mcpField
S
stride-analysis-patterns

stride-analysis-patterns

github.com/wshobsonSecurity41.9k21.2k installsUpdated 2w ago
Repository

About stride-analysis-patterns

A structured threat-modeling reference skill for teams applying the STRIDE methodology to new or existing system designs. It helps identify threats across six categories and supports security reviews and documentation.

Key features

  1. 01Six STRIDE threat categories
  2. 02Threat-analysis question matrix
  3. 03Security control family mapping
  4. 04Threat-modeling best practices

Use cases

  1. 01Modeling threats for a new system
  2. 02Reviewing architecture security
  3. 03Preparing threat documentation
  4. 04Training teams in threat identification

Install

Copy the command and run it in a terminal.

$npx skills add https://github.com/wshobson/agents --skill stride-analysis-patterns

After installing, type/stride-analysis-patternsin Claude Code to confirm it loaded.

Bundled filesreferences/details.md

Details

From the project README

STRIDE Analysis Patterns

Systematic threat identification using the STRIDE methodology.

When to Use This Skill

  • Starting new threat modeling sessions
  • Analyzing existing system architecture
  • Reviewing security design decisions
  • Creating threat documentation
  • Training teams on threat identification
  • Compliance and audit preparation

Core Concepts

1. STRIDE Categories
S - Spoofing       → Authentication threats
T - Tampering      → Integrity threats
R - Repudiation    → Non-repudiation threats
I - Information    → Confidentiality threats
    Disclosure
D - Denial of      → Availability threats
    Service
E - Elevation of   → Authorization threats
    Privilege
2. Threat Analysis Matrix
CategoryQuestionControl Family
SpoofingCan attacker pretend to be someone else?Authentication
TamperingCan attacker modify data in transit/rest?Integrity
RepudiationCan attacker deny actions?Logging/Audit
Info DisclosureCan attacker access unauthorized data?Encryption
DoSCan attacker disrupt availability?Rate limiting
ElevationCan attacker gain higher privileges?Authorization

Templates and detailed worked examples

Full template library lives in references/details.md. Read that file when you need concrete templates for this skill.

Best Practices

Do's
  • Involve stakeholders - Security, dev, and ops perspectives
  • Be systematic - Cover all STRIDE categories
  • Prioritize realistically - Focus on high-impact threats
  • Update regularly - Threat models are living documents
  • Use visual aids - DFDs help communication
Don'ts
  • Don't skip categories - Each reveals different threats
  • Don't assume security - Question every component
  • Don't work in isolation - Collaborative modeling is better
  • Don't ignore low-probability - High-impact threats matter
  • Don't stop at identification - Follow through with mitigations

Comments

Markdown supported