher text fetched live through the Ansvar Gateway MCP connector. Never answers from model memory.

SecurityIn 1 list

Cra Vulnerability Obligations

Ansvar-Systems/cra-vulnerability-obligations-skill

Use when a user asks what the EU Cyber Resilience Act (CRA) means for their product, whether and when they must report a vulnerability or incident, or what a specific CVE triggers legally. Maps a product with digital elements to CRA scope, product classification, Annex I vulnerability-handling duties, and Article 14 reporting obligations — every legal claim cited from official regulation text fetched live through the Ansvar Gateway MCP connector, joined with live CVE / CISA-KEV / EPSS vulnerability intelligence from the same connector.

SecurityIn 1 list

Deep Security Check

give-jd/deep-security-check

Use when the user asks for a defensive security assessment, security audit, vulnerability scan, or "how safe / how reliable is this code/project/repo". Runs Semgrep (SAST), osv-scanner (dependency CVEs) and gitleaks (secrets) against a local project, then produces a report with a reproducible reliability grade (0-100, A-F). Defensive only — finds weaknesses in code you own; it does not exploit, attack, or test remote targets.

SecurityIn 1 list

Requirement Zero

Chisanan232/requirement-zero

Challenge whether a requirement deserves to exist before planning or implementing it. Use when a request asks to build, add, or design something and its necessity or scope has not been established — new features, abstractions, plugin systems, dashboards, configurability, migrations, or "we should probably support X". Reaches an explicit verdict: DELETE, REDUCE, DEFER, BUILD, or BUILD HARD. Do not use for already-validated work, bug fixes, or explicit safety, security, legal, or compliance requirements.

SecurityIn 1 list

Deep Security Audit

ravindrakele/claude-skills

Deep, multi-agent security audit of a codebase — WordPress plugin, Laravel, Next.js, Node/Express, Django/Rails, or any app. Detects the framework, maps the REAL attack surface (routes, handlers, auth, sinks), then fans out scoped finder agents that READ and understand the code (not just grep), adversarially verifies every finding (proves the guard is genuinely absent + traces reachability), scores honest CVSS 3.1, dedupes, and produces a ranked report. Use whenever the user asks to find security issues / vulnerabilities, run a security audit or pentest, "is this secure", "scan this plugin/app

SecurityIn 1 list

Browse the most popular Claude skills, all security skills, or write your own with the skills generator.