# Stride Analysis Patterns

> Apply STRIDE methodology to systematically identify threats. Use when analyzing system security, conducting threat modeling sessions, or creating security documentation.

Source: https://skillsagentes.com/skills/wshobson/agents/stride-analysis-patterns
Repository: https://github.com/wshobson/agents
Author: wshobson
License: MIT
Updated: hace 2 meses
Context cost: 42 tok installed, 613 tok once triggered, 5.2k tok with every bundled file
Bundle: 2 files, 20 KB
Permissions requested: none declared

## Install

```bash
npx -y skills add wshobson/agents --skill stride-analysis-patterns --agent claude-code
```

## What it does

- Aplica la metodología STRIDE para identificar amenazas de forma sistemática
- Ofrece una matriz de análisis con preguntas y familias de control por categoría STRIDE
- Remite a una biblioteca de plantillas en references/details.md para ejemplos concretos

## Use it when

- Al iniciar sesiones de threat modeling
- Al analizar arquitectura de sistemas existente
- Al revisar decisiones de diseño de seguridad
- Al preparar documentación de amenazas o auditorías de cumplimiento

## What triggers it

- "Ayúdame a hacer un threat modeling STRIDE de este sistema"
- "Analiza las amenazas de spoofing y elevación de privilegios en esta arquitectura"
- "Genera documentación de amenazas para la auditoría de seguridad"

## Files

- SKILL.md — 2 KB
- references/details.md — 18 KB

## SKILL.md

Reproduced verbatim from wshobson/agents under MIT. This section is the upstream document and is in English.

# STRIDE Analysis Patterns

Systematic threat identification using the STRIDE methodology.

## When to Use This Skill

- Starting new threat modeling sessions
- Analyzing existing system architecture
- Reviewing security design decisions
- Creating threat documentation
- Training teams on threat identification
- Compliance and audit preparation

## Core Concepts

### 1. STRIDE Categories

```
S - Spoofing       → Authentication threats
T - Tampering      → Integrity threats
R - Repudiation    → Non-repudiation threats
I - Information    → Confidentiality threats
    Disclosure
D - Denial of      → Availability threats
    Service
E - Elevation of   → Authorization threats
    Privilege
```

### 2. Threat Analysis Matrix

| Category            | Question                                  | Control Family |
| ------------------- | ----------------------------------------- | -------------- |
| **Spoofing**        | Can attacker pretend to be someone else?  | Authentication |
| **Tampering**       | Can attacker modify data in transit/rest? | Integrity      |
| **Repudiation**     | Can attacker deny actions?                | Logging/Audit  |
| **Info Disclosure** | Can attacker access unauthorized data?    | Encryption     |
| **DoS**             | Can attacker disrupt availability?        | Rate limiting  |
| **Elevation**       | Can attacker gain higher privileges?      | Authorization  |

## Templates and detailed worked examples

Full template library lives in `references/details.md`. Read that file when you need concrete templates for this skill.

## Best Practices

### Do's

- **Involve stakeholders** - Security, dev, and ops perspectives
- **Be systematic** - Cover all STRIDE categories
- **Prioritize realistically** - Focus on high-impact threats
- **Update regularly** - Threat models are living documents
- **Use visual aids** - DFDs help communication

### Don'ts

- **Don't skip categories** - Each reveals different threats
- **Don't assume security** - Question every component
- **Don't work in isolation** - Collaborative modeling is better
- **Don't ignore low-probability** - High-impact threats matter
- **Don't stop at identification** - Follow through with mitigations

---

Skills Agentes — https://skillsagentes.com/skills/wshobson/agents/stride-analysis-patterns