Agent skill · security · wshobson
stride-analysis-patterns
Apply STRIDE methodology to systematically identify threats. Use when analyzing system security, conducting threat modeling sessions, or creating security documentation.
Why this skill is useful
Provides a structured approach to threat identification that the AI wouldn't reliably generate on its own, including specific questions and control families for each STRIDE category.
What it needs
About 1k tokens when loaded. Last updated 2026-08-05. 38,570 stars on the source repository.
What this skill does
STRIDE Analysis Patterns Systematic threat identification using the STRIDE methodology. When to Use This Skill Starting new threat modeling sessions Analyzing existing system architecture Reviewing security design decisions Creating threat documentation Training teams on threat identification Compliance and audit preparation Core Concepts 1. STRIDE Categories 2. Threat Analysis Matrix Category Question Control Family ------------------- ----------------------------------------- -------------- Spoofing Can attacker pretend to be someone else? Authentication Tampering Can attacker modify data in transit/rest? Integrity Repudiation Can attacker deny actions? Logging/Audit Info Disclosure Can attacker access unauthorized data? Encryption DoS Can attacker disrupt availability? Rate limiting Elevation Can attacker gain higher privileges? Authorization Templates and detailed worked examples Full template library lives in references/details.md. Read that file when you need concrete templates for this skill. Best Practices Do's Involve stakeholders - Security, dev, and ops perspectives Be systematic - Cover all STRIDE categories Prioritize realistically - Focus on high-impact threats Update regularly - Threat models are living documents Use visual aids - DFDs help communication Don'ts Don't skip categories - Each reveals different threats Don't assume security - Question every component Don't work in isolation - Collaborative modeling is better Don't ignore low-probability - High-impact threats matter Don't stop at identification - Follow through with mitigations
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills wshobson/stride-analysis-patterns