Name: stride-analysis-patterns
Author: wshobson

Imported from wshobson/agents (plugins/security-scanning/skills/stride-analysis-patterns/SKILL.md) via skills.sh. Install upstream with npx skills add wshobson/agents --skill stride-analysis-patterns. Copyright stays with the author.

STRIDE Analysis Patterns

Systematic threat identification using the STRIDE methodology.

When to Use This Skill

Starting new threat modeling sessions
Analyzing existing system architecture
Reviewing security design decisions
Creating threat documentation
Training teams on threat identification
Compliance and audit preparation

Core Concepts

1. STRIDE Categories

S - Spoofing       → Authentication threats
T - Tampering      → Integrity threats
R - Repudiation    → Non-repudiation threats
I - Information    → Confidentiality threats
    Disclosure
D - Denial of      → Availability threats
    Service
E - Elevation of   → Authorization threats
    Privilege

2. Threat Analysis Matrix

Category	Question	Control Family
Spoofing	Can attacker pretend to be someone else?	Authentication
Tampering	Can attacker modify data in transit/rest?	Integrity
Repudiation	Can attacker deny actions?	Logging/Audit
Info Disclosure	Can attacker access unauthorized data?	Encryption
DoS	Can attacker disrupt availability?	Rate limiting
Elevation	Can attacker gain higher privileges?	Authorization

Templates and detailed worked examples

Full template library lives in references/details.md. Read that file when you need concrete templates for this skill.

Best Practices

Do's

Involve stakeholders - Security, dev, and ops perspectives
Be systematic - Cover all STRIDE categories
Prioritize realistically - Focus on high-impact threats
Update regularly - Threat models are living documents
Use visual aids - DFDs help communication

Don'ts

Don't skip categories - Each reveals different threats
Don't assume security - Question every component
Don't work in isolation - Collaborative modeling is better
Don't ignore low-probability - High-impact threats matter
Don't stop at identification - Follow through with mitigations

Install stride-analysis-patterns and it becomes one more candidate the router can pick - when it fits.

A listing is a routing target with a manifest: what it does, which domains it covers, what it costs and who publishes it. Once installed it sits beside your own models and tools, is scored like any other candidate for each request, and shows up in the trace when it wins. Ratings come from workspaces that installed it, one per account.

{ "ocm": "1", "id": "wshobson-agents-stride-analysis-patterns", "kind": "skill", "name": "stride-analysis-patterns", "description": "Apply STRIDE methodology to systematically identify threats. Use when analyzing system security, conducting threat modeling sessions, or creating security documentation.", "publisher": "wshobson", "version": "1.0.0", "capabilities": { "domains": [ "general" ], "tags": [ "skill-md", "skills-sh" ], "languages": [ "en" ] }, "quality_prior": 0.6, "examples": [ "Apply STRIDE methodology to systematically identify threats. Use when analyzing system security, conducting threat modeling sessions, or creating security documentation." ], "primary": false, "metadata": { "source": { "provider": "skills.sh", "repository": "https://github.com/wshobson/agents", "path": "plugins/security-scanning/skills/stride-analysis-patterns/SKILL.md", "ref": "HEAD", "url": "https://www.skills.sh/wshobson/agents/stride-analysis-patterns", "key": "wshobson/agents/plugins/security-scanning/skills/stride-analysis-patterns/SKILL.md" } }, "instructions": "# STRIDE Analysis Patterns\n\nSystematic threat identification using the STRIDE methodology.\n\n## When to Use This Skill\n\n- Starting new threat modeling sessions\n- Analyzing existing system architecture\n- Reviewing security design decisions\n- Creating threat documentation\n- Training teams on threat identification\n- Compliance and audit preparation\n\n## Core Concepts\n\n### 1. STRIDE Categories\n\n```\nS - Spoofing → Authentication threats\nT - Tampering → Integrity threats\nR - Repudiation → Non-repudiation threats\nI - Information → Confidentiality threats\n Disclosure\nD - Denial of ", "cost": { "context_tokens": 554 } }

stride-analysis-patterns

About