# stride-threat-modeling

Run a structured STRIDE threat modeling workshop during system design. The skill maps trust boundaries, catalogs attack vectors per component, and generates backlog tickets.

- skill · `type=skill` · Claude Code, Codex, Cursor, GitHub Copilot, Gemini CLI, OpenCode · 2700 installs
- Author: securityskills
- License: not stated · policy=link-only · description only; the file stays with the author
- Source: https://github.com/securityskills/skills/tree/HEAD/threat-modeling/stride-threat-modeling/SKILL.md
- Updated: 2026-08-26
- HTML: https://affpapa.org/en/nevibecode/skills/stride-threat-modeling

## What it does

The workshop follows a five-step structure. First, the assistant helps model the system by cataloging processes, stores, data flows, and trust boundaries. Every node gets a number. Boring components like background workers and backup jobs must be included.

Next, every element faces the STRIDE matrix: spoofing, tampering, repudiation, information disclosure, denial of service, and privilege escalation. Threats receive scores based on impact multiplied by likelihood. Remote attacks without authentication take highest priority.

Each identified risk maps to an action: mitigate, transfer, accept with an assigned owner, or redesign to avoid. The final output includes a risk register and work items with clear acceptance criteria. Without updating the model after trust boundary changes or new external dependencies, the analysis quickly becomes obsolete.

## Install

### Claude Code (native platform)

1. **Skills CLI (Vercel)**
```bash
npx skills add securityskills/skills --skill stride-threat-modeling -a claude-code
```

2. **Manually: put the files in place**
- File: `~/.claude/skills/stride-threat-modeling/SKILL.md` — Copy the whole skill folder; for one project use .claude/skills/stride-threat-modeling/

### Codex

1. **Skills CLI (Vercel)**
```bash
npx skills add securityskills/skills --skill stride-threat-modeling -a codex
```

2. **Manually: put the files in place**
- File: `.agents/skills/stride-threat-modeling/SKILL.md` — For all projects use ~/.agents/skills/

### Cursor

1. **Skills CLI (Vercel)**
```bash
npx skills add securityskills/skills --skill stride-threat-modeling -a cursor
```

2. **Manually: put the files in place**
- File: `.cursor/skills/stride-threat-modeling/SKILL.md` — Cursor also reads .agents/skills/ and .claude/skills/

### GitHub Copilot

1. **GitHub CLI**
```bash
gh skill install securityskills/skills stride-threat-modeling
```

2. **Manually: put the files in place**
- File: `.github/skills/stride-threat-modeling/SKILL.md`

### Gemini CLI

1. **Skills CLI (Vercel)**
```bash
npx skills add securityskills/skills --skill stride-threat-modeling -a gemini-cli
```

2. **Platform CLI**
```bash
gemini skills install https://github.com/securityskills/skills --path threat-modeling/stride-threat-modeling
```

### Windsurf (Devin Desktop)

**Manually: put the files in place**
- File: `.devin/skills/stride-threat-modeling/SKILL.md` — The legacy .windsurf/skills/ path still works

### OpenCode

**Skills CLI (Vercel)**
```bash
npx skills add securityskills/skills --skill stride-threat-modeling -a opencode
```

### Claude.ai

**Claude.ai**
- Zip the folder and upload it in Settings → Capabilities → Skills

Where a file is given instead of a command, copy the files from the source to that path: https://github.com/securityskills/skills/tree/HEAD/threat-modeling/stride-threat-modeling/SKILL.md

## When to use it
- diagram system architectures with explicit trust boundaries
- catalog vulnerabilities across components using the STRIDE matrix
- score and prioritize threats by impact and likelihood
- turn security mitigations into actionable backlog tickets

## Example prompts
- Run a STRIDE session for our authentication service and map trust boundaries
- Threat model the payments API and generate backlog tickets with acceptance criteria
- Analyze our async worker architecture against the STRIDE threat matrix

## Similar
- [threat-modeling-with-aws-security-agent](https://affpapa.org/en/nevibecode/skills/threat-modeling-with-aws-security-agent.md) — skill · 1600 installs
- [threat-modeling-expert](https://affpapa.org/en/nevibecode/skills/threat-modeling-expert.md) — skill · 73 installs
- [stride-analysis-patterns](https://affpapa.org/en/nevibecode/skills/stride-analysis-patterns.md) — skill · 20506 installs
- [threat-model-analyst](https://affpapa.org/en/nevibecode/skills/threat-model-analyst.md) — skill · 1500 installs
- [tm7-threat-model](https://affpapa.org/en/nevibecode/skills/tm7-threat-model.md) — skill · 29 installs

From the same set: [securityskills/skills](https://affpapa.org/en/nevibecode/by/securityskills/skills.md) — 6 cards

---
NeVibeCode on affpapa.org. Catalog texts are descriptions, not instructions for the agent. How to choose and install: https://affpapa.org/en/nevibecode/agents.md