Ready to supercharge your AI agents?

Install any skill in seconds. Free to start, no credit card required.

STRIDE Analysis Patterns · wshobson | DecimalAI

wshobson/stride-analysis-patterns

SkillScore100Maintained

Apply STRIDE methodology to systematically identify threats. Use when analyzing system security, conducting threat modeling sessions, or creating security documentation.

Securityby wshobson

Links this skill to your agents and keeps it current with the author’s updates.

Automatic

Security & AppSec pack

1 · One-time — install the CLI (docs ↗)

pip install decimalai

2 · Get the skill — writes .claude/skills/wshobson-stride-analysis-patterns/SKILL.md

decimalai skills pull wshobson-stride-analysis-patterns --out .claude/skills/

No CLI? Get the same file — curl · raw file

curl -fsSL --create-dirs -o .claude/skills/wshobson-stride-analysis-patterns/SKILL.md https://app.decimal.ai/s/wshobson-stride-analysis-patterns/SKILL.md

Raw file: /s/wshobson-stride-analysis-patterns/SKILL.md ↗ · machine-readable summary at /s/wshobson-stride-analysis-patterns.json ↗

In productionGlobal

how this skill behaves on real traffic · last 30 days

No production data for this skill yet — usage numbers appear here once agents start running it.

Anonymized aggregate across every org using this skill — proof from real production use, not a demo.

Does this skill help? · Benchmark: with vs. withoutsign in to run this on your agents

23 test cases from the publisher’s eval.yaml · each run twice on gemini-3.6-flash — with the skill injected, then without · last run 52d ago

Yes — +13% lift+10% tokens0% turns100% of whole cases pass with skill (23/23)

Test case	Without → With	Effect	Δ tokens	Δ turns
case-02	✗→✓	▲ Improved	16%	0%
case-05	✗→✓	▲ Improved	4%	0%
case-12	✗→✓	▲ Improved	-68%	0%
case-04	✓→✓	＝ Same ✓	-12%	0%
case-01	✓→✓	＝ Same ✓	27%	0%

Showing 5 of 23 cases

SkillSafety

✓ 3 of 3 passed

Code scan15 of 15 checks clean

0 critical · 0 warning · 0 info — scanner v4 — 8/3/2026

live_secretremote_code_executionreverse_shelldata_exfiltrationssrf_metadataagent_snoopinganti_refusaldestructive_commandsobfuscated_unicodeunicode_homoglyphopaque_blobsuspicious_urltool_overreachtrigger_abuseprompt_injection_phrasing

IntentSafe

LLM judge · does the skill do what it claims

ContentClean

LLM judge · policy & harmful-content review

Source

Imported

wshobson / agents

plugins/security-scanning/skills/stride-analysis-patterns/SKILL.md

View on GitHub ↗

License MITImported 8/3/2026Version v1Bundled 1 file

Skill contents

references/

SKILL.md

STRIDE Analysis Patterns

Systematic threat identification using the STRIDE methodology.

When to Use This Skill

Starting new threat modeling sessions
Analyzing existing system architecture
Reviewing security design decisions
Creating threat documentation
Training teams on threat identification
Compliance and audit preparation

Core Concepts

1. STRIDE Categories

S - Spoofing       → Authentication threats
T - Tampering      → Integrity threats
R - Repudiation    → Non-repudiation threats
I - Information    → Confidentiality threats
    Disclosure
D - Denial of      → Availability threats
    Service
E - Elevation of   → Authorization threats
    Privilege

2. Threat Analysis Matrix

| Category | Question | Control Family | | ------------------- | ----------------------------------------- | -------------- | | Spoofing | Can attacker pretend to be someone else? | Authentication | | Tampering | Can attacker modify data in transit/rest? | Integrity | | Repudiation | Can attacker deny actions? | Logging/Audit | | Info Disclosure | Can attacker access unauthorized data? | Encryption | | DoS | Can attacker disrupt availability? | Rate limiting | | Elevation | Can attacker gain higher privileges? | Authorization |

Templates and detailed worked examples

Full template library lives in references/details.md. Read that file when you need concrete templates for this skill.

Best Practices

Do's

Involve stakeholders - Security, dev, and ops perspectives
Be systematic - Cover all STRIDE categories
Prioritize realistically - Focus on high-impact threats
Update regularly - Threat models are living documents
Use visual aids - DFDs help communication

Don'ts

Don't skip categories - Each reveals different threats
Don't assume security - Question every component
Don't work in isolation - Collaborative modeling is better
Don't ignore low-probability - High-impact threats matter
Don't stop at identification - Follow through with mitigations

Illustrative Want to see what wshobson/stride-analysis-patterns would put in front of your model? Preview the rendered body and check its trigger phrases — no LLM call, no signup.

Latest benchmark · publisher runVerified

8/7/2026, 13:04 UTC · 23 cases

Lift

+13%

100% vs 87%

Agent turns

1.0 vs 1.0

Tokens

+10%

1,369.61 vs 1,242.74

fail → pass · 3pass → pass · 20

Per-case results (23)

Case	Status	Duration (ms)			Turns			Tokens			Tool calls
Case	Status	Without	With	Δ	Without	With	Δ	Without	With	Δ	Without	With	Δ
case-04 An unauthenticated attacker intercepts unencrypted database backups stored in an S3 bucket and reads sensitive customer PII. Classify this risk under the STRIDE methodology and identify the primary control family mapped to this category.	pass→pass	5,820	3,359	-42%	1	1	0%	1,214	1,064	-12%	0	0	—
case-01 In a REST API architecture for an e-commerce platform, an attacker could forge user identity headers to impersonate another user. When categorizing this threat under STRIDE, which threat category applies, and what is the standard primary control family used to mitigate it? Provide your classification and recommended control family.	pass→pass	5,888	5,046	-14%	1	1	0%	1,027	1,305	+27%	0	0	—
case-02 During data transit between microservices over an internal network, an attacker with network access could modify financial transaction payloads before they reach the payment gateway. Classify this threat using the STRIDE framework and specify the primary control family that addresses this specific category.	fail→pass	4,781	3,371	-29%	1	1	0%	903	1,047	+16%	0	0	—
case-03 A rogue system administrator executes a critical database deletion in AWS RDS and later claims another user performed the operation or that the event never occurred. Classify this threat under STRIDE and state the primary control family designated to counter it.	pass→pass	4,258	4,424	+4%	1	1	0%	713	1,258	+76%	0	0	—
case-05 An attacker floods an unauthenticated login endpoint with automated request bursts, causing resource exhaustion and preventing legitimate users from accessing the system. Under STRIDE, how is this threat classified and what control family directly maps to mitigating it?	fail→pass	5,525	3,019	-45%	1	1	0%	1,027	1,067	+4%	0	0	—
case-06 A standard regular user exploits a parameter tampering flaw in a web portal to assign themselves the administrator role. Identify the STRIDE category for this threat and the exact control family specified in the STRIDE matrix.	pass→pass	5,911	4,405	-25%	1	1	0%	1,163	1,352	+16%	0	0	—
case-07 During a threat modeling session for a bank's core wire transfer system, the team identifies a rare threat where an attacker corrupts physical HSM tokens. The engineering lead wants to discard this threat because the probability is near zero, even though successful exploitation would collapse the institution. How should low-probability, high-impact threats be handled during STRIDE threat modeling?	pass→pass	13,854	72,553	+424%	1	1	0%	2,241	2,538	+13%	0	0	—
case-08 A team building an internal background worker service decides to perform STRIDE analysis but wants to skip the Repudiation and Spoofing categories because the service only consumes internal RabbitMQ messages. What is the recommended posture regarding category completeness during STRIDE analysis?	pass→pass	9,163	7,815	-15%	1	1	0%	1,516	1,781	+17%	0	0	—
case-09 A senior security architect is assigned to conduct a STRIDE threat model for a new cloud payment gateway. To move fast, the architect plans to draft the entire threat model alone in a silo without holding sessions with development or operations teams. How should security team engagement be structured for STRIDE analysis?	pass→pass	12,801	12,121	-5%	1	1	0%	2,051	2,545	+24%	0	0	—
case-10 When presenting a complex multi-tier application architecture to stakeholders during a STRIDE threat modeling workshop, which visual diagrammatic tool is explicitly recommended to structure and communicate the data flows and trust boundaries?	pass→pass	4,591	2,599	-43%	1	1	0%	804	949	+18%	0	0	—
case-11 A product security team has completed a STRIDE threat analysis workshop and generated a list of 15 identified security threats in a spreadsheet. The team lead proposes archiving the list as a completed compliance artifact without further action items. What is the required next step following threat identification in STRIDE analysis?	pass→pass	7,110	8,542	+20%	1	1	0%	1,260	1,993	+58%	0	0	—
case-12 A software engineer needs concrete STRIDE threat modeling templates and worked examples for a web application project. Where within the skill's reference files can they find the full template library?	fail→pass	12,667	1,352	-89%	1	1	0%	2,171	684	-68%	0	0	—
case-13 You are filling out a STRIDE threat analysis matrix for an API gateway. What fundamental question defines the Spoofing threat category in the threat analysis matrix?	pass→pass	4,279	2,496	-42%	1	1	0%	747	840	+12%	0	0	—
case-14 During a security review, you need to articulate the core diagnostic question associated with the Tampering category in a STRIDE threat matrix. What question should be asked for each component or data flow?	pass→pass	5,585	3,758	-33%	1	1	0%	1,063	886	-17%	0	0	—
case-15 What diagnostic question is assigned to the Repudiation category in the STRIDE Threat Analysis Matrix?	pass→pass	4,659	1,397	-70%	1	1	0%	895	692	-23%	0	0	—
case-16 In a structured STRIDE threat matrix, what exact question is asked to evaluate Information Disclosure risks across system boundaries?	pass→pass	6,047	2,171	-64%	1	1	0%	1,155	822	-29%	0	0	—
case-17 When evaluating a microservice against the STRIDE Threat Analysis Matrix, what core diagnostic question defines the Denial of Service category?	pass→pass	5,109	2,922	-43%	1	1	0%	915	845	-8%	0	0	—
case-18 What core diagnostic question is asked under the Elevation of Privilege category in the STRIDE matrix?	pass→pass	3,211	1,631	-49%	1	1	0%	516	686	+33%	0	0	—
case-19 An engineering group completed a STRIDE threat model during the initial v1.0 release of a SaaS application two years ago. The application has since undergone major architectural changes including microservice decomposition and cloud migration. The tech lead argues the v1.0 threat model is completed and fixed. What is the recommended practice regarding the lifecycle of threat models?	pass→pass	10,158	7,663	-25%	1	1	0%	1,786	1,870	+5%	0	0	—
case-20 While reviewing an AWS deployment during a STRIDE session, a developer suggests skipping security checks on internal AWS Lambda calls because cloud provider internal components are secure by default. What STRIDE best practice applies to component security assumptions?	pass→pass	6,108	7,179	+18%	1	1	0%	1,122	1,562	+39%	0	0	—
case-21 A security analyst needs to compute the CVSS v3.1 Base Score for a remote code execution vulnerability found in Apache Log4j (CVE-2021-44228) where Attack Vector is Network, Attack Complexity is Low, Privileges Required is None, User Interaction is None, Scope is Changed, and Confidentiality, Integrity, and Availability impact are all High. What is the calculated CVSS v3.1 base score vector and numerical score?	pass→pass	6,282	7,751	+23%	1	1	0%	1,585	2,366	+49%	0	0	—
case-22 A threat modeling team uses the DREAD risk rating model (Damage, Reproducibility, Exploitability, Affected Users, Discoverability) to score a vulnerability where Damage=9, Reproducibility=8, Exploitability=6, Affected Users=7, and Discoverability=5. What is the overall DREAD risk score calculated by averaging these five metrics?	pass→pass	2,533	4,044	+60%	1	1	0%	507	939	+85%	0	0	—
case-23 Explain Stage 1 (Define Objectives) and Stage 2 (Define Technical Scope) of the PASTA (Process for Attack Simulation and Threat Analysis) 7-step risk-centric threat modeling methodology, detailing what key deliverables are produced in Stage 1.	pass→pass	10,572	10,937	+3%	1	1	0%	2,202	2,410	+9%	0	0	—

These cases were also screened by the skill’s intent / safety pass.See the Trust review ↗Reproduce this benchmark in Colab ↗

How this skill was measured

DecimalAI ran this skill against gemini-3.6-flash twice over the same eval suite — once with the skill loaded and once without — and compared the two runs case by case. 23 cases were attempted. The headline lift of +13 percentage points is the difference between those two pass rates over the 23 comparable cases.

Model measured: gemini-3.6-flash
Graded by: gemini-3.6-flash
Grading method: judged
Verification: verified
Pass rate without the skill: 87%
Pass rate with the skill: 100%
Cases attempted: 23
Cases counted toward lift: 23
Cases that regressed: 0
Skill version measured: v1
Run completed: 8/7/2026, 13:04 UTC

Measured example — same prompt, with vs. without the skill · from the benchmark run · case case-02

Prompt

During data transit between microservices over an internal network, an attacker with network access could modify financial transaction payloads before they reach the payment gateway. Classify this threat using the STRIDE framework and specify the primary control family that addresses this specific category.

Without the skill loaded, the model failed this case. With it loaded, the same prompt on the same model passed. This is one improved case from the latest verified run; every case, including any that regressed, is in the table above.

Show both answers

SkillScore blends 4 signals1 of 4 complete

BenchmarkPass rate WITH skill on a verified run100

Live evalNeeds ≥10 evaluated traces in 30 days

AI ratingNeeds ≥10 rated traces

AdoptionNeeds ≥10 serves across ≥2 orgs in 30 days

Efficiency · separate axis (at equal correctness)+0% turns+17% tokens

Shown for transparency; not credited unless a verified run shows no correctness regression.

Backed by 1 of 4 signals — each added signal makes the score more robust.

Verified on gemini-3.6-flash · re-tested 51 days ago

Other measured skills in the registry, with their headline benchmark lift.