stride-analysis-patterns
wshobson/agents
Apply STRIDE methodology to systematically identify threats across authentication, integrity, confidentiality, availability, and authorization.
What is stride-analysis-patterns?
This skill guides you through the STRIDE threat modeling framework to identify security threats across six categories: Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, and Elevation of Privilege. Use it when starting threat modeling sessions, analyzing system architecture, or creating security documentation.
- Organize threat identification across six STRIDE categories (Spoofing, Tampering, Repudiation, Information Disclosure, DoS, Elevation of Privilege)
- Map threats to control families (Authentication, Integrity, Logging/Audit, Encryption, Rate limiting, Authorization)
- Provide systematic questions for each threat category to guide analysis
- Support collaborative threat modeling with stakeholders from security, development, and operations
- Generate threat documentation and audit-ready security assessments
How to install stride-analysis-patterns
npx skills add https://github.com/wshobson/agents --skill stride-analysis-patternsHow to use stride-analysis-patterns
- 1.Gather stakeholders from security, development, and operations teams
- 2.Map your system components and data flows using diagrams (DFDs recommended)
- 3.For each system component, systematically work through each STRIDE category
- 4.Use the threat analysis matrix to ask targeted questions about each threat type
- 5.Document identified threats and map them to relevant control families
- 6.Prioritize threats by impact and likelihood
- 7.Define mitigations and controls for high-priority threats
- 8.Review and update the threat model regularly as the system evolves
Use cases
- Starting new threat modeling sessions for a system or application
- Analyzing existing system architecture to identify security gaps
- Reviewing security design decisions during architecture reviews
- Creating threat documentation for compliance and audit preparation
- Training development teams on systematic threat identification approaches
- Security architects and threat modeling practitioners
- Development teams conducting security design reviews
- Compliance and audit professionals
- Security trainers and educators
- DevOps and infrastructure teams evaluating system security
stride-analysis-patterns FAQ
STRIDE is a structured threat modeling methodology that organizes threats into six categories. It ensures systematic coverage of threat types and helps teams identify security gaps they might otherwise miss.
Yes. Each category reveals different types of threats. Skipping categories leaves security blind spots. The methodology's value comes from systematic coverage.
Involve stakeholders from security, development, and operations. Collaborative modeling brings different perspectives and produces more comprehensive threat identification.
Threat models are living documents. Update them when system architecture changes, new features are added, or threat landscapes evolve.
After identifying threats, prioritize them by impact and likelihood, then define mitigations and controls. Follow through with implementation to address identified risks.
Full instructions (SKILL.md)
Source of truth, from wshobson/agents.
name: stride-analysis-patterns description: Apply STRIDE methodology to systematically identify threats. Use when analyzing system security, conducting threat modeling sessions, or creating security documentation.
STRIDE Analysis Patterns
Systematic threat identification using the STRIDE methodology.
When to Use This Skill
- Starting new threat modeling sessions
- Analyzing existing system architecture
- Reviewing security design decisions
- Creating threat documentation
- Training teams on threat identification
- Compliance and audit preparation
Core Concepts
1. STRIDE Categories
S - Spoofing → Authentication threats
T - Tampering → Integrity threats
R - Repudiation → Non-repudiation threats
I - Information → Confidentiality threats
Disclosure
D - Denial of → Availability threats
Service
E - Elevation of → Authorization threats
Privilege
2. Threat Analysis Matrix
| Category | Question | Control Family |
|---|---|---|
| Spoofing | Can attacker pretend to be someone else? | Authentication |
| Tampering | Can attacker modify data in transit/rest? | Integrity |
| Repudiation | Can attacker deny actions? | Logging/Audit |
| Info Disclosure | Can attacker access unauthorized data? | Encryption |
| DoS | Can attacker disrupt availability? | Rate limiting |
| Elevation | Can attacker gain higher privileges? | Authorization |
Templates and detailed worked examples
Full template library lives in references/details.md. Read that file when you need concrete templates for this skill.
Best Practices
Do's
- Involve stakeholders - Security, dev, and ops perspectives
- Be systematic - Cover all STRIDE categories
- Prioritize realistically - Focus on high-impact threats
- Update regularly - Threat models are living documents
- Use visual aids - DFDs help communication
Don'ts
- Don't skip categories - Each reveals different threats
- Don't assume security - Question every component
- Don't work in isolation - Collaborative modeling is better
- Don't ignore low-probability - High-impact threats matter
- Don't stop at identification - Follow through with mitigations
Related skills
More from wshobson/agents and the wider catalog.
stripe-integration
Implement Stripe payment processing with checkout, subscriptions, and webhooks for PCI-compliant payment flows.
tailwind-design-system
Build scalable design systems with Tailwind CSS v4, design tokens, and responsive component patterns.
task-coordination-strategies
Decompose complex tasks, design dependency graphs, and coordinate multi-agent work across teams.
team-communication-protocols
Structured messaging protocols for coordinating agent teams: direct messages, broadcasts, plan approval, and graceful shutdown.
team-composition-analysis
Design optimal team structures, hiring plans, compensation strategies, and equity allocation for early-stage startups pre-seed through Series A.
team-composition-patterns
Design optimal multi-agent team compositions with sizing heuristics, preset configurations, and agent type selection.