Interactive Threat Modeling Assistant

Open
  • Is something wrong?
#60 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty
5/5
Estimated time
Over a week
Newbie friendliness
25/100
Issue type
Feature
Clarity
Needs clarification
Activity status
Stale
Tech stack
typescript
Domain
cli, security

Research direction

Start by reading the original proposal in issue #34 and the current issue's open question about integrating with /security:analyze. Identify the existing command entry points and generation flow before deciding whether this is a separate /security:threat-model command. Done should include an interactive threat-modeling flow that produces THREAT_MODEL.md and clearly supports the intended analysis workflow.

Written by the indexing model from the issue text.

Description

Introduce a new interactive command /security:threat-model, to help developers think through potential threats before or during development. This would generate a THREAT_MODEL.md at the end, as originally proposed in https://github.com/gemini-cli-extensions/security/issues/34

This command would guide the developer through a simplified threat modeling exercise, such as:

  1. The developer runs /security:threat-model.

  2. The CLI asks a series of questions about the feature being built, such as:
    "Briefly describe the new feature or change."
    "What new data are you collecting or processing?"
    "Does this feature involve authentication or authorization?"
    "Does it interact with any external APIs or services?"

  3. Based on the answers, it generates a mini threat model, outlining potential threats (using a framework like STRIDE: Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, Elevation of Privilege), and suggests specific mitigations the developer should consider.

  4. The THREAD_MODEL.md could be used to help the /security:analyze scan to find the correct vulnerabilities or go after specific risks.

Open question: instead of a separate command, should this be incorporated into the /security:analyze?

Dominant language
TypeScript
Stars
793
Forks
60
No merged PRs in 30d

Getting set up

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from gemini-cli-extensions/security

All issues in gemini-cli-extensions/security

Similar issues

More TypeScript issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.