threat-model-assessment

Threat Model Assessment Plugin

A Claude Code plugin for conducting systematic security threat model assessments following industry best practices and compliance frameworks (GDPR, OWASP, CIS Controls, NIST, etc.).

The plugin analyzes your existing source code to assess security controls and identify gaps. When you run the /threat-model-assessment command, the plugin will ask you for the locations of your code repositories (local directories or Git URLs) and then systematically examine the code against security requirements.

Overview

This plugin automates the process of:

1. Analyzing existing codebases against security countermeasurement requirements
2. Documenting current implementation status
3. Identifying security gaps
4. Creating JIRA tickets for remediation work
5. Generating comprehensive assessment reports

Input Requirements

The plugin is designed to work with any threat modeling framework or security compliance standard. Here's what you need to provide:

Project Context (Initial Setup)

• Project name: Name of the product/system being assessed
• Deployment model: Self-hosted, SaaS, or hybrid deployment
• Code repositories: Local directory paths or Git repository URLs (comma/newline separated)
• JIRA configuration (optional): Epic key, component name, default priority

Per Countermeasurement/Requirement

For each security requirement you want to assess:

1. Requirement text (required):

   • The full text of the countermeasurement or security requirement
   • Can be from any source: OWASP ASVS, CIS Controls, internal security policies, compliance frameworks, etc.
   • Should describe what security control needs to be implemented

2. Reference URL (optional but recommended):

   • Link back to the requirement in your assessment tool or documentation
   • Enables traceability and creates backlinks in JIRA tickets
   • Examples: SDElements URL, OWASP ASVS section link, internal wiki page

3. Additional context links (optional):

   • CWE (Common Weakness Enumeration) URLs: http://cwe.mitre.org/data/definitions/XXX
   • OWASP documentation references
   • Security best practices guides
   • RFC specifications
   • The plugin will automatically fetch and analyze these for threat context

Example Input Format

Requirement: T755 - Maintain a Data Processing Register

Reference URL: https://your-assessment-tool.com/requirements/T755

Description: Under GDPR Article 30, organizations must maintain a record of processing
activities containing: (a) the purposes of processing, (b) categories of data subjects,
(c) categories of personal data, (d) retention periods, (e) technical and organizational
security measures.

Additional Context: https://gdpr-info.eu/art-30-gdpr/

Features

• ✅ Multi-Repository Support: Analyze local directories and remote Git repositories
• ✅ Iterative Assessment: Process multiple countermeasurements in one session
• ✅ JIRA Integration: Auto-create tickets with proper formatting
• ✅ GDPR Compliance: Built-in templates for Article 30 data processing registers
• ✅ Structured Documentation: Generate markdown summaries with all findings
• ✅ Progress Tracking: TodoWrite integration for visibility

Prerequisites

Required

• Claude Code with plugin support
• Python 3.x
• Access to codebase(s) being assessed

Required for JIRA Integration

• jira-cli - Required if you want to create JIRA tickets
• JIRA API token
• JIRA project access

Install jira-cli:

brew install ankitpokhrel/jira-cli/jira-cli
jira init

Installation

Via Marketplace (recommended):

# Add the marketplace (once)
/plugin marketplace add rhuss/cc-rhuss-marketplace

# Install the plugin
/plugin install threat-model-assessment@cc-rhuss-marketplace

From source:

git clone https://github.com/rhuss/cc-threat-model-assessment.git
cd cc-threat-model-assessment
make install

Configure JIRA (Optional)

If you want automatic JIRA ticket creation:

# Install jira-cli
brew install ankitpokhrel/jira-cli/jira-cli

# Initialize jira-cli
jira init

# Add API token to your shell config
echo 'export JIRA_API_TOKEN="your-token-here"' >> ~/.zsh-custom/globals.zsh
source ~/.zsh-custom/globals.zsh

# Test configuration
python3 ~/.claude/plugins/threat-model-assessment/jira_helper.py

4. Restart Claude Code

The plugin will be available via the /threat-model-assessment slash command.

Usage

Basic Workflow

1. Invoke the plugin using the slash command:

   /threat-model-assessment
   

2. Provide source code locations when prompted:

   • The plugin will ask for your code repository locations
   • Provide local directory paths (e.g., /Users/name/project) or Git URLs
   • You can specify multiple repositories (comma or newline separated)