Works with the AI Agents you already use

    Claude CodeClaude CodeCursorCursorCodex CLICodex CLIMuseMuseDotsDots+22 more

    STRIDE Analyzer

    1

    From code to a prioritized security remediation plan: STRIDE threat modeling for repos, monorepos and multi-repos, with file:line evidence.

    $9

    Secure checkout via Stripe

    Money-back guarantee

    Converts to your local currency at checkout

    Security scanned
    STRIDE Analyzer

    STRIDE Analyzer

    Example session with this skill installed

    Run a STRIDE analysis on the current repository and generate a prioritized remediation plan in the docs folder.

    • Read your context and instructions
    • Compiled the stride analyzer
    • Generated the data export

    I have completed the STRIDE analysis for the repository. I identified the stack (Node.js, PostgreSQL, Redis) and mapped 4 distinct data flows crossing trust boundaries.

    Security Analysis Summary

    The analysis identified 8 open threats, including 2 high-priority (P0/P1) issues related to unencrypted internal flows and missing input validation on the public API gateway.

    Threat Inventory (threats.json)

    IDTitlePrioritySTRIDELocation
    T-001Plaintext Credential ExposureP0Information Disclosuresrc/auth/service.ts:42
    T-002SQL Injection via SearchP1Tamperingsrc/db/query.ts:115
    T-003Missing Rate LimitingP2Denial of Servicesrc/api/gateway.ts:12
    T-004Insecure Cross-Service AuthP1Spoofingconfig/env.yaml:08

    System Model (system-model.mmd)

    graph LR
    subgraph External
        User((User))
    end
    subgraph Production_VPC
        Gateway[API Gateway]
        Auth[Auth Service]
        DB[(PostgreSQL)]
    end
    User -- HTTPS --> Gateway
    Gateway -- HTTP --> Auth
    Auth -- TCP --> DB

    Remediation Plan Highlights

    Phase 1 (Immediate): Implement parameterized queries in src/db/query.ts and encrypt internal service-to-service communication.

    Phase 2 (Short-term): Deploy rate limiting on the API Gateway and rotate the leaked credentials in the auth service.

    Next steps

    1. Review the full report at docs/threat-model/2023-10-27/threat-model.md.
    2. Import threats.csv into your Jira or GitHub Issues backlog.
    3. Run the remediation tasks listed in remediation-plan.md.

    threats.csv

    CSV · data export

    Generated

    Example file from a real run - the skill writes it into your workspace.

    Connects securely to your tools. The creator never sees your data.

    About this skill

    Turn any codebase into a professional, evidence-based threat model — and a remediation plan your team can actually execute.

    What it does

    • Detects the system and stack with a local, read-only inventory script: languages, frameworks, datastores, messaging, Terraform, Kubernetes, Docker, CI/CD, API specs, endpoints, risky patterns, redacted secrets and cross-repo links.
    • Models the architecture: assets, actors, data-flow diagram (Mermaid), trust boundaries and entry points.
    • Finds threats with evidence: STRIDE-per-element plus stack-specific catalogs for Node, Python, Java/Spring, Go, .NET, Rails, PHP, frontend frameworks, REST/GraphQL/gRPC, databases, Kafka/RabbitMQ/SQS, Docker, Kubernetes, AWS/GCP/Azure, GitHub Actions/GitLab/Jenkins, mobile and LLM apps. Every threat cites file:line or is explicitly marked as a hypothesis — no generic filler.
    • Prioritizes: likelihood × impact → P0–P3, plus effort (S/M/L) so quick wins come first.
    • Plans remediation in phases with acceptance criteria and a verification step (test, SAST rule or CI check) for every task.

    Outputs threats.json (validated source of truth), threat-model.md, remediation-plan.md, threats.csv (import into Jira, Linear or GitHub Issues) and system-model.mmd.

    Built for real teams

    • Per-project .threatmodel.yml for deployment context, assets, trust assumptions, accepted risks and false positives — decisions are versioned and persist across runs thanks to stable threat fingerprints.
    • Documented, versioned JSON contract so other tools and skills can enrich the model without breaking it.
    • Built-in validator: checks references, risk math, priorities, that every piece of evidence points to a real file and line, and that no secret leaks into the report.

    Safe by design Static analysis only. The scripts use the Python standard library, make no network requests, install nothing and never print secret values.

    Who it's for AppSec and security engineers, tech leads and architects, DevSecOps teams, and startups preparing for ISO 27001, SOC 2 or customer security reviews.

    Example prompts

    • "Threat model this repository"
    • "Run a STRIDE analysis of these three services and give me a remediation plan"
    • "Review the security design of this monorepo"

    Reports are written in the user's language (or the one set in .threatmodel.yml). Requires Python 3.8+.

    How to use

    Skills on Agensi run inside your AI agent. Copy the prompt, paste it into your agent, and it connects to Agensi and installs this skill for you. If a payment is needed, your agent shows it to you first.

    Reviews

    No reviews yet

    Be one of the first to try it. Every listed skill passes our trust checks below.

    Security scanned

    Passed our 8-point scan before listing

    Fresh listing

    Recently published to Agensi

    Money-back guarantee

    Doesn't do what its page promises? You get your money back.

    Trust & safety

    Security scanned

    Verified clean 8 days ago

    • Passed all security checks, Safe to install

    Requires

    Python

    Listed8 days ago

    What's inside

    Frequently Asked Questions