skill request: threat modeling — OWASP Threat Dragon for interactive diagram-based modeling

## Summary

The `threatmodel` category has a single skill (`pytm`) which is code-first and requires Python fluency. The majority of threat modeling practitioners use diagram-based tools (data flow diagrams, trust boundary annotations). [OWASP Threat Dragon](https://owasp.org/www-project-threat-dragon/) is the standard open-source option: a free, desktop/web app that produces STRIDE-mapped threat models as JSON files that can be committed to source control and reviewed in PRs.

## Requested Skill: `threatmodel/threatdragon`

### What to Cover

**Core workflows**:

1. **Create a threat model for a new service** — define components, data flows, trust boundaries, and STRIDE threats using Threat Dragon's GUI, then save the `.json` model file to the repo

2. **CLI-based threat model generation from architecture diagrams**
```bash
# Export threats as JSON for CI integration
threat-dragon export --model threat-models/api-gateway.json --format json
```

3. **Review a threat model in a PR** — diff the `.json` model file to see what threats were added/removed/mitigated

4. **Generate a threat report** — produce a markdown or PDF summary of all identified threats, their severity (STRIDE category), and mitigation status
```bash
threat-dragon report --model threat-models/api-gateway.json --output report.md
```

5. **STRIDE threat enumeration checklist** — for each component type (web app, API, database, message queue, identity provider), enumerate applicable STRIDE threats

### STRIDE Coverage Table

| Component | S | T | R | I | D | E |
|---|---|---|---|---|---|---|
| Web frontend | XSS → auth bypass | Token theft | Missing audit log | Input injection | Cache poisoning | Privilege escalation |
| REST API | JWT forgery | Man-in-the-middle | No request logging | IDOR | Race condition | Admin endpoint exposure |
| Database | SQL injection | Unencrypted at rest | Query log disabled | Schema enumeration | Deadlock DoS | DB user over-privilege |
| Message queue | Message injection | Replay attack | No consumer ACK log | Topic enumeration | Queue flooding | Dead-letter escalation |

### Relationship to Existing Skills

- Complements `pytm` (code-first) — Threat Dragon is better for architecture review early in design phase
- Threats identified here feed directly into `sast-semgrep` rule selection and `dast-nuclei` scan templates
- High-risk threats can pre-populate `devsecops/vuln-defectdojo` findings for tracking

### Frameworks

- OWASP Threat Modeling Cheat Sheet
- STRIDE (Microsoft)
- LINDDUN (privacy threat modeling)
- PASTA (Process for Attack Simulation and Threat Analysis)
- NIST SP 800-154 (Data-Centric System Threat Modeling)