Guide · Agent skill
How to use the STRIDE Threat Analysis agent skill
Updated · written with AI from the project's own documentation and checked against our catalogue data
The STRIDE Threat Analysis skill (stride-analysis-patterns) is a set of instructions that lets an AI agent work through the STRIDE threat modeling method when you describe a system. This guide explains what the skill does, how to install it, how to ask for it in plain language, and where its output should and should not be trusted. By the end you will be able to run a structured threat brainstorm on a service or feature.
STRIDE Threat Analysiswshobson/agents · MIT Download the skill Quick start
- 1Download the ZIP. Get the stride-analysis-patterns ZIP from the skill page on this site.
- 2Unzip the skill folder. Extract it so that SKILL.md and references/details.md are inside a stride-analysis-patterns folder.
- 3Place it in the skills folder. Move the folder to ~/.claude/skills/ for personal use, or to .claude/skills/ inside a project.
- 4Or upload it in the Claude apps. In the Claude apps, go to Settings → Capabilities → Skills and upload the skill.
- 5Describe your system. Write a short description of the components, data flows and sensitive assets, and state your goal.
- 6Ask for a STRIDE analysis. Request analysis across all six categories, or ask for a threat model document using the template.
- 7Verify the output. Check each suggested threat and control against your real architecture before relying on it.
What the skill makes the agent do
STRIDE is a method for finding security threats by asking six questions about each part of a system. The categories are Spoofing (can someone pretend to be someone else?), Tampering (can data be changed in transit or at rest?), Repudiation (can someone deny their actions?), Information Disclosure (can someone see data they shouldn't?), Denial of Service (can someone disrupt availability?), and Elevation of Privilege (can someone gain higher privileges?).
With the skill installed, the agent goes through those six categories systematically when you describe a system. For each one it suggests threats and points to a matching control area: authentication, integrity, logging/audit, encryption, rate limiting or authorization.
- Spoofing maps to authentication
- Tampering maps to integrity
- Repudiation maps to logging/audit
- Information Disclosure maps to encryption
- Denial of Service maps to rate limiting
- Elevation of Privilege maps to authorization
Install the skill from the ZIP or the Claude apps
Download the ZIP from the skill's page on this site and unzip it. The skill is a folder containing SKILL.md and references/details.md. Place that folder in one of these locations: ~/.claude/skills/ to make it available to you across projects, or a project's .claude/skills/ folder to make it available only inside that project.
If you use the Claude apps instead, you can upload the skill under Settings → Capabilities → Skills.
- Personal install: ~/.claude/skills/
- Project install: .claude/skills/ inside your project
Trigger the skill with a natural request
You do not need a special command. The skill's description says to use it when analyzing system security, conducting threat modeling sessions, or creating security documentation, so describe your goal in those terms and include the system details. The more concrete your description of components, data flows and trust boundaries, the more useful the output.
- Describe the components (web app, API, database, queue) and how data moves between them.
- Say what kind of output you want: threats by category, a threat model document, or a training walkthrough.
- Name the sensitive assets, such as credentials, personal data or payment details.
Example requests
Here are requests that match the skill's purpose. Adjust the details to your own system.
- "Run a STRIDE analysis on a login service that uses JWT tokens, talks to a Postgres database and sits behind an API gateway."
- "We're holding a threat modeling session for a new file upload feature. Walk through all six STRIDE categories and suggest controls."
- "Create a threat model document for our payments API using the STRIDE template."
- "Teach our team how to identify threats with STRIDE, using a simple example web app."
Use the templates in references/details.md
The skill includes a reference file with a threat model document template and worked examples. The template covers a system overview with a data flow diagram, trust boundaries, an assets table with sensitivity ratings, and a STRIDE analysis section with a table for each category (ID, threat, target, impact, likelihood). Ask the agent to follow this template when you need documentation or audit evidence.
Safety notes and what the skill needs
The skill requires nothing to be installed beyond itself. It does not run scripts and does not use the network. It is a set of written instructions and templates, so it cannot scan your systems or test them.
Treat the output as a structured brainstorm. It is not a verified assessment of your real architecture, and it is not a penetration test or a compliance certification. Check every suggested threat against how your system actually works.
- Requires: nothing listed
- Runs scripts: no
- Uses network: no
Tips for better results
Give the agent a diagram or a clear list of components before asking for analysis. Work through all six categories rather than the ones that seem most likely, because each category tends to reveal different threats. Keep the threat model as a living document and revisit it when the design changes.
- Involve security, developers and operations in the session.
- Prioritize by impact, but do not drop low-probability, high-impact threats.
- Follow each threat through to a mitigation and an owner.
What people use it for
- Preparing a threat modeling session for a new service or feature
- Drafting threat documentation for a security team
- Producing audit-friendly threat model write-ups using the template
- Teaching engineers or students how to identify threats with STRIDE
Frequently asked questions
How do I install the stride-analysis-patterns skill?
Download the ZIP from the skill page and unzip it. Put the folder in ~/.claude/skills/ for personal use or in a project's .claude/skills/ folder. In the Claude apps, you can instead upload it under Settings → Capabilities → Skills.
Does this skill need anything else installed?
The source lists no requirements. The skill runs no scripts and uses no network access, so it consists of instructions and reference templates only.
Is the STRIDE Threat Analysis skill free?
The skill is published under the MIT licence, as listed on the item page. Check the licence file in the repository for the exact terms.
What is STRIDE?
STRIDE is a threat identification method with six categories: Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service and Elevation of Privilege. Each category has a matching control area such as authentication, encryption or authorization.
Can this skill replace a penetration test?
No. The output is a structured brainstorm, not a verified assessment of a real system. Use it to prepare for a threat modeling session, and rely on a professional penetration test or expert review for validation.
Why doesn't the agent use my skill after I installed it?
Check that the folder is named stride-analysis-patterns and contains SKILL.md in the right place. Then describe your task in threat modeling terms, such as analyzing system security or creating threat documentation, since that is what the skill's description matches.
New agent skills, repos and AI tools — every week
The best new skills and open-source projects, the fastest-growing repos, and one free prompt. Five minutes to read. Unsubscribe anytime.
Our verdict
Engineers preparing a threat modeling session, security teams writing threat documentation, and students learning STRIDE will get a useful, systematic checklist from this skill. It is not suited to replacing a penetration test, expert review or compliance sign-off, and its suggestions must be checked against your actual architecture.
Download the skill