stride-threat-modeling — Claude Code skill: how it works and setup
Run a structured STRIDE threat modeling workshop during system design. The skill maps trust boundaries, catalogs attack vectors per component, and generates backlog tickets.
npx skills add securityskills/skills --skill stride-threat-modeling -a claude-codeWhat stride-threat-modeling does
The workshop follows a five-step structure. First, the assistant helps model the system by cataloging processes, stores, data flows, and trust boundaries. Every node gets a number. Boring components like background workers and backup jobs must be included.
Next, every element faces the STRIDE matrix: spoofing, tampering, repudiation, information disclosure, denial of service, and privilege escalation. Threats receive scores based on impact multiplied by likelihood. Remote attacks without authentication take highest priority.
Each identified risk maps to an action: mitigate, transfer, accept with an assigned owner, or redesign to avoid. The final output includes a risk register and work items with clear acceptance criteria. Without updating the model after trust boundary changes or new external dependencies, the analysis quickly becomes obsolete.
What it helps with
- diagram system architectures with explicit trust boundaries
- catalog vulnerabilities across components using the STRIDE matrix
- score and prioritize threats by impact and likelihood
- turn security mitigations into actionable backlog tickets
Example prompts for the agent
- Run a STRIDE session for our authentication service and map trust boundaries
- Threat model the payments API and generate backlog tickets with acceptance criteria
- Analyze our async worker architecture against the STRIDE threat matrix
How to install stride-threat-modeling
1Skills CLI (Vercel)
npx skills add securityskills/skills --skill stride-threat-modeling -a claude-code2Manually: put the files in place
~/.claude/skills/stride-threat-modeling/SKILL.mdCopy the whole skill folder; for one project use .claude/skills/stride-threat-modeling/
1Skills CLI (Vercel)
npx skills add securityskills/skills --skill stride-threat-modeling -a codex2Manually: put the files in place
.agents/skills/stride-threat-modeling/SKILL.mdFor all projects use ~/.agents/skills/
1Skills CLI (Vercel)
npx skills add securityskills/skills --skill stride-threat-modeling -a cursor2Manually: put the files in place
.cursor/skills/stride-threat-modeling/SKILL.mdCursor also reads .agents/skills/ and .claude/skills/
1GitHub CLI
gh skill install securityskills/skills stride-threat-modeling2Manually: put the files in place
.github/skills/stride-threat-modeling/SKILL.md1Skills CLI (Vercel)
npx skills add securityskills/skills --skill stride-threat-modeling -a gemini-cli2Platform CLI
gemini skills install https://github.com/securityskills/skills --path threat-modeling/stride-threat-modelingManually: put the files in place
.devin/skills/stride-threat-modeling/SKILL.mdThe legacy .windsurf/skills/ path still works
Skills CLI (Vercel)
npx skills add securityskills/skills --skill stride-threat-modeling -a opencodeClaude.ai
Zip the folder and upload it in Settings → Capabilities → Skills
Step by step, with commands for each platform: How to install skills in Claude Code: five ways
Questions about stride-threat-modeling
How do I install stride-threat-modeling in Claude Code?
Run npx skills add securityskills/skills --skill stride-threat-modeling -a claude-code in your terminal. You can also place the skill file directly at ~/.claude/skills/stride-threat-modeling/SKILL.md.
What does stride-threat-modeling do?
It guides you through an architectural security review using the STRIDE framework. The skill maps system components, evaluates threats across six attack categories, ranks risks, and produces implementation tickets.
When should you re-evaluate the threat model?
Review the model whenever your architecture introduces new external dependencies, modifies trust boundaries, or introduces new data classifications. Post-incident reviews in production should also feed into future evaluations.
