stride-analysis-patterns
Apply STRIDE methodology to systematically identify threats
by wshobsonFree
Description
stride-analysis-patterns is an agent skill from the wshobson/agents collection for finding threats in a system with the STRIDE methodology. STRIDE sorts threats into six categories: spoofing, tampering, repudiation, information disclosure, denial of service and elevation of privilege. Walking a system through each category gives a structured way to ask what could go wrong, rather than relying on whoever is in the room to think of everything. The skill is built around the categories themselves, which are its core concepts, so the agent can apply each one to every component and data flow it examines. It applies when starting a new threat modeling session, analyzing an existing system architecture, reviewing security design decisions, writing threat documentation, training teams to identify threats, and preparing for compliance and audits. The output is a list of candidate threats grouped by category, which a team then assesses for likelihood and impact and decides how to handle. STRIDE finds candidates rather than confirmed risks, so a threat model still needs review by people who know the system. The skill is installed with the skills CLI from the wshobson/agents repository. Its skills.sh page showed about 19.3K installs and passing results from three security audits at the time of the scan.…
Highlights
- Six STRIDE threat categories
- Threat identification for architectures and designs
- Structured threat documentation
- Team training on threat identification
- Support for compliance and audit preparation
- Installs with the skills CLI
Ratings & Reviews
No ratings yet
Be the first to rate stride-analysis-patterns.
People also visit
stride-analysis-patterns FAQ
What is STRIDE?
A threat classification with six categories: spoofing, tampering, repudiation, information disclosure, denial of service and elevation of privilege.
What does the skill produce?
Candidate threats grouped by STRIDE category, which a team then assesses for likelihood and impact.
Does it confirm real risks?
No. It finds candidate threats, and people who know the system need to assess them.
Who is it for?
Security reviewers, architects and teams running threat modeling sessions or preparing for audits.
How do I install it?
Run npx skills add https://github.com/wshobson/agents --skill stride-analysis-patterns.
What security audits does it have?
skills.sh lists three audits: Gen Agent Trust Hub Pass, Socket Pass and Snyk Pass.
What are the best stride-analysis-patterns alternatives?
Popular alternatives to stride-analysis-patterns include threat-model-analyst, attack-tree-construction and senior-security. See all stride-analysis-patterns alternatives