[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill-aws-labs-threat-designer":3,"mdc--x6v40m-key":46,"related-repo-aws-labs-threat-designer":3477,"related-org-aws-labs-threat-designer":3486},{"slug":4,"name":5,"fn":6,"description":7,"org":8,"tags":13,"stars":27,"repoUrl":28,"updatedAt":29,"license":30,"forks":31,"topics":32,"repo":41,"sourceUrl":44,"mdContent":45},"threat-designer","Threat Designer","run threat-model-driven security reviews","Run a threat-model-driven security review of the current repository using the threat-designer CLI. Analyzes the codebase, generates an architecture diagram, runs STRIDE-based threat modeling, and produces an actionable tasks.md with security findings.",{"slug":9,"name":10,"logoUrl":11,"githubOrg":12},"aws-labs","AWS Labs","https:\u002F\u002Fpexgzepcugksgbtrxkhf.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Forg-logos\u002Faws-labs.png","awslabs",[14,18,21,24],{"name":15,"slug":16,"type":17},"Security","security","tag",{"name":19,"slug":20,"type":17},"Threat Modeling","threat-modeling",{"name":22,"slug":23,"type":17},"AWS","aws",{"name":25,"slug":26,"type":17},"Code Analysis","code-analysis",267,"https:\u002F\u002Fgithub.com\u002Fawslabs\u002Fthreat-designer","2026-07-12T08:37:14.772466",null,46,[33,34,35,36,37,20,38,39,40],"agentic-ai","appsec","cybersecurity","devsecops","generativeai","threat-modeling-tool","threatmodeling","threatmodelling",{"repoUrl":28,"stars":27,"forks":31,"topics":42,"description":43},[33,34,35,36,37,20,38,39,40],"Threat Designer is a GenerativeAI application designed to automate and streamline the threat modeling process for secure system design.","https:\u002F\u002Fgithub.com\u002Fawslabs\u002Fthreat-designer\u002Ftree\u002FHEAD\u002Fcli\u002Fkiro\u002Fskill","---\nname: \"Threat Designer\"\ndescription: \"Run a threat-model-driven security review of the current repository using the threat-designer CLI. Analyzes the codebase, generates an architecture diagram, runs STRIDE-based threat modeling, and produces an actionable tasks.md with security findings.\"\n---\n\n# Threat Designer — Security Review\n\nPerform a threat-model-driven security review of the current repository.\n\n## Step 0 — Gather configuration from the user\n\n**You cannot receive arguments via this skill invocation.** Before doing any work, ask the user to provide the following options. Present this table and ask them to specify any overrides — anything not specified uses the default.\n\n| Option             | Default     | Description                                                                                               |\n| ------------------ | ----------- | --------------------------------------------------------------------------------------------------------- |\n| **model**          | _(not set)_ | Use an existing threat model ID — skip generating a new one                                               |\n| **min-likelihood** | `medium`    | Remove threats below this likelihood: `high` \u002F `medium` \u002F `low`                                           |\n| **stride**         | _(all)_     | Comma-separated STRIDE filter (e.g. `Spoofing,Tampering`)                                                 |\n| **effort**         | `medium`    | Reasoning effort for threat modeling: `off` \u002F `low` \u002F `medium` \u002F `high` \u002F `max`                           |\n| **iterations**     | `0` (Auto)  | Number of modeling iterations; `0` = agent decides                                                        |\n| **app-type**       | `hybrid`    | Application exposure: `public` \u002F `internal` \u002F `hybrid`                                                    |\n| **scope**          | `full`      | `full` = entire codebase; `diff` = only changed components; `spec` = components in the active spec folder |\n| **spec-folder**    | _(not set)_ | Path to the spec folder (required when scope is `spec`)                                                   |\n| **instruction**    | _(not set)_ | Additional instruction for the review (e.g. _\"focus only on the auth service\"_)                           |\n\n**Wait for the user to respond before proceeding.** Once you have their choices, determine routing:\n\n- **model** is set → skip Section A, go straight to **Section B** with that model ID\n- **model** is not set → follow **Section A**, then continue to **Section B**\n\n---\n\n## Section A — Generate threat model from codebase\n\n### A1 — Check dependencies\n\n**Do not run `threat-designer` without a subcommand** — it launches an interactive REPL that will hang.\n\n```bash\nthreat-designer --version || { echo \"ERROR: threat-designer is not installed. Install it with: pip install \u003Cpath-to-cli>\"; exit 1; }\nmmdc --version 2>\u002Fdev\u002Fnull && echo \"ok\" || npm install -g @mermaid-js\u002Fmermaid-cli\n```\n\nIf `threat-designer` is not installed, **stop here** — tell the user to install it first and do not proceed.\n\n**Determine the spec folder** — all artifacts (diagram, output, task file) live together under one `.kiro\u002Fspecs\u002F` folder:\n\n- **If scope is `spec`:** use the user-provided spec folder directly: `SPEC_DIR=.kiro\u002Fspecs\u002F\u003Cspec-folder>`\n- **If scope is `full` or `diff`:** list existing spec folders and check if one matches the components under review. If a match is found, use it. Otherwise, create a new one:\n  ```bash\n  ls .kiro\u002Fspecs\u002F 2>\u002Fdev\u002Fnull || echo \"(no existing specs)\"\n  RUN_ID=$(date +%Y%m%d-%H%M%S)-$(head -c 4 \u002Fdev\u002Furandom | xxd -p)\n  SPEC_DIR=.kiro\u002Fspecs\u002Fthreat-model-$RUN_ID\n  ```\n\n```bash\nmkdir -p $SPEC_DIR\n```\n\nAll artifacts for this run go under `$SPEC_DIR\u002F`. Use `$SPEC_DIR` in all paths below.\n\n### A2 — Analyze the codebase\n\n**If scope is `diff`:** run:\n\n```bash\ngit diff --name-only HEAD\n```\n\nIdentify which architectural components (services, layers, modules) the changed files belong to. Only analyze those components and their direct dependencies.\n\n**If scope is `spec`:** read the files in the spec folder provided by the user. Identify which architectural components the spec touches based on the requirements and design documents. Only analyze those components and their direct dependencies.\n\n**If scope is `full`:** read the following to understand the full system architecture:\n\n- Service entrypoints, route definitions, API handlers\n- Infrastructure-as-code (Terraform, CDK, CloudFormation, docker-compose, k8s manifests)\n- Authentication and authorization middleware\n- Database schemas, ORM models, migration files\n- External API clients and integrations\n- Network and security configuration (VPCs, security groups, IAM policies)\n- Environment variable definitions (`.env.example`, config files)\n\nSummarize what you find: services, responsibilities, communication patterns, data handled, and trust boundaries.\n\n**In all scopes**, also determine — these are critical for threat model quality and cannot be inferred from the architecture diagram alone:\n\n- **Exposure model**: is the application public-facing, internal-only, or hybrid?\n- **Business context**: what does the application do, who are its users, what data is sensitive?\n- **Tech stack**: languages, frameworks, runtime environment (serverless, containers, VMs)\n- **Key assumptions**: authentication mechanism (SSO, API keys, JWT), network boundaries, trust relationships with third parties\n\n### A3 — Generate architecture diagram\n\nWrite a Mermaid `flowchart TD` diagram to `$SPEC_DIR\u002Farch.mmd`.\n\n**If scope is `diff`:** include only the components identified in A2 (changed components + their direct dependencies). Label each changed component with `*` (e.g., `AuthService*`).\n\n**If scope is `spec`:** include only the components the spec touches and their direct dependencies. Label each spec-relevant component with `*`.\n\n**If scope is `full`:** include all components.\n\nAll scopes must include:\n\n- Directed data flow arrows labeled with protocol\u002Fdata type (e.g. `-->|HTTPS\u002FJWT|`)\n- Trust boundaries as named subgraphs (e.g. `subgraph Internet`, `subgraph VPC`, `subgraph DataLayer`)\n- External actors: end users, third-party APIs, external systems\n- Authentication checkpoints\n\nCompleteness matters more than aesthetics.\n\n```bash\nmmdc -i $SPEC_DIR\u002Farch.mmd -o $SPEC_DIR\u002Farch.png -w 2400 -b white\n```\n\n### A4 — Run threat modeling\n\nBuild the command using the values from Step 0. Always include `--min-likelihood`. Only include `--stride` if the user specified it.\n\n**`--app-type` sets the application exposure model** — this directly influences how the agent calibrates threat likelihood. Choose one based on A2 findings or the user's selection:\n\n- `public` — internet-facing, accessible by anonymous users\n- `internal` — private network only, controlled access\n- `hybrid` — mix of public and internal components (default)\n\n**`--description` is critical for threat model quality.** The architecture diagram shows structure but not context. Write a rich description (2–4 sentences) that covers:\n\n- What the application does and who its users are\n- Tech stack and runtime environment\n- Key security properties (e.g. \"handles PII\", \"processes payments\", \"stores credentials\")\n\n**`--assumption` flags are equally important.** Assumptions define **acceptable risks** and **security controls already in place** — they tell the agent what is already mitigated so it can focus on real gaps. Add one `--assumption` per security-relevant fact discovered in A2. Be specific and concrete — for example:\n\n- `--assumption \"JWT tokens are validated by a custom Lambda authorizer before reaching the application layer\"`\n- `--assumption \"DynamoDB tables use KMS CMK encryption at rest with point-in-time recovery enabled\"`\n- `--assumption \"S3 buckets block all public access and use server-side encryption\"`\n- `--assumption \"CORS is configured with allow_origins=* on both services\"`\n- `--assumption \"Cognito is configured with admin-only user creation (no self-service sign-up)\"`\n- `--assumption \"File uploads use presigned S3 PUT URLs with content-type validation and 1GB size limit\"`\n\n**Threat modeling can take up to 20 minutes.** Run the command with a **20-minute timeout** (`timeout: 1200000`). The tool returns as soon as the command exits — the timeout is just the upper bound.\n\n```bash\nthreat-designer run \\\n  --name \"Threat Review — $(basename $(pwd))\" \\\n  --image $SPEC_DIR\u002Farch.png \\\n  --app-type \u003Cpublic|internal|hybrid> \\\n  --description \"\u003Crich description from A2 — business context, tech stack, sensitive data>\" \\\n  --assumption \"\u003Cassumption 1>\" \\\n  --assumption \"\u003Cassumption 2>\" \\\n  [--assumption ...] \\\n  --effort \u003Ceffort> \\\n  --iterations \u003Citerations> \\\n  --min-likelihood \u003Cmin-likelihood> \\\n  [--stride \u003Cstride if provided>] > $SPEC_DIR\u002Foutput.md\n```\n\nOnce complete, read the job ID:\n\n```bash\nJOB_ID=$(head -1 $SPEC_DIR\u002Foutput.md)\necho \"Threat model: $JOB_ID\"\n```\n\nIf the output file is empty or the process exited with a non-zero code, **stop and report the error**.\n\n---\n\n## Section B — Review code against threat model\n\n### B1 — Load the threat model\n\n**If Section A was run:** the threat list is already in `$SPEC_DIR\u002Foutput.md`. Read it directly.\n\n**If model ID was provided** (Section A skipped), generate the formatted list — pass the same filters:\n\n```bash\nthreat-designer threats \u003Cid> --min-likelihood \u003Cmin-likelihood> [--stride \u003Cstride if provided>]\n```\n\nEach threat has: `name`, `description`, `likelihood` (High\u002FMedium\u002FLow), `stride_category`, `target`. Mitigations are excluded.\n\n**If scope is `diff` and model ID was provided** (Section A was skipped, so git diff was never run): run it now:\n\n```bash\ngit diff --name-only HEAD\n```\n\nIdentify which architectural components the changed files belong to. Discard threats whose `target` does not match.\n\n**If scope is `spec` and model ID was provided**: read the spec folder to identify relevant components. Discard threats whose `target` does not match.\n\n**If scope is `diff` or `spec` and Section A was run:** the component list is already known from A2 — discard threats whose `target` does not match.\n\nPrint a one-line summary before starting:\n\n> Reviewing \u003CN> threats (model: \u003Cid>)\n\n### B2 — Parallel security review\n\nSplit the threats into batches of at most 10. Use the **general-task-execution** agent to launch one sub-agent per batch. Each sub-agent can run independently.\n\nEach sub-agent receives its batch of threat entries, the scope, the instruction (if provided), and these instructions:\n\n> For each threat in this batch, ordered High → Medium → Low:\n>\n> 1. Find the relevant code — files and functions that implement or relate to the `target` component\n>    - If scope is `diff`: focus on the changed files; only look beyond them if the threat directly implicates a dependency\n>    - If scope is `spec`: focus on files related to the spec's components; only look beyond them if the threat directly implicates a dependency\n> 2. Assess mitigation state: **Mitigated** \u002F **Partially mitigated** \u002F **Unmitigated**\n> 3. Return findings as structured markdown — one entry per threat with: file path + line number, gap description, concrete fix\n>\n> **Additional instruction from the user (if provided):** \u003Cinstruction>\n\nWait for all sub-agents to complete, then aggregate their findings into B3.\n\n### B3 — Output\n\nWrite the task file to `$SPEC_DIR\u002Fsecurity_fix_tasks.md` — since all artifacts already live under the spec folder, Kiro picks it up as a native task file.\n\nWrite in **Kiro tasks format**:\n\n```markdown\n# Security Review Tasks\n\nThreat model: \u003Cid> | \u003CN> threats | min-likelihood: \u003Cvalue> | stride: \u003Cvalue or \"all\"> | \u003Cdate>\n\n## Critical\n\n\u003C!-- Unmitigated High-likelihood threats — address immediately -->\n\n- [ ] **TR-001: \u003CThreat name>**\n      File: `\u003Cfile>:\u003Cline>`\n      Threat: \u003Cone-line description> — High, \u003CSTRIDE category>\n      Gap: \u003Cwhat is missing or broken in the current code>\n      Fix: \u003Cconcrete, specific change to make — function name, parameter, pattern>\n\n## Important\n\n\u003C!-- Unmitigated or partially mitigated Medium-likelihood threats -->\n\n- [ ] **TR-002: \u003CThreat name>**\n      File: `\u003Cfile>:\u003Cline>`\n      Threat: \u003Cone-line description> — Medium, \u003CSTRIDE category>\n      Gap: \u003Cwhat is missing or broken>\n      Fix: \u003Cconcrete, specific change>\n\n## Informational\n\n\u003C!-- Low-likelihood or already mitigated — no action required -->\n\n- [x] **TR-003: \u003CThreat name>** — mitigated in `\u003Cfile>:\u003Cline>` (\u003Cbrief note>)\n\n---\n\nSummary: \u003CN> critical | \u003CN> important | \u003CN> informational\n```\n\nRules:\n\n- Each item gets a sequential ID: `TR-001`, `TR-002`, … — numbered across all sections\n- Each unchecked task must be self-contained: file path, line number, what is wrong, what to do\n- \"Fix\" must be a concrete instruction, not a vague suggestion (\"add rate limiting to `\u002Fapi\u002Flogin` in `routes\u002Fauth.py:34`\", not \"consider rate limiting\")\n- Already-mitigated threats go under Informational as pre-checked `[x]` items\n- The file must be valid Kiro task format so tasks can be executed individually or as a batch\n\nAfter writing the file, tell the user:\n\n> Security review complete. Tasks and artifacts written to `$SPEC_DIR\u002F` — Kiro will pick up `security_fix_tasks.md` as a task file.\n",{"data":47,"body":48},{"name":5,"description":7},{"type":49,"children":50},"root",[51,60,66,73,84,457,467,508,512,518,525,542,696,715,733,933,957,978,984,999,1029,1034,1049,1064,1110,1115,1125,1168,1174,1195,1226,1247,1262,1267,1319,1324,1387,1393,1414,1430,1463,1479,1497,1534,1591,1616,1989,1994,2061,2072,2075,2081,2087,2105,2115,2206,2248,2264,2289,2301,2322,2350,2355,2375,2381,2393,2398,2487,2492,2498,2511,2522,3371,3376,3443,3448,3471],{"type":52,"tag":53,"props":54,"children":56},"element","h1",{"id":55},"threat-designer-security-review",[57],{"type":58,"value":59},"text","Threat Designer — Security Review",{"type":52,"tag":61,"props":62,"children":63},"p",{},[64],{"type":58,"value":65},"Perform a threat-model-driven security review of the current repository.",{"type":52,"tag":67,"props":68,"children":70},"h2",{"id":69},"step-0-gather-configuration-from-the-user",[71],{"type":58,"value":72},"Step 0 — Gather configuration from the user",{"type":52,"tag":61,"props":74,"children":75},{},[76,82],{"type":52,"tag":77,"props":78,"children":79},"strong",{},[80],{"type":58,"value":81},"You cannot receive arguments via this skill invocation.",{"type":58,"value":83}," Before doing any work, ask the user to provide the following options. Present this table and ask them to specify any overrides — anything not specified uses the default.",{"type":52,"tag":85,"props":86,"children":87},"table",{},[88,112],{"type":52,"tag":89,"props":90,"children":91},"thead",{},[92],{"type":52,"tag":93,"props":94,"children":95},"tr",{},[96,102,107],{"type":52,"tag":97,"props":98,"children":99},"th",{},[100],{"type":58,"value":101},"Option",{"type":52,"tag":97,"props":103,"children":104},{},[105],{"type":58,"value":106},"Default",{"type":52,"tag":97,"props":108,"children":109},{},[110],{"type":58,"value":111},"Description",{"type":52,"tag":113,"props":114,"children":115},"tbody",{},[116,142,188,220,275,309,353,399,428],{"type":52,"tag":93,"props":117,"children":118},{},[119,128,137],{"type":52,"tag":120,"props":121,"children":122},"td",{},[123],{"type":52,"tag":77,"props":124,"children":125},{},[126],{"type":58,"value":127},"model",{"type":52,"tag":120,"props":129,"children":130},{},[131],{"type":52,"tag":132,"props":133,"children":134},"em",{},[135],{"type":58,"value":136},"(not set)",{"type":52,"tag":120,"props":138,"children":139},{},[140],{"type":58,"value":141},"Use an existing threat model ID — skip generating a new one",{"type":52,"tag":93,"props":143,"children":144},{},[145,153,163],{"type":52,"tag":120,"props":146,"children":147},{},[148],{"type":52,"tag":77,"props":149,"children":150},{},[151],{"type":58,"value":152},"min-likelihood",{"type":52,"tag":120,"props":154,"children":155},{},[156],{"type":52,"tag":157,"props":158,"children":160},"code",{"className":159},[],[161],{"type":58,"value":162},"medium",{"type":52,"tag":120,"props":164,"children":165},{},[166,168,174,176,181,182],{"type":58,"value":167},"Remove threats below this likelihood: ",{"type":52,"tag":157,"props":169,"children":171},{"className":170},[],[172],{"type":58,"value":173},"high",{"type":58,"value":175}," \u002F ",{"type":52,"tag":157,"props":177,"children":179},{"className":178},[],[180],{"type":58,"value":162},{"type":58,"value":175},{"type":52,"tag":157,"props":183,"children":185},{"className":184},[],[186],{"type":58,"value":187},"low",{"type":52,"tag":93,"props":189,"children":190},{},[191,199,207],{"type":52,"tag":120,"props":192,"children":193},{},[194],{"type":52,"tag":77,"props":195,"children":196},{},[197],{"type":58,"value":198},"stride",{"type":52,"tag":120,"props":200,"children":201},{},[202],{"type":52,"tag":132,"props":203,"children":204},{},[205],{"type":58,"value":206},"(all)",{"type":52,"tag":120,"props":208,"children":209},{},[210,212,218],{"type":58,"value":211},"Comma-separated STRIDE filter (e.g. ",{"type":52,"tag":157,"props":213,"children":215},{"className":214},[],[216],{"type":58,"value":217},"Spoofing,Tampering",{"type":58,"value":219},")",{"type":52,"tag":93,"props":221,"children":222},{},[223,231,239],{"type":52,"tag":120,"props":224,"children":225},{},[226],{"type":52,"tag":77,"props":227,"children":228},{},[229],{"type":58,"value":230},"effort",{"type":52,"tag":120,"props":232,"children":233},{},[234],{"type":52,"tag":157,"props":235,"children":237},{"className":236},[],[238],{"type":58,"value":162},{"type":52,"tag":120,"props":240,"children":241},{},[242,244,250,251,256,257,262,263,268,269],{"type":58,"value":243},"Reasoning effort for threat modeling: ",{"type":52,"tag":157,"props":245,"children":247},{"className":246},[],[248],{"type":58,"value":249},"off",{"type":58,"value":175},{"type":52,"tag":157,"props":252,"children":254},{"className":253},[],[255],{"type":58,"value":187},{"type":58,"value":175},{"type":52,"tag":157,"props":258,"children":260},{"className":259},[],[261],{"type":58,"value":162},{"type":58,"value":175},{"type":52,"tag":157,"props":264,"children":266},{"className":265},[],[267],{"type":58,"value":173},{"type":58,"value":175},{"type":52,"tag":157,"props":270,"children":272},{"className":271},[],[273],{"type":58,"value":274},"max",{"type":52,"tag":93,"props":276,"children":277},{},[278,286,297],{"type":52,"tag":120,"props":279,"children":280},{},[281],{"type":52,"tag":77,"props":282,"children":283},{},[284],{"type":58,"value":285},"iterations",{"type":52,"tag":120,"props":287,"children":288},{},[289,295],{"type":52,"tag":157,"props":290,"children":292},{"className":291},[],[293],{"type":58,"value":294},"0",{"type":58,"value":296}," (Auto)",{"type":52,"tag":120,"props":298,"children":299},{},[300,302,307],{"type":58,"value":301},"Number of modeling iterations; ",{"type":52,"tag":157,"props":303,"children":305},{"className":304},[],[306],{"type":58,"value":294},{"type":58,"value":308}," = agent decides",{"type":52,"tag":93,"props":310,"children":311},{},[312,320,329],{"type":52,"tag":120,"props":313,"children":314},{},[315],{"type":52,"tag":77,"props":316,"children":317},{},[318],{"type":58,"value":319},"app-type",{"type":52,"tag":120,"props":321,"children":322},{},[323],{"type":52,"tag":157,"props":324,"children":326},{"className":325},[],[327],{"type":58,"value":328},"hybrid",{"type":52,"tag":120,"props":330,"children":331},{},[332,334,340,341,347,348],{"type":58,"value":333},"Application exposure: ",{"type":52,"tag":157,"props":335,"children":337},{"className":336},[],[338],{"type":58,"value":339},"public",{"type":58,"value":175},{"type":52,"tag":157,"props":342,"children":344},{"className":343},[],[345],{"type":58,"value":346},"internal",{"type":58,"value":175},{"type":52,"tag":157,"props":349,"children":351},{"className":350},[],[352],{"type":58,"value":328},{"type":52,"tag":93,"props":354,"children":355},{},[356,364,373],{"type":52,"tag":120,"props":357,"children":358},{},[359],{"type":52,"tag":77,"props":360,"children":361},{},[362],{"type":58,"value":363},"scope",{"type":52,"tag":120,"props":365,"children":366},{},[367],{"type":52,"tag":157,"props":368,"children":370},{"className":369},[],[371],{"type":58,"value":372},"full",{"type":52,"tag":120,"props":374,"children":375},{},[376,381,383,389,391,397],{"type":52,"tag":157,"props":377,"children":379},{"className":378},[],[380],{"type":58,"value":372},{"type":58,"value":382}," = entire codebase; ",{"type":52,"tag":157,"props":384,"children":386},{"className":385},[],[387],{"type":58,"value":388},"diff",{"type":58,"value":390}," = only changed components; ",{"type":52,"tag":157,"props":392,"children":394},{"className":393},[],[395],{"type":58,"value":396},"spec",{"type":58,"value":398}," = components in the active spec folder",{"type":52,"tag":93,"props":400,"children":401},{},[402,410,417],{"type":52,"tag":120,"props":403,"children":404},{},[405],{"type":52,"tag":77,"props":406,"children":407},{},[408],{"type":58,"value":409},"spec-folder",{"type":52,"tag":120,"props":411,"children":412},{},[413],{"type":52,"tag":132,"props":414,"children":415},{},[416],{"type":58,"value":136},{"type":52,"tag":120,"props":418,"children":419},{},[420,422,427],{"type":58,"value":421},"Path to the spec folder (required when scope is ",{"type":52,"tag":157,"props":423,"children":425},{"className":424},[],[426],{"type":58,"value":396},{"type":58,"value":219},{"type":52,"tag":93,"props":429,"children":430},{},[431,439,446],{"type":52,"tag":120,"props":432,"children":433},{},[434],{"type":52,"tag":77,"props":435,"children":436},{},[437],{"type":58,"value":438},"instruction",{"type":52,"tag":120,"props":440,"children":441},{},[442],{"type":52,"tag":132,"props":443,"children":444},{},[445],{"type":58,"value":136},{"type":52,"tag":120,"props":447,"children":448},{},[449,451,456],{"type":58,"value":450},"Additional instruction for the review (e.g. ",{"type":52,"tag":132,"props":452,"children":453},{},[454],{"type":58,"value":455},"\"focus only on the auth service\"",{"type":58,"value":219},{"type":52,"tag":61,"props":458,"children":459},{},[460,465],{"type":52,"tag":77,"props":461,"children":462},{},[463],{"type":58,"value":464},"Wait for the user to respond before proceeding.",{"type":58,"value":466}," Once you have their choices, determine routing:",{"type":52,"tag":468,"props":469,"children":470},"ul",{},[471,488],{"type":52,"tag":472,"props":473,"children":474},"li",{},[475,479,481,486],{"type":52,"tag":77,"props":476,"children":477},{},[478],{"type":58,"value":127},{"type":58,"value":480}," is set → skip Section A, go straight to ",{"type":52,"tag":77,"props":482,"children":483},{},[484],{"type":58,"value":485},"Section B",{"type":58,"value":487}," with that model ID",{"type":52,"tag":472,"props":489,"children":490},{},[491,495,497,502,504],{"type":52,"tag":77,"props":492,"children":493},{},[494],{"type":58,"value":127},{"type":58,"value":496}," is not set → follow ",{"type":52,"tag":77,"props":498,"children":499},{},[500],{"type":58,"value":501},"Section A",{"type":58,"value":503},", then continue to ",{"type":52,"tag":77,"props":505,"children":506},{},[507],{"type":58,"value":485},{"type":52,"tag":509,"props":510,"children":511},"hr",{},[],{"type":52,"tag":67,"props":513,"children":515},{"id":514},"section-a-generate-threat-model-from-codebase",[516],{"type":58,"value":517},"Section A — Generate threat model from codebase",{"type":52,"tag":519,"props":520,"children":522},"h3",{"id":521},"a1-check-dependencies",[523],{"type":58,"value":524},"A1 — Check dependencies",{"type":52,"tag":61,"props":526,"children":527},{},[528,540],{"type":52,"tag":77,"props":529,"children":530},{},[531,533,538],{"type":58,"value":532},"Do not run ",{"type":52,"tag":157,"props":534,"children":536},{"className":535},[],[537],{"type":58,"value":4},{"type":58,"value":539}," without a subcommand",{"type":58,"value":541}," — it launches an interactive REPL that will hang.",{"type":52,"tag":543,"props":544,"children":549},"pre",{"className":545,"code":546,"language":547,"meta":548,"style":548},"language-bash shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","threat-designer --version || { echo \"ERROR: threat-designer is not installed. Install it with: pip install \u003Cpath-to-cli>\"; exit 1; }\nmmdc --version 2>\u002Fdev\u002Fnull && echo \"ok\" || npm install -g @mermaid-js\u002Fmermaid-cli\n","bash","",[550],{"type":52,"tag":157,"props":551,"children":552},{"__ignoreMap":548},[553,627],{"type":52,"tag":554,"props":555,"children":558},"span",{"class":556,"line":557},"line",1,[559,564,570,576,581,587,592,597,602,607,612,618,622],{"type":52,"tag":554,"props":560,"children":562},{"style":561},"--shiki-light:#E2931D;--shiki-default:#FFCB6B;--shiki-dark:#FFCB6B",[563],{"type":58,"value":4},{"type":52,"tag":554,"props":565,"children":567},{"style":566},"--shiki-light:#91B859;--shiki-default:#C3E88D;--shiki-dark:#C3E88D",[568],{"type":58,"value":569}," --version",{"type":52,"tag":554,"props":571,"children":573},{"style":572},"--shiki-light:#39ADB5;--shiki-default:#89DDFF;--shiki-dark:#89DDFF",[574],{"type":58,"value":575}," ||",{"type":52,"tag":554,"props":577,"children":578},{"style":572},[579],{"type":58,"value":580}," {",{"type":52,"tag":554,"props":582,"children":584},{"style":583},"--shiki-light:#6182B8;--shiki-default:#82AAFF;--shiki-dark:#82AAFF",[585],{"type":58,"value":586}," echo",{"type":52,"tag":554,"props":588,"children":589},{"style":572},[590],{"type":58,"value":591}," \"",{"type":52,"tag":554,"props":593,"children":594},{"style":566},[595],{"type":58,"value":596},"ERROR: threat-designer is not installed. Install it with: pip install \u003Cpath-to-cli>",{"type":52,"tag":554,"props":598,"children":599},{"style":572},[600],{"type":58,"value":601},"\"",{"type":52,"tag":554,"props":603,"children":604},{"style":572},[605],{"type":58,"value":606},";",{"type":52,"tag":554,"props":608,"children":609},{"style":583},[610],{"type":58,"value":611}," exit",{"type":52,"tag":554,"props":613,"children":615},{"style":614},"--shiki-light:#F76D47;--shiki-default:#F78C6C;--shiki-dark:#F78C6C",[616],{"type":58,"value":617}," 1",{"type":52,"tag":554,"props":619,"children":620},{"style":572},[621],{"type":58,"value":606},{"type":52,"tag":554,"props":623,"children":624},{"style":572},[625],{"type":58,"value":626}," }\n",{"type":52,"tag":554,"props":628,"children":630},{"class":556,"line":629},2,[631,636,640,645,650,655,659,663,668,672,676,681,686,691],{"type":52,"tag":554,"props":632,"children":633},{"style":561},[634],{"type":58,"value":635},"mmdc",{"type":52,"tag":554,"props":637,"children":638},{"style":566},[639],{"type":58,"value":569},{"type":52,"tag":554,"props":641,"children":642},{"style":572},[643],{"type":58,"value":644}," 2>",{"type":52,"tag":554,"props":646,"children":647},{"style":566},[648],{"type":58,"value":649},"\u002Fdev\u002Fnull",{"type":52,"tag":554,"props":651,"children":652},{"style":572},[653],{"type":58,"value":654}," &&",{"type":52,"tag":554,"props":656,"children":657},{"style":583},[658],{"type":58,"value":586},{"type":52,"tag":554,"props":660,"children":661},{"style":572},[662],{"type":58,"value":591},{"type":52,"tag":554,"props":664,"children":665},{"style":566},[666],{"type":58,"value":667},"ok",{"type":52,"tag":554,"props":669,"children":670},{"style":572},[671],{"type":58,"value":601},{"type":52,"tag":554,"props":673,"children":674},{"style":572},[675],{"type":58,"value":575},{"type":52,"tag":554,"props":677,"children":678},{"style":561},[679],{"type":58,"value":680}," npm",{"type":52,"tag":554,"props":682,"children":683},{"style":566},[684],{"type":58,"value":685}," install",{"type":52,"tag":554,"props":687,"children":688},{"style":566},[689],{"type":58,"value":690}," -g",{"type":52,"tag":554,"props":692,"children":693},{"style":566},[694],{"type":58,"value":695}," @mermaid-js\u002Fmermaid-cli\n",{"type":52,"tag":61,"props":697,"children":698},{},[699,701,706,708,713],{"type":58,"value":700},"If ",{"type":52,"tag":157,"props":702,"children":704},{"className":703},[],[705],{"type":58,"value":4},{"type":58,"value":707}," is not installed, ",{"type":52,"tag":77,"props":709,"children":710},{},[711],{"type":58,"value":712},"stop here",{"type":58,"value":714}," — tell the user to install it first and do not proceed.",{"type":52,"tag":61,"props":716,"children":717},{},[718,723,725,731],{"type":52,"tag":77,"props":719,"children":720},{},[721],{"type":58,"value":722},"Determine the spec folder",{"type":58,"value":724}," — all artifacts (diagram, output, task file) live together under one ",{"type":52,"tag":157,"props":726,"children":728},{"className":727},[],[729],{"type":58,"value":730},".kiro\u002Fspecs\u002F",{"type":58,"value":732}," folder:",{"type":52,"tag":468,"props":734,"children":735},{},[736,759],{"type":52,"tag":472,"props":737,"children":738},{},[739,751,753],{"type":52,"tag":77,"props":740,"children":741},{},[742,744,749],{"type":58,"value":743},"If scope is ",{"type":52,"tag":157,"props":745,"children":747},{"className":746},[],[748],{"type":58,"value":396},{"type":58,"value":750},":",{"type":58,"value":752}," use the user-provided spec folder directly: ",{"type":52,"tag":157,"props":754,"children":756},{"className":755},[],[757],{"type":58,"value":758},"SPEC_DIR=.kiro\u002Fspecs\u002F\u003Cspec-folder>",{"type":52,"tag":472,"props":760,"children":761},{},[762,779,781],{"type":52,"tag":77,"props":763,"children":764},{},[765,766,771,773,778],{"type":58,"value":743},{"type":52,"tag":157,"props":767,"children":769},{"className":768},[],[770],{"type":58,"value":372},{"type":58,"value":772}," or ",{"type":52,"tag":157,"props":774,"children":776},{"className":775},[],[777],{"type":58,"value":388},{"type":58,"value":750},{"type":58,"value":780}," list existing spec folders and check if one matches the components under review. If a match is found, use it. Otherwise, create a new one:\n",{"type":52,"tag":543,"props":782,"children":784},{"className":545,"code":783,"language":547,"meta":548,"style":548},"ls .kiro\u002Fspecs\u002F 2>\u002Fdev\u002Fnull || echo \"(no existing specs)\"\nRUN_ID=$(date +%Y%m%d-%H%M%S)-$(head -c 4 \u002Fdev\u002Furandom | xxd -p)\nSPEC_DIR=.kiro\u002Fspecs\u002Fthreat-model-$RUN_ID\n",[785],{"type":52,"tag":157,"props":786,"children":787},{"__ignoreMap":548},[788,831,909],{"type":52,"tag":554,"props":789,"children":790},{"class":556,"line":557},[791,796,801,805,809,813,817,821,826],{"type":52,"tag":554,"props":792,"children":793},{"style":561},[794],{"type":58,"value":795},"ls",{"type":52,"tag":554,"props":797,"children":798},{"style":566},[799],{"type":58,"value":800}," .kiro\u002Fspecs\u002F",{"type":52,"tag":554,"props":802,"children":803},{"style":572},[804],{"type":58,"value":644},{"type":52,"tag":554,"props":806,"children":807},{"style":566},[808],{"type":58,"value":649},{"type":52,"tag":554,"props":810,"children":811},{"style":572},[812],{"type":58,"value":575},{"type":52,"tag":554,"props":814,"children":815},{"style":583},[816],{"type":58,"value":586},{"type":52,"tag":554,"props":818,"children":819},{"style":572},[820],{"type":58,"value":591},{"type":52,"tag":554,"props":822,"children":823},{"style":566},[824],{"type":58,"value":825},"(no existing specs)",{"type":52,"tag":554,"props":827,"children":828},{"style":572},[829],{"type":58,"value":830},"\"\n",{"type":52,"tag":554,"props":832,"children":833},{"class":556,"line":629},[834,840,845,850,855,859,864,869,874,879,884,889,894,899,904],{"type":52,"tag":554,"props":835,"children":837},{"style":836},"--shiki-light:#90A4AE;--shiki-default:#EEFFFF;--shiki-dark:#BABED8",[838],{"type":58,"value":839},"RUN_ID",{"type":52,"tag":554,"props":841,"children":842},{"style":572},[843],{"type":58,"value":844},"=$(",{"type":52,"tag":554,"props":846,"children":847},{"style":561},[848],{"type":58,"value":849},"date",{"type":52,"tag":554,"props":851,"children":852},{"style":566},[853],{"type":58,"value":854}," +%Y%m%d-%H%M%S",{"type":52,"tag":554,"props":856,"children":857},{"style":572},[858],{"type":58,"value":219},{"type":52,"tag":554,"props":860,"children":861},{"style":566},[862],{"type":58,"value":863},"-",{"type":52,"tag":554,"props":865,"children":866},{"style":572},[867],{"type":58,"value":868},"$(",{"type":52,"tag":554,"props":870,"children":871},{"style":561},[872],{"type":58,"value":873},"head",{"type":52,"tag":554,"props":875,"children":876},{"style":566},[877],{"type":58,"value":878}," -c",{"type":52,"tag":554,"props":880,"children":881},{"style":614},[882],{"type":58,"value":883}," 4",{"type":52,"tag":554,"props":885,"children":886},{"style":566},[887],{"type":58,"value":888}," \u002Fdev\u002Furandom",{"type":52,"tag":554,"props":890,"children":891},{"style":572},[892],{"type":58,"value":893}," |",{"type":52,"tag":554,"props":895,"children":896},{"style":561},[897],{"type":58,"value":898}," xxd",{"type":52,"tag":554,"props":900,"children":901},{"style":566},[902],{"type":58,"value":903}," -p",{"type":52,"tag":554,"props":905,"children":906},{"style":572},[907],{"type":58,"value":908},")\n",{"type":52,"tag":554,"props":910,"children":912},{"class":556,"line":911},3,[913,918,923,928],{"type":52,"tag":554,"props":914,"children":915},{"style":836},[916],{"type":58,"value":917},"SPEC_DIR",{"type":52,"tag":554,"props":919,"children":920},{"style":572},[921],{"type":58,"value":922},"=",{"type":52,"tag":554,"props":924,"children":925},{"style":566},[926],{"type":58,"value":927},".kiro\u002Fspecs\u002Fthreat-model-",{"type":52,"tag":554,"props":929,"children":930},{"style":836},[931],{"type":58,"value":932},"$RUN_ID\n",{"type":52,"tag":543,"props":934,"children":936},{"className":545,"code":935,"language":547,"meta":548,"style":548},"mkdir -p $SPEC_DIR\n",[937],{"type":52,"tag":157,"props":938,"children":939},{"__ignoreMap":548},[940],{"type":52,"tag":554,"props":941,"children":942},{"class":556,"line":557},[943,948,952],{"type":52,"tag":554,"props":944,"children":945},{"style":561},[946],{"type":58,"value":947},"mkdir",{"type":52,"tag":554,"props":949,"children":950},{"style":566},[951],{"type":58,"value":903},{"type":52,"tag":554,"props":953,"children":954},{"style":836},[955],{"type":58,"value":956}," $SPEC_DIR\n",{"type":52,"tag":61,"props":958,"children":959},{},[960,962,968,970,976],{"type":58,"value":961},"All artifacts for this run go under ",{"type":52,"tag":157,"props":963,"children":965},{"className":964},[],[966],{"type":58,"value":967},"$SPEC_DIR\u002F",{"type":58,"value":969},". Use ",{"type":52,"tag":157,"props":971,"children":973},{"className":972},[],[974],{"type":58,"value":975},"$SPEC_DIR",{"type":58,"value":977}," in all paths below.",{"type":52,"tag":519,"props":979,"children":981},{"id":980},"a2-analyze-the-codebase",[982],{"type":58,"value":983},"A2 — Analyze the codebase",{"type":52,"tag":61,"props":985,"children":986},{},[987,997],{"type":52,"tag":77,"props":988,"children":989},{},[990,991,996],{"type":58,"value":743},{"type":52,"tag":157,"props":992,"children":994},{"className":993},[],[995],{"type":58,"value":388},{"type":58,"value":750},{"type":58,"value":998}," run:",{"type":52,"tag":543,"props":1000,"children":1002},{"className":545,"code":1001,"language":547,"meta":548,"style":548},"git diff --name-only HEAD\n",[1003],{"type":52,"tag":157,"props":1004,"children":1005},{"__ignoreMap":548},[1006],{"type":52,"tag":554,"props":1007,"children":1008},{"class":556,"line":557},[1009,1014,1019,1024],{"type":52,"tag":554,"props":1010,"children":1011},{"style":561},[1012],{"type":58,"value":1013},"git",{"type":52,"tag":554,"props":1015,"children":1016},{"style":566},[1017],{"type":58,"value":1018}," diff",{"type":52,"tag":554,"props":1020,"children":1021},{"style":566},[1022],{"type":58,"value":1023}," --name-only",{"type":52,"tag":554,"props":1025,"children":1026},{"style":566},[1027],{"type":58,"value":1028}," HEAD\n",{"type":52,"tag":61,"props":1030,"children":1031},{},[1032],{"type":58,"value":1033},"Identify which architectural components (services, layers, modules) the changed files belong to. Only analyze those components and their direct dependencies.",{"type":52,"tag":61,"props":1035,"children":1036},{},[1037,1047],{"type":52,"tag":77,"props":1038,"children":1039},{},[1040,1041,1046],{"type":58,"value":743},{"type":52,"tag":157,"props":1042,"children":1044},{"className":1043},[],[1045],{"type":58,"value":396},{"type":58,"value":750},{"type":58,"value":1048}," read the files in the spec folder provided by the user. Identify which architectural components the spec touches based on the requirements and design documents. Only analyze those components and their direct dependencies.",{"type":52,"tag":61,"props":1050,"children":1051},{},[1052,1062],{"type":52,"tag":77,"props":1053,"children":1054},{},[1055,1056,1061],{"type":58,"value":743},{"type":52,"tag":157,"props":1057,"children":1059},{"className":1058},[],[1060],{"type":58,"value":372},{"type":58,"value":750},{"type":58,"value":1063}," read the following to understand the full system architecture:",{"type":52,"tag":468,"props":1065,"children":1066},{},[1067,1072,1077,1082,1087,1092,1097],{"type":52,"tag":472,"props":1068,"children":1069},{},[1070],{"type":58,"value":1071},"Service entrypoints, route definitions, API handlers",{"type":52,"tag":472,"props":1073,"children":1074},{},[1075],{"type":58,"value":1076},"Infrastructure-as-code (Terraform, CDK, CloudFormation, docker-compose, k8s manifests)",{"type":52,"tag":472,"props":1078,"children":1079},{},[1080],{"type":58,"value":1081},"Authentication and authorization middleware",{"type":52,"tag":472,"props":1083,"children":1084},{},[1085],{"type":58,"value":1086},"Database schemas, ORM models, migration files",{"type":52,"tag":472,"props":1088,"children":1089},{},[1090],{"type":58,"value":1091},"External API clients and integrations",{"type":52,"tag":472,"props":1093,"children":1094},{},[1095],{"type":58,"value":1096},"Network and security configuration (VPCs, security groups, IAM policies)",{"type":52,"tag":472,"props":1098,"children":1099},{},[1100,1102,1108],{"type":58,"value":1101},"Environment variable definitions (",{"type":52,"tag":157,"props":1103,"children":1105},{"className":1104},[],[1106],{"type":58,"value":1107},".env.example",{"type":58,"value":1109},", config files)",{"type":52,"tag":61,"props":1111,"children":1112},{},[1113],{"type":58,"value":1114},"Summarize what you find: services, responsibilities, communication patterns, data handled, and trust boundaries.",{"type":52,"tag":61,"props":1116,"children":1117},{},[1118,1123],{"type":52,"tag":77,"props":1119,"children":1120},{},[1121],{"type":58,"value":1122},"In all scopes",{"type":58,"value":1124},", also determine — these are critical for threat model quality and cannot be inferred from the architecture diagram alone:",{"type":52,"tag":468,"props":1126,"children":1127},{},[1128,1138,1148,1158],{"type":52,"tag":472,"props":1129,"children":1130},{},[1131,1136],{"type":52,"tag":77,"props":1132,"children":1133},{},[1134],{"type":58,"value":1135},"Exposure model",{"type":58,"value":1137},": is the application public-facing, internal-only, or hybrid?",{"type":52,"tag":472,"props":1139,"children":1140},{},[1141,1146],{"type":52,"tag":77,"props":1142,"children":1143},{},[1144],{"type":58,"value":1145},"Business context",{"type":58,"value":1147},": what does the application do, who are its users, what data is sensitive?",{"type":52,"tag":472,"props":1149,"children":1150},{},[1151,1156],{"type":52,"tag":77,"props":1152,"children":1153},{},[1154],{"type":58,"value":1155},"Tech stack",{"type":58,"value":1157},": languages, frameworks, runtime environment (serverless, containers, VMs)",{"type":52,"tag":472,"props":1159,"children":1160},{},[1161,1166],{"type":52,"tag":77,"props":1162,"children":1163},{},[1164],{"type":58,"value":1165},"Key assumptions",{"type":58,"value":1167},": authentication mechanism (SSO, API keys, JWT), network boundaries, trust relationships with third parties",{"type":52,"tag":519,"props":1169,"children":1171},{"id":1170},"a3-generate-architecture-diagram",[1172],{"type":58,"value":1173},"A3 — Generate architecture diagram",{"type":52,"tag":61,"props":1175,"children":1176},{},[1177,1179,1185,1187,1193],{"type":58,"value":1178},"Write a Mermaid ",{"type":52,"tag":157,"props":1180,"children":1182},{"className":1181},[],[1183],{"type":58,"value":1184},"flowchart TD",{"type":58,"value":1186}," diagram to ",{"type":52,"tag":157,"props":1188,"children":1190},{"className":1189},[],[1191],{"type":58,"value":1192},"$SPEC_DIR\u002Farch.mmd",{"type":58,"value":1194},".",{"type":52,"tag":61,"props":1196,"children":1197},{},[1198,1208,1210,1216,1218,1224],{"type":52,"tag":77,"props":1199,"children":1200},{},[1201,1202,1207],{"type":58,"value":743},{"type":52,"tag":157,"props":1203,"children":1205},{"className":1204},[],[1206],{"type":58,"value":388},{"type":58,"value":750},{"type":58,"value":1209}," include only the components identified in A2 (changed components + their direct dependencies). Label each changed component with ",{"type":52,"tag":157,"props":1211,"children":1213},{"className":1212},[],[1214],{"type":58,"value":1215},"*",{"type":58,"value":1217}," (e.g., ",{"type":52,"tag":157,"props":1219,"children":1221},{"className":1220},[],[1222],{"type":58,"value":1223},"AuthService*",{"type":58,"value":1225},").",{"type":52,"tag":61,"props":1227,"children":1228},{},[1229,1239,1241,1246],{"type":52,"tag":77,"props":1230,"children":1231},{},[1232,1233,1238],{"type":58,"value":743},{"type":52,"tag":157,"props":1234,"children":1236},{"className":1235},[],[1237],{"type":58,"value":396},{"type":58,"value":750},{"type":58,"value":1240}," include only the components the spec touches and their direct dependencies. Label each spec-relevant component with ",{"type":52,"tag":157,"props":1242,"children":1244},{"className":1243},[],[1245],{"type":58,"value":1215},{"type":58,"value":1194},{"type":52,"tag":61,"props":1248,"children":1249},{},[1250,1260],{"type":52,"tag":77,"props":1251,"children":1252},{},[1253,1254,1259],{"type":58,"value":743},{"type":52,"tag":157,"props":1255,"children":1257},{"className":1256},[],[1258],{"type":58,"value":372},{"type":58,"value":750},{"type":58,"value":1261}," include all components.",{"type":52,"tag":61,"props":1263,"children":1264},{},[1265],{"type":58,"value":1266},"All scopes must include:",{"type":52,"tag":468,"props":1268,"children":1269},{},[1270,1282,1309,1314],{"type":52,"tag":472,"props":1271,"children":1272},{},[1273,1275,1281],{"type":58,"value":1274},"Directed data flow arrows labeled with protocol\u002Fdata type (e.g. ",{"type":52,"tag":157,"props":1276,"children":1278},{"className":1277},[],[1279],{"type":58,"value":1280},"-->|HTTPS\u002FJWT|",{"type":58,"value":219},{"type":52,"tag":472,"props":1283,"children":1284},{},[1285,1287,1293,1295,1301,1302,1308],{"type":58,"value":1286},"Trust boundaries as named subgraphs (e.g. ",{"type":52,"tag":157,"props":1288,"children":1290},{"className":1289},[],[1291],{"type":58,"value":1292},"subgraph Internet",{"type":58,"value":1294},", ",{"type":52,"tag":157,"props":1296,"children":1298},{"className":1297},[],[1299],{"type":58,"value":1300},"subgraph VPC",{"type":58,"value":1294},{"type":52,"tag":157,"props":1303,"children":1305},{"className":1304},[],[1306],{"type":58,"value":1307},"subgraph DataLayer",{"type":58,"value":219},{"type":52,"tag":472,"props":1310,"children":1311},{},[1312],{"type":58,"value":1313},"External actors: end users, third-party APIs, external systems",{"type":52,"tag":472,"props":1315,"children":1316},{},[1317],{"type":58,"value":1318},"Authentication checkpoints",{"type":52,"tag":61,"props":1320,"children":1321},{},[1322],{"type":58,"value":1323},"Completeness matters more than aesthetics.",{"type":52,"tag":543,"props":1325,"children":1327},{"className":545,"code":1326,"language":547,"meta":548,"style":548},"mmdc -i $SPEC_DIR\u002Farch.mmd -o $SPEC_DIR\u002Farch.png -w 2400 -b white\n",[1328],{"type":52,"tag":157,"props":1329,"children":1330},{"__ignoreMap":548},[1331],{"type":52,"tag":554,"props":1332,"children":1333},{"class":556,"line":557},[1334,1338,1343,1348,1353,1358,1362,1367,1372,1377,1382],{"type":52,"tag":554,"props":1335,"children":1336},{"style":561},[1337],{"type":58,"value":635},{"type":52,"tag":554,"props":1339,"children":1340},{"style":566},[1341],{"type":58,"value":1342}," -i",{"type":52,"tag":554,"props":1344,"children":1345},{"style":836},[1346],{"type":58,"value":1347}," $SPEC_DIR",{"type":52,"tag":554,"props":1349,"children":1350},{"style":566},[1351],{"type":58,"value":1352},"\u002Farch.mmd",{"type":52,"tag":554,"props":1354,"children":1355},{"style":566},[1356],{"type":58,"value":1357}," -o",{"type":52,"tag":554,"props":1359,"children":1360},{"style":836},[1361],{"type":58,"value":1347},{"type":52,"tag":554,"props":1363,"children":1364},{"style":566},[1365],{"type":58,"value":1366},"\u002Farch.png",{"type":52,"tag":554,"props":1368,"children":1369},{"style":566},[1370],{"type":58,"value":1371}," -w",{"type":52,"tag":554,"props":1373,"children":1374},{"style":614},[1375],{"type":58,"value":1376}," 2400",{"type":52,"tag":554,"props":1378,"children":1379},{"style":566},[1380],{"type":58,"value":1381}," -b",{"type":52,"tag":554,"props":1383,"children":1384},{"style":566},[1385],{"type":58,"value":1386}," white\n",{"type":52,"tag":519,"props":1388,"children":1390},{"id":1389},"a4-run-threat-modeling",[1391],{"type":58,"value":1392},"A4 — Run threat modeling",{"type":52,"tag":61,"props":1394,"children":1395},{},[1396,1398,1404,1406,1412],{"type":58,"value":1397},"Build the command using the values from Step 0. Always include ",{"type":52,"tag":157,"props":1399,"children":1401},{"className":1400},[],[1402],{"type":58,"value":1403},"--min-likelihood",{"type":58,"value":1405},". Only include ",{"type":52,"tag":157,"props":1407,"children":1409},{"className":1408},[],[1410],{"type":58,"value":1411},"--stride",{"type":58,"value":1413}," if the user specified it.",{"type":52,"tag":61,"props":1415,"children":1416},{},[1417,1428],{"type":52,"tag":77,"props":1418,"children":1419},{},[1420,1426],{"type":52,"tag":157,"props":1421,"children":1423},{"className":1422},[],[1424],{"type":58,"value":1425},"--app-type",{"type":58,"value":1427}," sets the application exposure model",{"type":58,"value":1429}," — this directly influences how the agent calibrates threat likelihood. Choose one based on A2 findings or the user's selection:",{"type":52,"tag":468,"props":1431,"children":1432},{},[1433,1443,1453],{"type":52,"tag":472,"props":1434,"children":1435},{},[1436,1441],{"type":52,"tag":157,"props":1437,"children":1439},{"className":1438},[],[1440],{"type":58,"value":339},{"type":58,"value":1442}," — internet-facing, accessible by anonymous users",{"type":52,"tag":472,"props":1444,"children":1445},{},[1446,1451],{"type":52,"tag":157,"props":1447,"children":1449},{"className":1448},[],[1450],{"type":58,"value":346},{"type":58,"value":1452}," — private network only, controlled access",{"type":52,"tag":472,"props":1454,"children":1455},{},[1456,1461],{"type":52,"tag":157,"props":1457,"children":1459},{"className":1458},[],[1460],{"type":58,"value":328},{"type":58,"value":1462}," — mix of public and internal components (default)",{"type":52,"tag":61,"props":1464,"children":1465},{},[1466,1477],{"type":52,"tag":77,"props":1467,"children":1468},{},[1469,1475],{"type":52,"tag":157,"props":1470,"children":1472},{"className":1471},[],[1473],{"type":58,"value":1474},"--description",{"type":58,"value":1476}," is critical for threat model quality.",{"type":58,"value":1478}," The architecture diagram shows structure but not context. Write a rich description (2–4 sentences) that covers:",{"type":52,"tag":468,"props":1480,"children":1481},{},[1482,1487,1492],{"type":52,"tag":472,"props":1483,"children":1484},{},[1485],{"type":58,"value":1486},"What the application does and who its users are",{"type":52,"tag":472,"props":1488,"children":1489},{},[1490],{"type":58,"value":1491},"Tech stack and runtime environment",{"type":52,"tag":472,"props":1493,"children":1494},{},[1495],{"type":58,"value":1496},"Key security properties (e.g. \"handles PII\", \"processes payments\", \"stores credentials\")",{"type":52,"tag":61,"props":1498,"children":1499},{},[1500,1511,1513,1518,1520,1525,1527,1532],{"type":52,"tag":77,"props":1501,"children":1502},{},[1503,1509],{"type":52,"tag":157,"props":1504,"children":1506},{"className":1505},[],[1507],{"type":58,"value":1508},"--assumption",{"type":58,"value":1510}," flags are equally important.",{"type":58,"value":1512}," Assumptions define ",{"type":52,"tag":77,"props":1514,"children":1515},{},[1516],{"type":58,"value":1517},"acceptable risks",{"type":58,"value":1519}," and ",{"type":52,"tag":77,"props":1521,"children":1522},{},[1523],{"type":58,"value":1524},"security controls already in place",{"type":58,"value":1526}," — they tell the agent what is already mitigated so it can focus on real gaps. Add one ",{"type":52,"tag":157,"props":1528,"children":1530},{"className":1529},[],[1531],{"type":58,"value":1508},{"type":58,"value":1533}," per security-relevant fact discovered in A2. Be specific and concrete — for example:",{"type":52,"tag":468,"props":1535,"children":1536},{},[1537,1546,1555,1564,1573,1582],{"type":52,"tag":472,"props":1538,"children":1539},{},[1540],{"type":52,"tag":157,"props":1541,"children":1543},{"className":1542},[],[1544],{"type":58,"value":1545},"--assumption \"JWT tokens are validated by a custom Lambda authorizer before reaching the application layer\"",{"type":52,"tag":472,"props":1547,"children":1548},{},[1549],{"type":52,"tag":157,"props":1550,"children":1552},{"className":1551},[],[1553],{"type":58,"value":1554},"--assumption \"DynamoDB tables use KMS CMK encryption at rest with point-in-time recovery enabled\"",{"type":52,"tag":472,"props":1556,"children":1557},{},[1558],{"type":52,"tag":157,"props":1559,"children":1561},{"className":1560},[],[1562],{"type":58,"value":1563},"--assumption \"S3 buckets block all public access and use server-side encryption\"",{"type":52,"tag":472,"props":1565,"children":1566},{},[1567],{"type":52,"tag":157,"props":1568,"children":1570},{"className":1569},[],[1571],{"type":58,"value":1572},"--assumption \"CORS is configured with allow_origins=* on both services\"",{"type":52,"tag":472,"props":1574,"children":1575},{},[1576],{"type":52,"tag":157,"props":1577,"children":1579},{"className":1578},[],[1580],{"type":58,"value":1581},"--assumption \"Cognito is configured with admin-only user creation (no self-service sign-up)\"",{"type":52,"tag":472,"props":1583,"children":1584},{},[1585],{"type":52,"tag":157,"props":1586,"children":1588},{"className":1587},[],[1589],{"type":58,"value":1590},"--assumption \"File uploads use presigned S3 PUT URLs with content-type validation and 1GB size limit\"",{"type":52,"tag":61,"props":1592,"children":1593},{},[1594,1599,1601,1606,1608,1614],{"type":52,"tag":77,"props":1595,"children":1596},{},[1597],{"type":58,"value":1598},"Threat modeling can take up to 20 minutes.",{"type":58,"value":1600}," Run the command with a ",{"type":52,"tag":77,"props":1602,"children":1603},{},[1604],{"type":58,"value":1605},"20-minute timeout",{"type":58,"value":1607}," (",{"type":52,"tag":157,"props":1609,"children":1611},{"className":1610},[],[1612],{"type":58,"value":1613},"timeout: 1200000",{"type":58,"value":1615},"). The tool returns as soon as the command exits — the timeout is just the upper bound.",{"type":52,"tag":543,"props":1617,"children":1619},{"className":545,"code":1618,"language":547,"meta":548,"style":548},"threat-designer run \\\n  --name \"Threat Review — $(basename $(pwd))\" \\\n  --image $SPEC_DIR\u002Farch.png \\\n  --app-type \u003Cpublic|internal|hybrid> \\\n  --description \"\u003Crich description from A2 — business context, tech stack, sensitive data>\" \\\n  --assumption \"\u003Cassumption 1>\" \\\n  --assumption \"\u003Cassumption 2>\" \\\n  [--assumption ...] \\\n  --effort \u003Ceffort> \\\n  --iterations \u003Citerations> \\\n  --min-likelihood \u003Cmin-likelihood> \\\n  [--stride \u003Cstride if provided>] > $SPEC_DIR\u002Foutput.md\n",[1620],{"type":52,"tag":157,"props":1621,"children":1622},{"__ignoreMap":548},[1623,1640,1685,1705,1745,1771,1797,1822,1840,1872,1903,1934],{"type":52,"tag":554,"props":1624,"children":1625},{"class":556,"line":557},[1626,1630,1635],{"type":52,"tag":554,"props":1627,"children":1628},{"style":561},[1629],{"type":58,"value":4},{"type":52,"tag":554,"props":1631,"children":1632},{"style":566},[1633],{"type":58,"value":1634}," run",{"type":52,"tag":554,"props":1636,"children":1637},{"style":836},[1638],{"type":58,"value":1639}," \\\n",{"type":52,"tag":554,"props":1641,"children":1642},{"class":556,"line":629},[1643,1648,1652,1657,1661,1666,1671,1676,1681],{"type":52,"tag":554,"props":1644,"children":1645},{"style":566},[1646],{"type":58,"value":1647},"  --name",{"type":52,"tag":554,"props":1649,"children":1650},{"style":572},[1651],{"type":58,"value":591},{"type":52,"tag":554,"props":1653,"children":1654},{"style":566},[1655],{"type":58,"value":1656},"Threat Review — ",{"type":52,"tag":554,"props":1658,"children":1659},{"style":572},[1660],{"type":58,"value":868},{"type":52,"tag":554,"props":1662,"children":1663},{"style":561},[1664],{"type":58,"value":1665},"basename",{"type":52,"tag":554,"props":1667,"children":1668},{"style":572},[1669],{"type":58,"value":1670}," $(",{"type":52,"tag":554,"props":1672,"children":1673},{"style":583},[1674],{"type":58,"value":1675},"pwd",{"type":52,"tag":554,"props":1677,"children":1678},{"style":572},[1679],{"type":58,"value":1680},"))\"",{"type":52,"tag":554,"props":1682,"children":1683},{"style":836},[1684],{"type":58,"value":1639},{"type":52,"tag":554,"props":1686,"children":1687},{"class":556,"line":911},[1688,1693,1697,1701],{"type":52,"tag":554,"props":1689,"children":1690},{"style":566},[1691],{"type":58,"value":1692},"  --image",{"type":52,"tag":554,"props":1694,"children":1695},{"style":836},[1696],{"type":58,"value":1347},{"type":52,"tag":554,"props":1698,"children":1699},{"style":566},[1700],{"type":58,"value":1366},{"type":52,"tag":554,"props":1702,"children":1703},{"style":836},[1704],{"type":58,"value":1639},{"type":52,"tag":554,"props":1706,"children":1708},{"class":556,"line":1707},4,[1709,1714,1719,1723,1728,1732,1736,1740],{"type":52,"tag":554,"props":1710,"children":1711},{"style":566},[1712],{"type":58,"value":1713},"  --app-type",{"type":52,"tag":554,"props":1715,"children":1716},{"style":572},[1717],{"type":58,"value":1718}," \u003C",{"type":52,"tag":554,"props":1720,"children":1721},{"style":566},[1722],{"type":58,"value":339},{"type":52,"tag":554,"props":1724,"children":1725},{"style":572},[1726],{"type":58,"value":1727},"|",{"type":52,"tag":554,"props":1729,"children":1730},{"style":561},[1731],{"type":58,"value":346},{"type":52,"tag":554,"props":1733,"children":1734},{"style":572},[1735],{"type":58,"value":1727},{"type":52,"tag":554,"props":1737,"children":1738},{"style":561},[1739],{"type":58,"value":328},{"type":52,"tag":554,"props":1741,"children":1742},{"style":836},[1743],{"type":58,"value":1744},"> \\\n",{"type":52,"tag":554,"props":1746,"children":1748},{"class":556,"line":1747},5,[1749,1754,1758,1763,1767],{"type":52,"tag":554,"props":1750,"children":1751},{"style":566},[1752],{"type":58,"value":1753},"  --description",{"type":52,"tag":554,"props":1755,"children":1756},{"style":572},[1757],{"type":58,"value":591},{"type":52,"tag":554,"props":1759,"children":1760},{"style":566},[1761],{"type":58,"value":1762},"\u003Crich description from A2 — business context, tech stack, sensitive data>",{"type":52,"tag":554,"props":1764,"children":1765},{"style":572},[1766],{"type":58,"value":601},{"type":52,"tag":554,"props":1768,"children":1769},{"style":836},[1770],{"type":58,"value":1639},{"type":52,"tag":554,"props":1772,"children":1774},{"class":556,"line":1773},6,[1775,1780,1784,1789,1793],{"type":52,"tag":554,"props":1776,"children":1777},{"style":566},[1778],{"type":58,"value":1779},"  --assumption",{"type":52,"tag":554,"props":1781,"children":1782},{"style":572},[1783],{"type":58,"value":591},{"type":52,"tag":554,"props":1785,"children":1786},{"style":566},[1787],{"type":58,"value":1788},"\u003Cassumption 1>",{"type":52,"tag":554,"props":1790,"children":1791},{"style":572},[1792],{"type":58,"value":601},{"type":52,"tag":554,"props":1794,"children":1795},{"style":836},[1796],{"type":58,"value":1639},{"type":52,"tag":554,"props":1798,"children":1800},{"class":556,"line":1799},7,[1801,1805,1809,1814,1818],{"type":52,"tag":554,"props":1802,"children":1803},{"style":566},[1804],{"type":58,"value":1779},{"type":52,"tag":554,"props":1806,"children":1807},{"style":572},[1808],{"type":58,"value":591},{"type":52,"tag":554,"props":1810,"children":1811},{"style":566},[1812],{"type":58,"value":1813},"\u003Cassumption 2>",{"type":52,"tag":554,"props":1815,"children":1816},{"style":572},[1817],{"type":58,"value":601},{"type":52,"tag":554,"props":1819,"children":1820},{"style":836},[1821],{"type":58,"value":1639},{"type":52,"tag":554,"props":1823,"children":1825},{"class":556,"line":1824},8,[1826,1831,1836],{"type":52,"tag":554,"props":1827,"children":1828},{"style":836},[1829],{"type":58,"value":1830},"  [--assumption ",{"type":52,"tag":554,"props":1832,"children":1833},{"style":566},[1834],{"type":58,"value":1835},"...]",{"type":52,"tag":554,"props":1837,"children":1838},{"style":836},[1839],{"type":58,"value":1639},{"type":52,"tag":554,"props":1841,"children":1843},{"class":556,"line":1842},9,[1844,1849,1853,1858,1863,1868],{"type":52,"tag":554,"props":1845,"children":1846},{"style":566},[1847],{"type":58,"value":1848},"  --effort",{"type":52,"tag":554,"props":1850,"children":1851},{"style":572},[1852],{"type":58,"value":1718},{"type":52,"tag":554,"props":1854,"children":1855},{"style":566},[1856],{"type":58,"value":1857},"effor",{"type":52,"tag":554,"props":1859,"children":1860},{"style":836},[1861],{"type":58,"value":1862},"t",{"type":52,"tag":554,"props":1864,"children":1865},{"style":572},[1866],{"type":58,"value":1867},">",{"type":52,"tag":554,"props":1869,"children":1870},{"style":836},[1871],{"type":58,"value":1639},{"type":52,"tag":554,"props":1873,"children":1875},{"class":556,"line":1874},10,[1876,1881,1885,1890,1895,1899],{"type":52,"tag":554,"props":1877,"children":1878},{"style":566},[1879],{"type":58,"value":1880},"  --iterations",{"type":52,"tag":554,"props":1882,"children":1883},{"style":572},[1884],{"type":58,"value":1718},{"type":52,"tag":554,"props":1886,"children":1887},{"style":566},[1888],{"type":58,"value":1889},"iteration",{"type":52,"tag":554,"props":1891,"children":1892},{"style":836},[1893],{"type":58,"value":1894},"s",{"type":52,"tag":554,"props":1896,"children":1897},{"style":572},[1898],{"type":58,"value":1867},{"type":52,"tag":554,"props":1900,"children":1901},{"style":836},[1902],{"type":58,"value":1639},{"type":52,"tag":554,"props":1904,"children":1906},{"class":556,"line":1905},11,[1907,1912,1916,1921,1926,1930],{"type":52,"tag":554,"props":1908,"children":1909},{"style":566},[1910],{"type":58,"value":1911},"  --min-likelihood",{"type":52,"tag":554,"props":1913,"children":1914},{"style":572},[1915],{"type":58,"value":1718},{"type":52,"tag":554,"props":1917,"children":1918},{"style":566},[1919],{"type":58,"value":1920},"min-likelihoo",{"type":52,"tag":554,"props":1922,"children":1923},{"style":836},[1924],{"type":58,"value":1925},"d",{"type":52,"tag":554,"props":1927,"children":1928},{"style":572},[1929],{"type":58,"value":1867},{"type":52,"tag":554,"props":1931,"children":1932},{"style":836},[1933],{"type":58,"value":1639},{"type":52,"tag":554,"props":1935,"children":1937},{"class":556,"line":1936},12,[1938,1943,1948,1952,1957,1962,1966,1970,1975,1980,1984],{"type":52,"tag":554,"props":1939,"children":1940},{"style":836},[1941],{"type":58,"value":1942},"  [--stride ",{"type":52,"tag":554,"props":1944,"children":1945},{"style":572},[1946],{"type":58,"value":1947},"\u003C",{"type":52,"tag":554,"props":1949,"children":1950},{"style":566},[1951],{"type":58,"value":198},{"type":52,"tag":554,"props":1953,"children":1954},{"style":566},[1955],{"type":58,"value":1956}," if",{"type":52,"tag":554,"props":1958,"children":1959},{"style":566},[1960],{"type":58,"value":1961}," provide",{"type":52,"tag":554,"props":1963,"children":1964},{"style":836},[1965],{"type":58,"value":1925},{"type":52,"tag":554,"props":1967,"children":1968},{"style":572},[1969],{"type":58,"value":1867},{"type":52,"tag":554,"props":1971,"children":1972},{"style":566},[1973],{"type":58,"value":1974},"]",{"type":52,"tag":554,"props":1976,"children":1977},{"style":572},[1978],{"type":58,"value":1979}," >",{"type":52,"tag":554,"props":1981,"children":1982},{"style":836},[1983],{"type":58,"value":1347},{"type":52,"tag":554,"props":1985,"children":1986},{"style":566},[1987],{"type":58,"value":1988},"\u002Foutput.md\n",{"type":52,"tag":61,"props":1990,"children":1991},{},[1992],{"type":58,"value":1993},"Once complete, read the job ID:",{"type":52,"tag":543,"props":1995,"children":1997},{"className":545,"code":1996,"language":547,"meta":548,"style":548},"JOB_ID=$(head -1 $SPEC_DIR\u002Foutput.md)\necho \"Threat model: $JOB_ID\"\n",[1998],{"type":52,"tag":157,"props":1999,"children":2000},{"__ignoreMap":548},[2001,2035],{"type":52,"tag":554,"props":2002,"children":2003},{"class":556,"line":557},[2004,2009,2013,2017,2022,2026,2031],{"type":52,"tag":554,"props":2005,"children":2006},{"style":836},[2007],{"type":58,"value":2008},"JOB_ID",{"type":52,"tag":554,"props":2010,"children":2011},{"style":572},[2012],{"type":58,"value":844},{"type":52,"tag":554,"props":2014,"children":2015},{"style":561},[2016],{"type":58,"value":873},{"type":52,"tag":554,"props":2018,"children":2019},{"style":566},[2020],{"type":58,"value":2021}," -1",{"type":52,"tag":554,"props":2023,"children":2024},{"style":836},[2025],{"type":58,"value":1347},{"type":52,"tag":554,"props":2027,"children":2028},{"style":566},[2029],{"type":58,"value":2030},"\u002Foutput.md",{"type":52,"tag":554,"props":2032,"children":2033},{"style":572},[2034],{"type":58,"value":908},{"type":52,"tag":554,"props":2036,"children":2037},{"class":556,"line":629},[2038,2043,2047,2052,2057],{"type":52,"tag":554,"props":2039,"children":2040},{"style":583},[2041],{"type":58,"value":2042},"echo",{"type":52,"tag":554,"props":2044,"children":2045},{"style":572},[2046],{"type":58,"value":591},{"type":52,"tag":554,"props":2048,"children":2049},{"style":566},[2050],{"type":58,"value":2051},"Threat model: ",{"type":52,"tag":554,"props":2053,"children":2054},{"style":836},[2055],{"type":58,"value":2056},"$JOB_ID",{"type":52,"tag":554,"props":2058,"children":2059},{"style":572},[2060],{"type":58,"value":830},{"type":52,"tag":61,"props":2062,"children":2063},{},[2064,2066,2071],{"type":58,"value":2065},"If the output file is empty or the process exited with a non-zero code, ",{"type":52,"tag":77,"props":2067,"children":2068},{},[2069],{"type":58,"value":2070},"stop and report the error",{"type":58,"value":1194},{"type":52,"tag":509,"props":2073,"children":2074},{},[],{"type":52,"tag":67,"props":2076,"children":2078},{"id":2077},"section-b-review-code-against-threat-model",[2079],{"type":58,"value":2080},"Section B — Review code against threat model",{"type":52,"tag":519,"props":2082,"children":2084},{"id":2083},"b1-load-the-threat-model",[2085],{"type":58,"value":2086},"B1 — Load the threat model",{"type":52,"tag":61,"props":2088,"children":2089},{},[2090,2095,2097,2103],{"type":52,"tag":77,"props":2091,"children":2092},{},[2093],{"type":58,"value":2094},"If Section A was run:",{"type":58,"value":2096}," the threat list is already in ",{"type":52,"tag":157,"props":2098,"children":2100},{"className":2099},[],[2101],{"type":58,"value":2102},"$SPEC_DIR\u002Foutput.md",{"type":58,"value":2104},". Read it directly.",{"type":52,"tag":61,"props":2106,"children":2107},{},[2108,2113],{"type":52,"tag":77,"props":2109,"children":2110},{},[2111],{"type":58,"value":2112},"If model ID was provided",{"type":58,"value":2114}," (Section A skipped), generate the formatted list — pass the same filters:",{"type":52,"tag":543,"props":2116,"children":2118},{"className":545,"code":2117,"language":547,"meta":548,"style":548},"threat-designer threats \u003Cid> --min-likelihood \u003Cmin-likelihood> [--stride \u003Cstride if provided>]\n",[2119],{"type":52,"tag":157,"props":2120,"children":2121},{"__ignoreMap":548},[2122],{"type":52,"tag":554,"props":2123,"children":2124},{"class":556,"line":557},[2125,2129,2134,2138,2143,2147,2151,2156,2160,2164,2168,2172,2177,2181,2185,2189,2193,2197,2201],{"type":52,"tag":554,"props":2126,"children":2127},{"style":561},[2128],{"type":58,"value":4},{"type":52,"tag":554,"props":2130,"children":2131},{"style":566},[2132],{"type":58,"value":2133}," threats",{"type":52,"tag":554,"props":2135,"children":2136},{"style":572},[2137],{"type":58,"value":1718},{"type":52,"tag":554,"props":2139,"children":2140},{"style":566},[2141],{"type":58,"value":2142},"i",{"type":52,"tag":554,"props":2144,"children":2145},{"style":836},[2146],{"type":58,"value":1925},{"type":52,"tag":554,"props":2148,"children":2149},{"style":572},[2150],{"type":58,"value":1867},{"type":52,"tag":554,"props":2152,"children":2153},{"style":566},[2154],{"type":58,"value":2155}," --min-likelihood",{"type":52,"tag":554,"props":2157,"children":2158},{"style":572},[2159],{"type":58,"value":1718},{"type":52,"tag":554,"props":2161,"children":2162},{"style":566},[2163],{"type":58,"value":1920},{"type":52,"tag":554,"props":2165,"children":2166},{"style":836},[2167],{"type":58,"value":1925},{"type":52,"tag":554,"props":2169,"children":2170},{"style":572},[2171],{"type":58,"value":1867},{"type":52,"tag":554,"props":2173,"children":2174},{"style":836},[2175],{"type":58,"value":2176}," [--stride ",{"type":52,"tag":554,"props":2178,"children":2179},{"style":572},[2180],{"type":58,"value":1947},{"type":52,"tag":554,"props":2182,"children":2183},{"style":566},[2184],{"type":58,"value":198},{"type":52,"tag":554,"props":2186,"children":2187},{"style":566},[2188],{"type":58,"value":1956},{"type":52,"tag":554,"props":2190,"children":2191},{"style":566},[2192],{"type":58,"value":1961},{"type":52,"tag":554,"props":2194,"children":2195},{"style":836},[2196],{"type":58,"value":1925},{"type":52,"tag":554,"props":2198,"children":2199},{"style":572},[2200],{"type":58,"value":1867},{"type":52,"tag":554,"props":2202,"children":2203},{"style":566},[2204],{"type":58,"value":2205},"]\n",{"type":52,"tag":61,"props":2207,"children":2208},{},[2209,2211,2217,2218,2224,2225,2231,2233,2239,2240,2246],{"type":58,"value":2210},"Each threat has: ",{"type":52,"tag":157,"props":2212,"children":2214},{"className":2213},[],[2215],{"type":58,"value":2216},"name",{"type":58,"value":1294},{"type":52,"tag":157,"props":2219,"children":2221},{"className":2220},[],[2222],{"type":58,"value":2223},"description",{"type":58,"value":1294},{"type":52,"tag":157,"props":2226,"children":2228},{"className":2227},[],[2229],{"type":58,"value":2230},"likelihood",{"type":58,"value":2232}," (High\u002FMedium\u002FLow), ",{"type":52,"tag":157,"props":2234,"children":2236},{"className":2235},[],[2237],{"type":58,"value":2238},"stride_category",{"type":58,"value":1294},{"type":52,"tag":157,"props":2241,"children":2243},{"className":2242},[],[2244],{"type":58,"value":2245},"target",{"type":58,"value":2247},". Mitigations are excluded.",{"type":52,"tag":61,"props":2249,"children":2250},{},[2251,2262],{"type":52,"tag":77,"props":2252,"children":2253},{},[2254,2255,2260],{"type":58,"value":743},{"type":52,"tag":157,"props":2256,"children":2258},{"className":2257},[],[2259],{"type":58,"value":388},{"type":58,"value":2261}," and model ID was provided",{"type":58,"value":2263}," (Section A was skipped, so git diff was never run): run it now:",{"type":52,"tag":543,"props":2265,"children":2266},{"className":545,"code":1001,"language":547,"meta":548,"style":548},[2267],{"type":52,"tag":157,"props":2268,"children":2269},{"__ignoreMap":548},[2270],{"type":52,"tag":554,"props":2271,"children":2272},{"class":556,"line":557},[2273,2277,2281,2285],{"type":52,"tag":554,"props":2274,"children":2275},{"style":561},[2276],{"type":58,"value":1013},{"type":52,"tag":554,"props":2278,"children":2279},{"style":566},[2280],{"type":58,"value":1018},{"type":52,"tag":554,"props":2282,"children":2283},{"style":566},[2284],{"type":58,"value":1023},{"type":52,"tag":554,"props":2286,"children":2287},{"style":566},[2288],{"type":58,"value":1028},{"type":52,"tag":61,"props":2290,"children":2291},{},[2292,2294,2299],{"type":58,"value":2293},"Identify which architectural components the changed files belong to. Discard threats whose ",{"type":52,"tag":157,"props":2295,"children":2297},{"className":2296},[],[2298],{"type":58,"value":2245},{"type":58,"value":2300}," does not match.",{"type":52,"tag":61,"props":2302,"children":2303},{},[2304,2314,2316,2321],{"type":52,"tag":77,"props":2305,"children":2306},{},[2307,2308,2313],{"type":58,"value":743},{"type":52,"tag":157,"props":2309,"children":2311},{"className":2310},[],[2312],{"type":58,"value":396},{"type":58,"value":2261},{"type":58,"value":2315},": read the spec folder to identify relevant components. Discard threats whose ",{"type":52,"tag":157,"props":2317,"children":2319},{"className":2318},[],[2320],{"type":58,"value":2245},{"type":58,"value":2300},{"type":52,"tag":61,"props":2323,"children":2324},{},[2325,2342,2344,2349],{"type":52,"tag":77,"props":2326,"children":2327},{},[2328,2329,2334,2335,2340],{"type":58,"value":743},{"type":52,"tag":157,"props":2330,"children":2332},{"className":2331},[],[2333],{"type":58,"value":388},{"type":58,"value":772},{"type":52,"tag":157,"props":2336,"children":2338},{"className":2337},[],[2339],{"type":58,"value":396},{"type":58,"value":2341}," and Section A was run:",{"type":58,"value":2343}," the component list is already known from A2 — discard threats whose ",{"type":52,"tag":157,"props":2345,"children":2347},{"className":2346},[],[2348],{"type":58,"value":2245},{"type":58,"value":2300},{"type":52,"tag":61,"props":2351,"children":2352},{},[2353],{"type":58,"value":2354},"Print a one-line summary before starting:",{"type":52,"tag":2356,"props":2357,"children":2358},"blockquote",{},[2359],{"type":52,"tag":61,"props":2360,"children":2361},{},[2362,2364],{"type":58,"value":2363},"Reviewing ",{"type":52,"tag":2365,"props":2366,"children":2367},"n",{},[2368,2370],{"type":58,"value":2369}," threats (model: ",{"type":52,"tag":2371,"props":2372,"children":2373},"id",{},[2374],{"type":58,"value":219},{"type":52,"tag":519,"props":2376,"children":2378},{"id":2377},"b2-parallel-security-review",[2379],{"type":58,"value":2380},"B2 — Parallel security review",{"type":52,"tag":61,"props":2382,"children":2383},{},[2384,2386,2391],{"type":58,"value":2385},"Split the threats into batches of at most 10. Use the ",{"type":52,"tag":77,"props":2387,"children":2388},{},[2389],{"type":58,"value":2390},"general-task-execution",{"type":58,"value":2392}," agent to launch one sub-agent per batch. Each sub-agent can run independently.",{"type":52,"tag":61,"props":2394,"children":2395},{},[2396],{"type":58,"value":2397},"Each sub-agent receives its batch of threat entries, the scope, the instruction (if provided), and these instructions:",{"type":52,"tag":2356,"props":2399,"children":2400},{},[2401,2406,2474],{"type":52,"tag":61,"props":2402,"children":2403},{},[2404],{"type":58,"value":2405},"For each threat in this batch, ordered High → Medium → Low:",{"type":52,"tag":2407,"props":2408,"children":2409},"ol",{},[2410,2447,2469],{"type":52,"tag":472,"props":2411,"children":2412},{},[2413,2415,2420,2422],{"type":58,"value":2414},"Find the relevant code — files and functions that implement or relate to the ",{"type":52,"tag":157,"props":2416,"children":2418},{"className":2417},[],[2419],{"type":58,"value":2245},{"type":58,"value":2421}," component\n",{"type":52,"tag":468,"props":2423,"children":2424},{},[2425,2436],{"type":52,"tag":472,"props":2426,"children":2427},{},[2428,2429,2434],{"type":58,"value":743},{"type":52,"tag":157,"props":2430,"children":2432},{"className":2431},[],[2433],{"type":58,"value":388},{"type":58,"value":2435},": focus on the changed files; only look beyond them if the threat directly implicates a dependency",{"type":52,"tag":472,"props":2437,"children":2438},{},[2439,2440,2445],{"type":58,"value":743},{"type":52,"tag":157,"props":2441,"children":2443},{"className":2442},[],[2444],{"type":58,"value":396},{"type":58,"value":2446},": focus on files related to the spec's components; only look beyond them if the threat directly implicates a dependency",{"type":52,"tag":472,"props":2448,"children":2449},{},[2450,2452,2457,2458,2463,2464],{"type":58,"value":2451},"Assess mitigation state: ",{"type":52,"tag":77,"props":2453,"children":2454},{},[2455],{"type":58,"value":2456},"Mitigated",{"type":58,"value":175},{"type":52,"tag":77,"props":2459,"children":2460},{},[2461],{"type":58,"value":2462},"Partially mitigated",{"type":58,"value":175},{"type":52,"tag":77,"props":2465,"children":2466},{},[2467],{"type":58,"value":2468},"Unmitigated",{"type":52,"tag":472,"props":2470,"children":2471},{},[2472],{"type":58,"value":2473},"Return findings as structured markdown — one entry per threat with: file path + line number, gap description, concrete fix",{"type":52,"tag":61,"props":2475,"children":2476},{},[2477,2482,2484],{"type":52,"tag":77,"props":2478,"children":2479},{},[2480],{"type":58,"value":2481},"Additional instruction from the user (if provided):",{"type":58,"value":2483}," ",{"type":52,"tag":438,"props":2485,"children":2486},{},[],{"type":52,"tag":61,"props":2488,"children":2489},{},[2490],{"type":58,"value":2491},"Wait for all sub-agents to complete, then aggregate their findings into B3.",{"type":52,"tag":519,"props":2493,"children":2495},{"id":2494},"b3-output",[2496],{"type":58,"value":2497},"B3 — Output",{"type":52,"tag":61,"props":2499,"children":2500},{},[2501,2503,2509],{"type":58,"value":2502},"Write the task file to ",{"type":52,"tag":157,"props":2504,"children":2506},{"className":2505},[],[2507],{"type":58,"value":2508},"$SPEC_DIR\u002Fsecurity_fix_tasks.md",{"type":58,"value":2510}," — since all artifacts already live under the spec folder, Kiro picks it up as a native task file.",{"type":52,"tag":61,"props":2512,"children":2513},{},[2514,2516,2521],{"type":58,"value":2515},"Write in ",{"type":52,"tag":77,"props":2517,"children":2518},{},[2519],{"type":58,"value":2520},"Kiro tasks format",{"type":58,"value":750},{"type":52,"tag":543,"props":2523,"children":2527},{"className":2524,"code":2525,"language":2526,"meta":548,"style":548},"language-markdown shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","# Security Review Tasks\n\nThreat model: \u003Cid> | \u003CN> threats | min-likelihood: \u003Cvalue> | stride: \u003Cvalue or \"all\"> | \u003Cdate>\n\n## Critical\n\n\u003C!-- Unmitigated High-likelihood threats — address immediately -->\n\n- [ ] **TR-001: \u003CThreat name>**\n      File: `\u003Cfile>:\u003Cline>`\n      Threat: \u003Cone-line description> — High, \u003CSTRIDE category>\n      Gap: \u003Cwhat is missing or broken in the current code>\n      Fix: \u003Cconcrete, specific change to make — function name, parameter, pattern>\n\n## Important\n\n\u003C!-- Unmitigated or partially mitigated Medium-likelihood threats -->\n\n- [ ] **TR-002: \u003CThreat name>**\n      File: `\u003Cfile>:\u003Cline>`\n      Threat: \u003Cone-line description> — Medium, \u003CSTRIDE category>\n      Gap: \u003Cwhat is missing or broken>\n      Fix: \u003Cconcrete, specific change>\n\n## Informational\n\n\u003C!-- Low-likelihood or already mitigated — no action required -->\n\n- [x] **TR-003: \u003CThreat name>** — mitigated in `\u003Cfile>:\u003Cline>` (\u003Cbrief note>)\n\n---\n\nSummary: \u003CN> critical | \u003CN> important | \u003CN> informational\n","markdown",[2528],{"type":52,"tag":157,"props":2529,"children":2530},{"__ignoreMap":548},[2531,2544,2553,2650,2657,2670,2677,2686,2693,2737,2760,2809,2869,2936,2944,2957,2965,2974,2982,3019,3039,3084,3120,3148,3156,3169,3177,3186,3194,3286,3294,3303,3311],{"type":52,"tag":554,"props":2532,"children":2533},{"class":556,"line":557},[2534,2539],{"type":52,"tag":554,"props":2535,"children":2536},{"style":572},[2537],{"type":58,"value":2538},"# ",{"type":52,"tag":554,"props":2540,"children":2541},{"style":561},[2542],{"type":58,"value":2543},"Security Review Tasks\n",{"type":52,"tag":554,"props":2545,"children":2546},{"class":556,"line":629},[2547],{"type":52,"tag":554,"props":2548,"children":2550},{"emptyLinePlaceholder":2549},true,[2551],{"type":58,"value":2552},"\n",{"type":52,"tag":554,"props":2554,"children":2555},{"class":556,"line":911},[2556,2560,2564,2569,2573,2578,2582,2587,2591,2596,2600,2605,2609,2614,2618,2622,2628,2633,2637,2641,2645],{"type":52,"tag":554,"props":2557,"children":2558},{"style":836},[2559],{"type":58,"value":2051},{"type":52,"tag":554,"props":2561,"children":2562},{"style":572},[2563],{"type":58,"value":1947},{"type":52,"tag":554,"props":2565,"children":2567},{"style":2566},"--shiki-light:#E53935;--shiki-default:#F07178;--shiki-dark:#F07178",[2568],{"type":58,"value":2371},{"type":52,"tag":554,"props":2570,"children":2571},{"style":572},[2572],{"type":58,"value":1867},{"type":52,"tag":554,"props":2574,"children":2575},{"style":836},[2576],{"type":58,"value":2577}," | ",{"type":52,"tag":554,"props":2579,"children":2580},{"style":572},[2581],{"type":58,"value":1947},{"type":52,"tag":554,"props":2583,"children":2584},{"style":2566},[2585],{"type":58,"value":2586},"N",{"type":52,"tag":554,"props":2588,"children":2589},{"style":572},[2590],{"type":58,"value":1867},{"type":52,"tag":554,"props":2592,"children":2593},{"style":836},[2594],{"type":58,"value":2595}," threats | min-likelihood: ",{"type":52,"tag":554,"props":2597,"children":2598},{"style":572},[2599],{"type":58,"value":1947},{"type":52,"tag":554,"props":2601,"children":2602},{"style":2566},[2603],{"type":58,"value":2604},"value",{"type":52,"tag":554,"props":2606,"children":2607},{"style":572},[2608],{"type":58,"value":1867},{"type":52,"tag":554,"props":2610,"children":2611},{"style":836},[2612],{"type":58,"value":2613}," | stride: ",{"type":52,"tag":554,"props":2615,"children":2616},{"style":572},[2617],{"type":58,"value":1947},{"type":52,"tag":554,"props":2619,"children":2620},{"style":2566},[2621],{"type":58,"value":2604},{"type":52,"tag":554,"props":2623,"children":2625},{"style":2624},"--shiki-light:#9C3EDA;--shiki-default:#C792EA;--shiki-dark:#C792EA",[2626],{"type":58,"value":2627}," or",{"type":52,"tag":554,"props":2629,"children":2630},{"style":572},[2631],{"type":58,"value":2632}," \"all\">",{"type":52,"tag":554,"props":2634,"children":2635},{"style":836},[2636],{"type":58,"value":2577},{"type":52,"tag":554,"props":2638,"children":2639},{"style":572},[2640],{"type":58,"value":1947},{"type":52,"tag":554,"props":2642,"children":2643},{"style":2566},[2644],{"type":58,"value":849},{"type":52,"tag":554,"props":2646,"children":2647},{"style":572},[2648],{"type":58,"value":2649},">\n",{"type":52,"tag":554,"props":2651,"children":2652},{"class":556,"line":1707},[2653],{"type":52,"tag":554,"props":2654,"children":2655},{"emptyLinePlaceholder":2549},[2656],{"type":58,"value":2552},{"type":52,"tag":554,"props":2658,"children":2659},{"class":556,"line":1747},[2660,2665],{"type":52,"tag":554,"props":2661,"children":2662},{"style":572},[2663],{"type":58,"value":2664},"## ",{"type":52,"tag":554,"props":2666,"children":2667},{"style":561},[2668],{"type":58,"value":2669},"Critical\n",{"type":52,"tag":554,"props":2671,"children":2672},{"class":556,"line":1773},[2673],{"type":52,"tag":554,"props":2674,"children":2675},{"emptyLinePlaceholder":2549},[2676],{"type":58,"value":2552},{"type":52,"tag":554,"props":2678,"children":2679},{"class":556,"line":1799},[2680],{"type":52,"tag":554,"props":2681,"children":2683},{"style":2682},"--shiki-light:#90A4AE;--shiki-light-font-style:italic;--shiki-default:#546E7A;--shiki-default-font-style:italic;--shiki-dark:#676E95;--shiki-dark-font-style:italic",[2684],{"type":58,"value":2685},"\u003C!-- Unmitigated High-likelihood threats — address immediately -->\n",{"type":52,"tag":554,"props":2687,"children":2688},{"class":556,"line":1824},[2689],{"type":52,"tag":554,"props":2690,"children":2691},{"emptyLinePlaceholder":2549},[2692],{"type":58,"value":2552},{"type":52,"tag":554,"props":2694,"children":2695},{"class":556,"line":1842},[2696,2700,2705,2711,2717,2721,2726,2732],{"type":52,"tag":554,"props":2697,"children":2698},{"style":572},[2699],{"type":58,"value":863},{"type":52,"tag":554,"props":2701,"children":2702},{"style":836},[2703],{"type":58,"value":2704}," [ ] ",{"type":52,"tag":554,"props":2706,"children":2708},{"style":2707},"--shiki-light:#39ADB5;--shiki-light-font-weight:bold;--shiki-default:#89DDFF;--shiki-default-font-weight:bold;--shiki-dark:#89DDFF;--shiki-dark-font-weight:bold",[2709],{"type":58,"value":2710},"**",{"type":52,"tag":554,"props":2712,"children":2714},{"style":2713},"--shiki-light:#E53935;--shiki-light-font-weight:bold;--shiki-default:#F07178;--shiki-default-font-weight:bold;--shiki-dark:#F07178;--shiki-dark-font-weight:bold",[2715],{"type":58,"value":2716},"TR-001: ",{"type":52,"tag":554,"props":2718,"children":2719},{"style":2707},[2720],{"type":58,"value":1947},{"type":52,"tag":554,"props":2722,"children":2723},{"style":2713},[2724],{"type":58,"value":2725},"Threat",{"type":52,"tag":554,"props":2727,"children":2729},{"style":2728},"--shiki-light:#9C3EDA;--shiki-light-font-weight:bold;--shiki-default:#C792EA;--shiki-default-font-weight:bold;--shiki-dark:#C792EA;--shiki-dark-font-weight:bold",[2730],{"type":58,"value":2731}," name",{"type":52,"tag":554,"props":2733,"children":2734},{"style":2707},[2735],{"type":58,"value":2736},">**\n",{"type":52,"tag":554,"props":2738,"children":2739},{"class":556,"line":1874},[2740,2745,2750,2755],{"type":52,"tag":554,"props":2741,"children":2742},{"style":836},[2743],{"type":58,"value":2744},"      File: ",{"type":52,"tag":554,"props":2746,"children":2747},{"style":572},[2748],{"type":58,"value":2749},"`",{"type":52,"tag":554,"props":2751,"children":2752},{"style":566},[2753],{"type":58,"value":2754},"\u003Cfile>:\u003Cline>",{"type":52,"tag":554,"props":2756,"children":2757},{"style":572},[2758],{"type":58,"value":2759},"`\n",{"type":52,"tag":554,"props":2761,"children":2762},{"class":556,"line":1905},[2763,2768,2772,2777,2782,2786,2791,2795,2800,2805],{"type":52,"tag":554,"props":2764,"children":2765},{"style":836},[2766],{"type":58,"value":2767},"      Threat: ",{"type":52,"tag":554,"props":2769,"children":2770},{"style":572},[2771],{"type":58,"value":1947},{"type":52,"tag":554,"props":2773,"children":2774},{"style":2566},[2775],{"type":58,"value":2776},"one-line",{"type":52,"tag":554,"props":2778,"children":2779},{"style":2624},[2780],{"type":58,"value":2781}," description",{"type":52,"tag":554,"props":2783,"children":2784},{"style":572},[2785],{"type":58,"value":1867},{"type":52,"tag":554,"props":2787,"children":2788},{"style":836},[2789],{"type":58,"value":2790}," — High, ",{"type":52,"tag":554,"props":2792,"children":2793},{"style":572},[2794],{"type":58,"value":1947},{"type":52,"tag":554,"props":2796,"children":2797},{"style":2566},[2798],{"type":58,"value":2799},"STRIDE",{"type":52,"tag":554,"props":2801,"children":2802},{"style":2624},[2803],{"type":58,"value":2804}," category",{"type":52,"tag":554,"props":2806,"children":2807},{"style":572},[2808],{"type":58,"value":2649},{"type":52,"tag":554,"props":2810,"children":2811},{"class":556,"line":1936},[2812,2817,2821,2826,2831,2836,2840,2845,2850,2855,2860,2865],{"type":52,"tag":554,"props":2813,"children":2814},{"style":836},[2815],{"type":58,"value":2816},"      Gap: ",{"type":52,"tag":554,"props":2818,"children":2819},{"style":572},[2820],{"type":58,"value":1947},{"type":52,"tag":554,"props":2822,"children":2823},{"style":2566},[2824],{"type":58,"value":2825},"what",{"type":52,"tag":554,"props":2827,"children":2828},{"style":2624},[2829],{"type":58,"value":2830}," is",{"type":52,"tag":554,"props":2832,"children":2833},{"style":2624},[2834],{"type":58,"value":2835}," missing",{"type":52,"tag":554,"props":2837,"children":2838},{"style":2624},[2839],{"type":58,"value":2627},{"type":52,"tag":554,"props":2841,"children":2842},{"style":2624},[2843],{"type":58,"value":2844}," broken",{"type":52,"tag":554,"props":2846,"children":2847},{"style":2624},[2848],{"type":58,"value":2849}," in",{"type":52,"tag":554,"props":2851,"children":2852},{"style":2624},[2853],{"type":58,"value":2854}," the",{"type":52,"tag":554,"props":2856,"children":2857},{"style":2624},[2858],{"type":58,"value":2859}," current",{"type":52,"tag":554,"props":2861,"children":2862},{"style":2624},[2863],{"type":58,"value":2864}," code",{"type":52,"tag":554,"props":2866,"children":2867},{"style":572},[2868],{"type":58,"value":2649},{"type":52,"tag":554,"props":2870,"children":2872},{"class":556,"line":2871},13,[2873,2878,2882,2887,2892,2897,2902,2907,2912,2917,2922,2927,2932],{"type":52,"tag":554,"props":2874,"children":2875},{"style":836},[2876],{"type":58,"value":2877},"      Fix: ",{"type":52,"tag":554,"props":2879,"children":2880},{"style":572},[2881],{"type":58,"value":1947},{"type":52,"tag":554,"props":2883,"children":2884},{"style":2566},[2885],{"type":58,"value":2886},"concrete,",{"type":52,"tag":554,"props":2888,"children":2889},{"style":2624},[2890],{"type":58,"value":2891}," specific",{"type":52,"tag":554,"props":2893,"children":2894},{"style":2624},[2895],{"type":58,"value":2896}," change",{"type":52,"tag":554,"props":2898,"children":2899},{"style":2624},[2900],{"type":58,"value":2901}," to",{"type":52,"tag":554,"props":2903,"children":2904},{"style":2624},[2905],{"type":58,"value":2906}," make",{"type":52,"tag":554,"props":2908,"children":2909},{"style":2624},[2910],{"type":58,"value":2911}," —",{"type":52,"tag":554,"props":2913,"children":2914},{"style":2624},[2915],{"type":58,"value":2916}," function",{"type":52,"tag":554,"props":2918,"children":2919},{"style":2624},[2920],{"type":58,"value":2921}," name,",{"type":52,"tag":554,"props":2923,"children":2924},{"style":2624},[2925],{"type":58,"value":2926}," parameter,",{"type":52,"tag":554,"props":2928,"children":2929},{"style":2624},[2930],{"type":58,"value":2931}," pattern",{"type":52,"tag":554,"props":2933,"children":2934},{"style":572},[2935],{"type":58,"value":2649},{"type":52,"tag":554,"props":2937,"children":2939},{"class":556,"line":2938},14,[2940],{"type":52,"tag":554,"props":2941,"children":2942},{"emptyLinePlaceholder":2549},[2943],{"type":58,"value":2552},{"type":52,"tag":554,"props":2945,"children":2947},{"class":556,"line":2946},15,[2948,2952],{"type":52,"tag":554,"props":2949,"children":2950},{"style":572},[2951],{"type":58,"value":2664},{"type":52,"tag":554,"props":2953,"children":2954},{"style":561},[2955],{"type":58,"value":2956},"Important\n",{"type":52,"tag":554,"props":2958,"children":2960},{"class":556,"line":2959},16,[2961],{"type":52,"tag":554,"props":2962,"children":2963},{"emptyLinePlaceholder":2549},[2964],{"type":58,"value":2552},{"type":52,"tag":554,"props":2966,"children":2968},{"class":556,"line":2967},17,[2969],{"type":52,"tag":554,"props":2970,"children":2971},{"style":2682},[2972],{"type":58,"value":2973},"\u003C!-- Unmitigated or partially mitigated Medium-likelihood threats -->\n",{"type":52,"tag":554,"props":2975,"children":2977},{"class":556,"line":2976},18,[2978],{"type":52,"tag":554,"props":2979,"children":2980},{"emptyLinePlaceholder":2549},[2981],{"type":58,"value":2552},{"type":52,"tag":554,"props":2983,"children":2985},{"class":556,"line":2984},19,[2986,2990,2994,2998,3003,3007,3011,3015],{"type":52,"tag":554,"props":2987,"children":2988},{"style":572},[2989],{"type":58,"value":863},{"type":52,"tag":554,"props":2991,"children":2992},{"style":836},[2993],{"type":58,"value":2704},{"type":52,"tag":554,"props":2995,"children":2996},{"style":2707},[2997],{"type":58,"value":2710},{"type":52,"tag":554,"props":2999,"children":3000},{"style":2713},[3001],{"type":58,"value":3002},"TR-002: ",{"type":52,"tag":554,"props":3004,"children":3005},{"style":2707},[3006],{"type":58,"value":1947},{"type":52,"tag":554,"props":3008,"children":3009},{"style":2713},[3010],{"type":58,"value":2725},{"type":52,"tag":554,"props":3012,"children":3013},{"style":2728},[3014],{"type":58,"value":2731},{"type":52,"tag":554,"props":3016,"children":3017},{"style":2707},[3018],{"type":58,"value":2736},{"type":52,"tag":554,"props":3020,"children":3022},{"class":556,"line":3021},20,[3023,3027,3031,3035],{"type":52,"tag":554,"props":3024,"children":3025},{"style":836},[3026],{"type":58,"value":2744},{"type":52,"tag":554,"props":3028,"children":3029},{"style":572},[3030],{"type":58,"value":2749},{"type":52,"tag":554,"props":3032,"children":3033},{"style":566},[3034],{"type":58,"value":2754},{"type":52,"tag":554,"props":3036,"children":3037},{"style":572},[3038],{"type":58,"value":2759},{"type":52,"tag":554,"props":3040,"children":3042},{"class":556,"line":3041},21,[3043,3047,3051,3055,3059,3063,3068,3072,3076,3080],{"type":52,"tag":554,"props":3044,"children":3045},{"style":836},[3046],{"type":58,"value":2767},{"type":52,"tag":554,"props":3048,"children":3049},{"style":572},[3050],{"type":58,"value":1947},{"type":52,"tag":554,"props":3052,"children":3053},{"style":2566},[3054],{"type":58,"value":2776},{"type":52,"tag":554,"props":3056,"children":3057},{"style":2624},[3058],{"type":58,"value":2781},{"type":52,"tag":554,"props":3060,"children":3061},{"style":572},[3062],{"type":58,"value":1867},{"type":52,"tag":554,"props":3064,"children":3065},{"style":836},[3066],{"type":58,"value":3067}," — Medium, ",{"type":52,"tag":554,"props":3069,"children":3070},{"style":572},[3071],{"type":58,"value":1947},{"type":52,"tag":554,"props":3073,"children":3074},{"style":2566},[3075],{"type":58,"value":2799},{"type":52,"tag":554,"props":3077,"children":3078},{"style":2624},[3079],{"type":58,"value":2804},{"type":52,"tag":554,"props":3081,"children":3082},{"style":572},[3083],{"type":58,"value":2649},{"type":52,"tag":554,"props":3085,"children":3087},{"class":556,"line":3086},22,[3088,3092,3096,3100,3104,3108,3112,3116],{"type":52,"tag":554,"props":3089,"children":3090},{"style":836},[3091],{"type":58,"value":2816},{"type":52,"tag":554,"props":3093,"children":3094},{"style":572},[3095],{"type":58,"value":1947},{"type":52,"tag":554,"props":3097,"children":3098},{"style":2566},[3099],{"type":58,"value":2825},{"type":52,"tag":554,"props":3101,"children":3102},{"style":2624},[3103],{"type":58,"value":2830},{"type":52,"tag":554,"props":3105,"children":3106},{"style":2624},[3107],{"type":58,"value":2835},{"type":52,"tag":554,"props":3109,"children":3110},{"style":2624},[3111],{"type":58,"value":2627},{"type":52,"tag":554,"props":3113,"children":3114},{"style":2624},[3115],{"type":58,"value":2844},{"type":52,"tag":554,"props":3117,"children":3118},{"style":572},[3119],{"type":58,"value":2649},{"type":52,"tag":554,"props":3121,"children":3123},{"class":556,"line":3122},23,[3124,3128,3132,3136,3140,3144],{"type":52,"tag":554,"props":3125,"children":3126},{"style":836},[3127],{"type":58,"value":2877},{"type":52,"tag":554,"props":3129,"children":3130},{"style":572},[3131],{"type":58,"value":1947},{"type":52,"tag":554,"props":3133,"children":3134},{"style":2566},[3135],{"type":58,"value":2886},{"type":52,"tag":554,"props":3137,"children":3138},{"style":2624},[3139],{"type":58,"value":2891},{"type":52,"tag":554,"props":3141,"children":3142},{"style":2624},[3143],{"type":58,"value":2896},{"type":52,"tag":554,"props":3145,"children":3146},{"style":572},[3147],{"type":58,"value":2649},{"type":52,"tag":554,"props":3149,"children":3151},{"class":556,"line":3150},24,[3152],{"type":52,"tag":554,"props":3153,"children":3154},{"emptyLinePlaceholder":2549},[3155],{"type":58,"value":2552},{"type":52,"tag":554,"props":3157,"children":3159},{"class":556,"line":3158},25,[3160,3164],{"type":52,"tag":554,"props":3161,"children":3162},{"style":572},[3163],{"type":58,"value":2664},{"type":52,"tag":554,"props":3165,"children":3166},{"style":561},[3167],{"type":58,"value":3168},"Informational\n",{"type":52,"tag":554,"props":3170,"children":3172},{"class":556,"line":3171},26,[3173],{"type":52,"tag":554,"props":3174,"children":3175},{"emptyLinePlaceholder":2549},[3176],{"type":58,"value":2552},{"type":52,"tag":554,"props":3178,"children":3180},{"class":556,"line":3179},27,[3181],{"type":52,"tag":554,"props":3182,"children":3183},{"style":2682},[3184],{"type":58,"value":3185},"\u003C!-- Low-likelihood or already mitigated — no action required -->\n",{"type":52,"tag":554,"props":3187,"children":3189},{"class":556,"line":3188},28,[3190],{"type":52,"tag":554,"props":3191,"children":3192},{"emptyLinePlaceholder":2549},[3193],{"type":58,"value":2552},{"type":52,"tag":554,"props":3195,"children":3197},{"class":556,"line":3196},29,[3198,3202,3207,3212,3216,3221,3226,3230,3234,3238,3243,3248,3252,3256,3260,3264,3268,3273,3278,3282],{"type":52,"tag":554,"props":3199,"children":3200},{"style":572},[3201],{"type":58,"value":863},{"type":52,"tag":554,"props":3203,"children":3204},{"style":572},[3205],{"type":58,"value":3206}," [",{"type":52,"tag":554,"props":3208,"children":3209},{"style":566},[3210],{"type":58,"value":3211},"x",{"type":52,"tag":554,"props":3213,"children":3214},{"style":572},[3215],{"type":58,"value":1974},{"type":52,"tag":554,"props":3217,"children":3218},{"style":2707},[3219],{"type":58,"value":3220}," **",{"type":52,"tag":554,"props":3222,"children":3223},{"style":2713},[3224],{"type":58,"value":3225},"TR-003: ",{"type":52,"tag":554,"props":3227,"children":3228},{"style":2707},[3229],{"type":58,"value":1947},{"type":52,"tag":554,"props":3231,"children":3232},{"style":2713},[3233],{"type":58,"value":2725},{"type":52,"tag":554,"props":3235,"children":3236},{"style":2728},[3237],{"type":58,"value":2731},{"type":52,"tag":554,"props":3239,"children":3240},{"style":2707},[3241],{"type":58,"value":3242},">**",{"type":52,"tag":554,"props":3244,"children":3245},{"style":836},[3246],{"type":58,"value":3247}," — mitigated in ",{"type":52,"tag":554,"props":3249,"children":3250},{"style":572},[3251],{"type":58,"value":2749},{"type":52,"tag":554,"props":3253,"children":3254},{"style":566},[3255],{"type":58,"value":2754},{"type":52,"tag":554,"props":3257,"children":3258},{"style":572},[3259],{"type":58,"value":2749},{"type":52,"tag":554,"props":3261,"children":3262},{"style":836},[3263],{"type":58,"value":1607},{"type":52,"tag":554,"props":3265,"children":3266},{"style":572},[3267],{"type":58,"value":1947},{"type":52,"tag":554,"props":3269,"children":3270},{"style":2566},[3271],{"type":58,"value":3272},"brief",{"type":52,"tag":554,"props":3274,"children":3275},{"style":2624},[3276],{"type":58,"value":3277}," note",{"type":52,"tag":554,"props":3279,"children":3280},{"style":572},[3281],{"type":58,"value":1867},{"type":52,"tag":554,"props":3283,"children":3284},{"style":836},[3285],{"type":58,"value":908},{"type":52,"tag":554,"props":3287,"children":3289},{"class":556,"line":3288},30,[3290],{"type":52,"tag":554,"props":3291,"children":3292},{"emptyLinePlaceholder":2549},[3293],{"type":58,"value":2552},{"type":52,"tag":554,"props":3295,"children":3297},{"class":556,"line":3296},31,[3298],{"type":52,"tag":554,"props":3299,"children":3300},{"style":836},[3301],{"type":58,"value":3302},"---\n",{"type":52,"tag":554,"props":3304,"children":3306},{"class":556,"line":3305},32,[3307],{"type":52,"tag":554,"props":3308,"children":3309},{"emptyLinePlaceholder":2549},[3310],{"type":58,"value":2552},{"type":52,"tag":554,"props":3312,"children":3314},{"class":556,"line":3313},33,[3315,3320,3324,3328,3332,3337,3341,3345,3349,3354,3358,3362,3366],{"type":52,"tag":554,"props":3316,"children":3317},{"style":836},[3318],{"type":58,"value":3319},"Summary: ",{"type":52,"tag":554,"props":3321,"children":3322},{"style":572},[3323],{"type":58,"value":1947},{"type":52,"tag":554,"props":3325,"children":3326},{"style":2566},[3327],{"type":58,"value":2586},{"type":52,"tag":554,"props":3329,"children":3330},{"style":572},[3331],{"type":58,"value":1867},{"type":52,"tag":554,"props":3333,"children":3334},{"style":836},[3335],{"type":58,"value":3336}," critical | ",{"type":52,"tag":554,"props":3338,"children":3339},{"style":572},[3340],{"type":58,"value":1947},{"type":52,"tag":554,"props":3342,"children":3343},{"style":2566},[3344],{"type":58,"value":2586},{"type":52,"tag":554,"props":3346,"children":3347},{"style":572},[3348],{"type":58,"value":1867},{"type":52,"tag":554,"props":3350,"children":3351},{"style":836},[3352],{"type":58,"value":3353}," important | ",{"type":52,"tag":554,"props":3355,"children":3356},{"style":572},[3357],{"type":58,"value":1947},{"type":52,"tag":554,"props":3359,"children":3360},{"style":2566},[3361],{"type":58,"value":2586},{"type":52,"tag":554,"props":3363,"children":3364},{"style":572},[3365],{"type":58,"value":1867},{"type":52,"tag":554,"props":3367,"children":3368},{"style":836},[3369],{"type":58,"value":3370}," informational\n",{"type":52,"tag":61,"props":3372,"children":3373},{},[3374],{"type":58,"value":3375},"Rules:",{"type":52,"tag":468,"props":3377,"children":3378},{},[3379,3399,3404,3425,3438],{"type":52,"tag":472,"props":3380,"children":3381},{},[3382,3384,3390,3391,3397],{"type":58,"value":3383},"Each item gets a sequential ID: ",{"type":52,"tag":157,"props":3385,"children":3387},{"className":3386},[],[3388],{"type":58,"value":3389},"TR-001",{"type":58,"value":1294},{"type":52,"tag":157,"props":3392,"children":3394},{"className":3393},[],[3395],{"type":58,"value":3396},"TR-002",{"type":58,"value":3398},", … — numbered across all sections",{"type":52,"tag":472,"props":3400,"children":3401},{},[3402],{"type":58,"value":3403},"Each unchecked task must be self-contained: file path, line number, what is wrong, what to do",{"type":52,"tag":472,"props":3405,"children":3406},{},[3407,3409,3415,3417,3423],{"type":58,"value":3408},"\"Fix\" must be a concrete instruction, not a vague suggestion (\"add rate limiting to ",{"type":52,"tag":157,"props":3410,"children":3412},{"className":3411},[],[3413],{"type":58,"value":3414},"\u002Fapi\u002Flogin",{"type":58,"value":3416}," in ",{"type":52,"tag":157,"props":3418,"children":3420},{"className":3419},[],[3421],{"type":58,"value":3422},"routes\u002Fauth.py:34",{"type":58,"value":3424},"\", not \"consider rate limiting\")",{"type":52,"tag":472,"props":3426,"children":3427},{},[3428,3430,3436],{"type":58,"value":3429},"Already-mitigated threats go under Informational as pre-checked ",{"type":52,"tag":157,"props":3431,"children":3433},{"className":3432},[],[3434],{"type":58,"value":3435},"[x]",{"type":58,"value":3437}," items",{"type":52,"tag":472,"props":3439,"children":3440},{},[3441],{"type":58,"value":3442},"The file must be valid Kiro task format so tasks can be executed individually or as a batch",{"type":52,"tag":61,"props":3444,"children":3445},{},[3446],{"type":58,"value":3447},"After writing the file, tell the user:",{"type":52,"tag":2356,"props":3449,"children":3450},{},[3451],{"type":52,"tag":61,"props":3452,"children":3453},{},[3454,3456,3461,3463,3469],{"type":58,"value":3455},"Security review complete. Tasks and artifacts written to ",{"type":52,"tag":157,"props":3457,"children":3459},{"className":3458},[],[3460],{"type":58,"value":967},{"type":58,"value":3462}," — Kiro will pick up ",{"type":52,"tag":157,"props":3464,"children":3466},{"className":3465},[],[3467],{"type":58,"value":3468},"security_fix_tasks.md",{"type":58,"value":3470}," as a task file.",{"type":52,"tag":3472,"props":3473,"children":3474},"style",{},[3475],{"type":58,"value":3476},"html .light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html.light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}",{"items":3478,"total":557},[3479],{"slug":4,"name":5,"fn":6,"description":7,"org":3480,"tags":3481,"stars":27,"repoUrl":28,"updatedAt":29},{"slug":9,"name":10,"logoUrl":11,"githubOrg":12},[3482,3483,3484,3485],{"name":22,"slug":23,"type":17},{"name":25,"slug":26,"type":17},{"name":15,"slug":16,"type":17},{"name":19,"slug":20,"type":17},{"items":3487,"total":3665},[3488,3507,3528,3538,3551,3564,3574,3584,3605,3620,3635,3650],{"slug":3489,"name":3489,"fn":3490,"description":3491,"org":3492,"tags":3493,"stars":3504,"repoUrl":3505,"updatedAt":3506},"agentcore-investigation","investigate Bedrock AgentCore runtime sessions","Investigate Bedrock AgentCore runtime sessions via CloudWatch Logs Insights — resolve session\u002Ftrace IDs, query OTEL spans, filter noise, build timelines. Use when debugging AgentCore agent sessions, tracing tool calls, or analyzing latency.",{"slug":9,"name":10,"logoUrl":11,"githubOrg":12},[3494,3495,3498,3501],{"name":22,"slug":23,"type":17},{"name":3496,"slug":3497,"type":17},"Debugging","debugging",{"name":3499,"slug":3500,"type":17},"Logs","logs",{"name":3502,"slug":3503,"type":17},"Observability","observability",9427,"https:\u002F\u002Fgithub.com\u002Fawslabs\u002Fmcp","2026-07-12T08:37:22.601527",{"slug":3508,"name":3509,"fn":3510,"description":3511,"org":3512,"tags":3513,"stars":3504,"repoUrl":3505,"updatedAt":3527},"amazon-aurora-dsql","amazon aurora dsql","build applications with Aurora DSQL","Build with Aurora DSQL — manage schemas, execute queries, handle migrations, diagnose query plans, load data, and develop applications with a serverless, distributed SQL database. Covers IAM auth, multi-tenant patterns, MySQL-to-DSQL and PostgreSQL-to-DSQL schema conversion, FK replacement code generation, OCC retry patterns, ORM migration (Django\u002FHibernate\u002FRails), DDL operations, query plan explainability, SQL compatibility validation, and bulk data loading. Triggers on phrases like: DSQL, Aurora DSQL, create DSQL table, DSQL schema, migrate to DSQL, distributed SQL database, serverless PostgreSQL-compatible database, DSQL query plan, DSQL EXPLAIN ANALYZE, why is my DSQL query slow, DSQL foreign key, DSQL OCC retry, DSQL multi-region, load into DSQL, load CSV into DSQL, bulk load DSQL, aurora-dsql-loader.",{"slug":9,"name":10,"logoUrl":11,"githubOrg":12},[3514,3517,3518,3521,3524],{"name":3515,"slug":3516,"type":17},"Aurora","aurora",{"name":22,"slug":23,"type":17},{"name":3519,"slug":3520,"type":17},"Database","database",{"name":3522,"slug":3523,"type":17},"Serverless","serverless",{"name":3525,"slug":3526,"type":17},"SQL","sql","2026-07-12T08:36:45.053393",{"slug":3529,"name":3530,"fn":3510,"description":3511,"org":3531,"tags":3532,"stars":3504,"repoUrl":3505,"updatedAt":3537},"aurora-dsql","aurora dsql",{"slug":9,"name":10,"logoUrl":11,"githubOrg":12},[3533,3534,3535,3536],{"name":22,"slug":23,"type":17},{"name":3519,"slug":3520,"type":17},{"name":3522,"slug":3523,"type":17},{"name":3525,"slug":3526,"type":17},"2026-07-12T08:36:42.694299",{"slug":3539,"name":3540,"fn":3510,"description":3511,"org":3541,"tags":3542,"stars":3504,"repoUrl":3505,"updatedAt":3550},"aws-dsql","aws dsql",{"slug":9,"name":10,"logoUrl":11,"githubOrg":12},[3543,3544,3545,3548,3549],{"name":22,"slug":23,"type":17},{"name":3519,"slug":3520,"type":17},{"name":3546,"slug":3547,"type":17},"Migration","migration",{"name":3522,"slug":3523,"type":17},{"name":3525,"slug":3526,"type":17},"2026-07-12T08:36:38.584057",{"slug":3552,"name":3553,"fn":3510,"description":3511,"org":3554,"tags":3555,"stars":3504,"repoUrl":3505,"updatedAt":3563},"distributed-postgres","distributed postgres",{"slug":9,"name":10,"logoUrl":11,"githubOrg":12},[3556,3557,3558,3561,3562],{"name":22,"slug":23,"type":17},{"name":3519,"slug":3520,"type":17},{"name":3559,"slug":3560,"type":17},"PostgreSQL","postgresql",{"name":3522,"slug":3523,"type":17},{"name":3525,"slug":3526,"type":17},"2026-07-12T08:36:46.530743",{"slug":3565,"name":3566,"fn":3510,"description":3511,"org":3567,"tags":3568,"stars":3504,"repoUrl":3505,"updatedAt":3573},"distributed-sql","distributed sql",{"slug":9,"name":10,"logoUrl":11,"githubOrg":12},[3569,3570,3571,3572],{"name":22,"slug":23,"type":17},{"name":3519,"slug":3520,"type":17},{"name":3522,"slug":3523,"type":17},{"name":3525,"slug":3526,"type":17},"2026-07-12T08:36:48.104182",{"slug":3575,"name":3575,"fn":3510,"description":3511,"org":3576,"tags":3577,"stars":3504,"repoUrl":3505,"updatedAt":3583},"dsql",{"slug":9,"name":10,"logoUrl":11,"githubOrg":12},[3578,3579,3580,3581,3582],{"name":22,"slug":23,"type":17},{"name":3519,"slug":3520,"type":17},{"name":3546,"slug":3547,"type":17},{"name":3522,"slug":3523,"type":17},{"name":3525,"slug":3526,"type":17},"2026-07-12T08:36:36.374512",{"slug":3585,"name":3585,"fn":3586,"description":3587,"org":3588,"tags":3589,"stars":3602,"repoUrl":3603,"updatedAt":3604},"cost-efficiency-analyzer","analyze cost efficiency and expenses","Analyzes cost structure, cost efficiency, and expense management from P&L data. Use when the user asks about costs, expenses, COGS, operating expenses, cost ratios, cost control, spending efficiency, margin compression from cost side, or wants to understand where money is going. Also use for \"are we spending too much\", \"cost breakdown\", \"expense analysis\", or \"how efficient are our operations\". NOT for revenue or top-line analysis.",{"slug":9,"name":10,"logoUrl":11,"githubOrg":12},[3590,3593,3596,3599],{"name":3591,"slug":3592,"type":17},"Accounting","accounting",{"name":3594,"slug":3595,"type":17},"Analytics","analytics",{"name":3597,"slug":3598,"type":17},"Cost Optimization","cost-optimization",{"name":3600,"slug":3601,"type":17},"Finance","finance",3176,"https:\u002F\u002Fgithub.com\u002Fawslabs\u002Fagentcore-samples","2026-07-12T08:40:03.29555",{"slug":3606,"name":3606,"fn":3607,"description":3608,"org":3609,"tags":3610,"stars":3602,"repoUrl":3603,"updatedAt":3619},"executive-financial-briefing","generate executive financial briefings","Generates a concise executive-level financial briefing or summary suitable for a CEO, CFO, or board presentation. Use when the user asks for a summary, briefing, executive summary, board update, financial overview, financial health check, or \"how is the business doing\". Covers the full P&L picture in one page. Also use for \"give me the highlights\", \"what do I need to know\", or \"quick financial update\".",{"slug":9,"name":10,"logoUrl":11,"githubOrg":12},[3611,3612,3613,3616],{"name":22,"slug":23,"type":17},{"name":3600,"slug":3601,"type":17},{"name":3614,"slug":3615,"type":17},"Management","management",{"name":3617,"slug":3618,"type":17},"Reporting","reporting","2026-07-12T08:40:02.066471",{"slug":3621,"name":3621,"fn":3622,"description":3623,"org":3624,"tags":3625,"stars":3602,"repoUrl":3603,"updatedAt":3634},"multi-quarter-trend-analysis","analyze multi-quarter financial trends","Analyzes financial trends across multiple quarters by comparing P&L metrics over time. Use when the user wants to see trends, patterns, trajectories, or directional movement across 3 or more quarters. Also use for \"how are we trending\", \"show me the trend\", \"track performance over time\", \"quarter over quarter comparison across all quarters\", or any multi-period longitudinal analysis.",{"slug":9,"name":10,"logoUrl":11,"githubOrg":12},[3626,3627,3628,3631],{"name":3594,"slug":3595,"type":17},{"name":3600,"slug":3601,"type":17},{"name":3629,"slug":3630,"type":17},"Financial Statements","financial-statements",{"name":3632,"slug":3633,"type":17},"Variance Analysis","variance-analysis","2026-07-12T08:40:00.79141",{"slug":3636,"name":3636,"fn":3637,"description":3638,"org":3639,"tags":3640,"stars":3602,"repoUrl":3603,"updatedAt":3649},"pdf","process and manipulate PDF documents","Use this skill whenever the user wants to do anything with PDF files. This includes reading or extracting text\u002Ftables from PDFs, combining or merging multiple PDFs into one, splitting PDFs apart, rotating pages, adding watermarks, creating new PDFs, filling PDF forms, encrypting\u002Fdecrypting PDFs, extracting images, and OCR on scanned PDFs to make them searchable. If the user mentions a .pdf file or asks to produce one, use this skill.",{"slug":9,"name":10,"logoUrl":11,"githubOrg":12},[3641,3644,3647],{"name":3642,"slug":3643,"type":17},"Automation","automation",{"name":3645,"slug":3646,"type":17},"Documents","documents",{"name":3648,"slug":3636,"type":17},"PDF","2026-07-12T08:41:44.135656",{"slug":3651,"name":3651,"fn":3652,"description":3653,"org":3654,"tags":3655,"stars":3602,"repoUrl":3603,"updatedAt":3664},"quarterly-kpi-calculator","calculate quarterly financial KPIs","Calculates quarterly financial KPIs from P&L data. P&L figures can be provided directly by the user or fetched from the financial data MCP server. Use when the user wants KPI calculations such as Gross Margin %, EBITDA Margin %, Operating Expense Ratio, or Revenue Growth % QoQ. Also use for quarterly performance review, P&L analysis, or interpreting financial ratios against benchmarks.",{"slug":9,"name":10,"logoUrl":11,"githubOrg":12},[3656,3657,3660,3661],{"name":3591,"slug":3592,"type":17},{"name":3658,"slug":3659,"type":17},"Data Analysis","data-analysis",{"name":3600,"slug":3601,"type":17},{"name":3662,"slug":3663,"type":17},"KPI","kpi","2026-07-12T08:39:59.54971",150]