Tm threats

Threat Analysis

Purpose

Systematically identify and analyze threats against your system using established threat modeling frameworks. This skill:

• Applies STRIDE methodology to each component
• Generates comprehensive threat catalog
• Builds attack trees for critical threats
• Identifies abuse cases from legitimate functionality
• Creates prioritized risk register

Usage

/tm-threats [--framework stride|pasta] [--focus <asset-id>] [--depth quick|standard|deep] [--include-abuse]

Arguments:

• --framework: Threat framework (default: stride)
• --focus: Analyze specific asset only
• --depth: Analysis depth
• --include-abuse: Generate abuse cases from sequences

Prerequisites

Requires initialized threat model. Run /tm-init first if .threatmodel/ doesn't exist.

STRIDE Analysis Process

For Each Asset

Apply STRIDE categories based on asset type:

Asset Type	S	T	R	I	D	E
External Entity	✓		✓
Process/Service	✓	✓	✓	✓	✓	✓
Data Store		✓	✓	✓	✓
Data Flow		✓		✓	✓

For Each Trust Boundary Crossing

Analyze threats for data flows crossing trust boundaries:

1. Spoofing: Can the source be impersonated?
2. Tampering: Can the data be modified in transit?
3. Repudiation: Can the action be denied?
4. Information Disclosure: Can the data be intercepted?
5. Denial of Service: Can the flow be disrupted?
6. Elevation of Privilege: Can privileges be escalated?

For Each Attack Surface Entry

Analyze exposed entry points:

1. What authentication is required?
2. What authorization is enforced?
3. What input validation exists?
4. What rate limiting is applied?
5. What data is exposed?

Risk Scoring

Likelihood Scale (1-5)

Score	Level	Description
1	Rare	Requires significant resources, unlikely to occur
2	Unlikely	Difficult but possible with moderate resources
3	Possible	Achievable with common tools and moderate skill
4	Likely	Easy to exploit with readily available tools
5	Almost Certain	Trivial to exploit, may already be happening

Impact Scale (1-5)

Score	Level	Description
1	Negligible	Minor inconvenience, no data loss
2	Minor	Limited data exposure, quick recovery
3	Moderate	Significant data exposure, business disruption
4	Major	Large scale data breach, major business impact
5	Severe	Complete system compromise, existential threat

Risk Score = Likelihood × Impact

Risk Score	Level
1-4	Low
5-9	Medium
10-15	High
16-25	Critical

Output Files

threats.json

{
  "version": "1.0",
  "generated": "ISO-8601",
  "framework": "STRIDE",
  "threats": [
    {
      "id": "threat-001",
      "title": "Credential Stuffing Attack",
      "category": "spoofing",
      "framework": "STRIDE",
      "description": "Attacker uses leaked credentials to gain unauthorized access",
      "target": {
        "asset_id": "asset-002",
        "attack_surface_id": "as-001",
        "entry_point": "/api/auth/login"
      },
      "threat_actor": "external-attacker",
      "prerequisites": ["Leaked credential database", "Knowledge of login endpoint"],
      "impact": {
        "confidentiality": "high",
        "integrity": "medium",
        "availability": "low"
      },
      "likelihood": "likely",
      "risk_score": 16,
      "risk_level": "critical",
      "mitre_attack": ["T1110.004"],
      "cwe": ["CWE-307", "CWE-521"],
      "countermeasures": ["control-001", "control-002"]
    }
  ]
}

attack-trees.json

{
  "version": "1.0",
  "trees": [
    {
      "id": "at-001",
      "threat_id": "threat-001",
      "goal": "Gain unauthorized access to user accounts",
      "root": {
        "description": "Compromise user account",
        "type": "or",
        "children": [
          {
            "description": "Credential stuffing",
            "type": "and",
            "children": [
              {"description": "Obtain leaked credentials", "type": "leaf", "difficulty": "low"},
              {"description": "Bypass rate limiting", "type": "leaf", "difficulty": "medium"}
            ]
          },
          {"description": "Phishing attack", "type": "leaf", "difficulty": "medium"}
        ]
      }
    }
  ]
}

risk-register.json

{
  "version": "1.0",
  "generated": "ISO-8601",
  "entries": [
    {
      "id": "risk-001",
      "threat_id": "threat-001",
      "title": "Credential Stuffing Attack",
      "category": "authentication",
      "likelihood": {"score": 4, "rationale": "Common attack, tools readily available"},
      "impact": {"score": 4, "rationale": "Account takeover leads to data breach"},
      "inherent_risk_score": 16,
      "inherent_risk_level": "critical",
      "treatment": "mitigate",
      "treatment_plan": "Implement MFA and improve rate limiting",
      "owner": "security-team",
      "status": "open"
    }
  ]
}

Common Threat Patterns

Authentication Threats (Spoofing)

• Credential stuffing
• Brute force attacks
• Session hijacking
• Token theft
• Password spraying

Data Integrity Threats (Tampering)

• SQL injection
• Parameter tampering
• Man-in-the-middle
• File upload attacks
• Configuration tampering

Audit Threats (Repudiation)

• Missing audit logs
• Log tampering
• Insufficient logging

Confidentiality Threats (Information Disclosure)

• Data leaks in errors
• Directory traversal
• Insecure direct object references
• Excessive data exposure

Availability Threats (Denial of Service)

• Resource exhaustion
• Algorithmic complexity
• DDoS attacks

Authorization Threats (Elevation of Privilege)

• Broken access control
• Privilege escalation
• IDOR vulnerabilities

Instructions for Claude

When executing this skill:

1. Load existing threat model state:

   • Read .threatmodel/state/assets.json
   • Read .threatmodel/state/dataflows.json
   • Read .threatmodel/state/trust-boundaries.json
   • Read .threatmodel/state/attack-surface.json

2. Apply STRIDE systematically:

   • For each asset, consider applicable STRIDE categories
   • For each trust boundary crossing, analyze all categories
   • For each attack surface entry, identify threats

3. Generate threat entries:

   • Create unique IDs (threat-001, threat-002, etc.)
   • Write clear descriptions
   • Identify prerequisites
   • Assess impact (CIA triad)
   • Estimate likelihood
   • Calculate risk score
   • Map to MITRE ATT&CK and CWE where applicable

4. Build attack trees for critical threats:

   • Create tree for threats with risk_score >= 12
   • Show attack paths as AND/OR trees

5. Generate abuse cases (if --include-abuse):

   • Review sequence diagrams
   • Identify how legitimate flows could be misused

6. Create risk register:

   • Prioritize by risk score
   • Group by category
   • Assign treatment strategy

7. Write visual threat report (.threatmodel/reports/threat-report.md):

   # Threat Analysis Report
   
   **Generated**: [Date]
   **Framework**: STRIDE
   
   ## Summary
   
   

   THREAT ANALYSIS ═══════════════════════════════════════════════════════════

   Assets Analyzed: 14 Attack Surfaces Analyzed: 12

   THREATS BY SEVERITY ───────────────────────────────────────────────────────── CRITICAL │██████████░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░│ 5 (11%) HIGH │████████████████████████░░░░░░░░░░░░░░░░│ 12 (26%) MEDIUM │████████████████████████████████████░░░░│ 18 (38%) LOW │████████████████████████░░░░░░░░░░░░░░░░│ 12 (26%)

   THREATS BY STRIDE CATEGORY ───────────────────────────────────────────────────────── Spoofing │████████████████░░░░░░░░░░░░░░░░│ 8 Tampering │████████████████████░░░░░░░░░░░░│ 10 Repudiation │████████░░░░░░░░░░░░░░░░░░░░░░░░│ 4 Information Disclosure│██████████████████░░░░░░░░░░░░░░│ 9 Denial of Service │██████████████░░░░░░░░░░░░░░░░░░│ 7 Elevation of Privilege│██████████████████░░░░░░░░░░░░░░│ 9

   
   ## Critical Threats
   
   ### THREAT-001: Credential Stuffing Attack
   
   

   ┌─────────────────────────────────────────────────────────┐ │ RISK SCORE: 8.5/10 (CRITICAL) │ ├─────────────────────────────────────────────────────────┤ │ Category: Spoofing │ │ Target: POST /api/auth/login │ │ │ │ ATTACK VECTOR: │ │ Automated login attempts with leaked credentials │ │ │ │ IMPACT: │ │ Confidentiality: HIGH │ │ Integrity: MEDIUM │ │ Availability: LOW │ │ │ │ MITRE ATT&CK: T1110.001 │ │ CWE: CWE-307 │ │ │ │ REQUIRED COUNTERMEASURES: │ │ • Rate limiting on auth endpoints │ │ • Account lockout after failed attempts │ │ • MFA enforcement │ └─────────────────────────────────────────────────────────┘

   
   [Additional threats...]
   

8. Console summary (also display to user):

   Threat Analysis Complete
   ========================
   
   Framework: STRIDE
   Assets Analyzed: X
   Attack Surfaces Analyzed: Y
   
   Threats Identified:
     Critical: N
     High: N
     Medium: N
     Low: N
   
   Top Critical Threats:
     1. [THREAT-001] Title (Risk: 16)
     2. [THREAT-002] Title (Risk: 15)
   
   Attack Trees Generated: N
   Abuse Cases Documented: N
   
   Files Updated:
     .threatmodel/state/threats.json
     .threatmodel/state/attack-trees.json
     .threatmodel/state/risk-register.json
     .threatmodel/reports/threat-report.md
   
   Next Steps:
     Run /tm-verify to check control implementations
   

Reference Files

• STRIDE Framework
• OWASP Top 10