Skip to content
Get packs

STRIDE Threat Analysis

Walks an agent through STRIDE threat modeling of a system's security design

Source Download skill
Repository
wshobson/agents
Stars
42,095
Licence
MIT
Files
2 files

What it does

STRIDE is a widely used method for finding security threats by asking six questions about each part of a system: can someone pretend to be someone else (spoofing), change data (tampering), deny their actions (repudiation), see data they shouldn't (information disclosure), disrupt availability (denial of service), or gain higher privileges (elevation of privilege). With this skill installed, the agent systematically works through those six categories when you describe a system, suggesting threats and matching control areas such as authentication, encryption, logging, rate limiting and authorization. It also points to a reference file of templates and worked examples for documenting the results.

Great for

  • Engineers preparing a threat modeling session for a new service or feature
  • Security teams writing threat documentation or audit evidence
  • Students or teams learning how to identify threats with the STRIDE framework

Skip it if

  • Replacing a professional penetration test or expert review: the output is a structured brainstorm, not a verified assessment of a real system
  • Compliance sign-off on its own: it provides no certification and its suggestions should be checked against your actual architecture

Try asking

  • “Run a STRIDE threat analysis on my login and password-reset flow”
  • “Create a threat model document for our new payments API using STRIDE”
  • “Walk me through each STRIDE category for a system that stores customer files in cloud storage”
  • “Help me train my team on identifying threats with STRIDE using a worked example”
Step-by-step guide: how to use STRIDE Threat AnalysisInstall, first run, examples, tips and FAQs

Install in 3 steps

  1. 1

    Download the skill

    The ZIP contains the 2 original files, the MIT licence and an attribution note.

    stride-analysis-patterns.zip
  2. 2

    Add it to your agent

    Claude Code (all projects)

    mkdir -p ~/.claude/skills && unzip stride-analysis-patterns.zip -d ~/.claude/skills/

    Claude Code / Agent SDK (this project only)

    mkdir -p .claude/skills && unzip stride-analysis-patterns.zip -d .claude/skills/

    Claude apps (web/desktop): Settings → Capabilities → Skills → Upload skill, and choose the ZIP.

  3. 3

    Ask for the task

    No special command needed — the agent reads the skill's description and loads it when your request matches. Try one of the prompts above.

Get better results

  • Describe the architecture, data flows and trust boundaries first; the agent gives much better threats with concrete context.
  • Ask the agent to map findings to mitigations and priorities, since the skill emphasises following through beyond identification.
  • Treat the output as a starting list to review with security and operations colleagues rather than a final threat model.

What's inside

  • references/details.md
  • SKILL.md

Redistributed unmodified from wshobson/agents under the MIT licence. The assessment was drafted with AI from the skill's files on 2026-10-29. Skills can instruct your agent to run code — read SKILL.md and any scripts before installing.