[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6F1NBT4X8B081BTSECT6H29":3,"skill-same:01M6F1NBT4X8B081BTSECT6H29":67},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":18,"publishedAt":33,"linkOnly":34,"markdownContent":35,"markdownBody":36,"frontMatter":37,"refName":38,"commitSha":39,"skillDirectory":40,"forksCount":41,"repositoryHtmlUrl":42,"repositoryHomepageUrl":43,"ownerHtmlUrl":44,"ownerBlogUrl":6,"ownerDescription":45,"updatedAt":46,"install":47,"resources":60},"01M6F1NBT4X8B081BTSECT6H29","stride-analysis-patterns",null,"Apply STRIDE methodology to systematically identify threats. Use when analyzing system security, conducting threat modeling sessions, or creating security documentation.","ComeOnOliver\u002Fskillshub","ComeOnOliver","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F43215937?v=4","01M6E5JNFECJAAVFE0W7SMWWD2","Haoran Shu","01M6E5JNNDQS7AJZDYFQ8TPZCK",67,"MIT","https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub\u002Fblob\u002Fmain\u002Fskills\u002Faiskillstore\u002Fmarketplace\u002Fwshobson\u002Fstride-analysis-patterns\u002FSKILL.md",[],[19,20,21,22,23,24,25,26,27,28,29,30,31,32],"analysis","stride","stride analysis patterns","patterns","security","threat modeling","sessions","documentation","analyzing","methodology","system","use","threat","modeling","2026-11-10 10:12:30",false,"---\nname: stride-analysis-patterns\ndescription: Apply STRIDE methodology to systematically identify threats. Use when analyzing system security, conducting threat modeling sessions, or creating security documentation.\n---\n\n# STRIDE Analysis Patterns\n\nSystematic threat identification using the STRIDE methodology.\n\n## When to Use This Skill\n\n- Starting new threat modeling sessions\n- Analyzing existing system architecture\n- Reviewing security design decisions\n- Creating threat documentation\n- Training teams on threat identification\n- Compliance and audit preparation\n\n## Core Concepts\n\n### 1. STRIDE Categories\n\n```\nS - Spoofing       → Authentication threats\nT - Tampering      → Integrity threats\nR - Repudiation    → Non-repudiation threats\nI - Information    → Confidentiality threats\n    Disclosure\nD - Denial of      → Availability threats\n    Service\nE - Elevation of   → Authorization threats\n    Privilege\n```\n\n### 2. Threat Analysis Matrix\n\n| Category | Question | Control Family |\n|----------|----------|----------------|\n| **Spoofing** | Can attacker pretend to be someone else? | Authentication |\n| **Tampering** | Can attacker modify data in transit\u002Frest? | Integrity |\n| **Repudiation** | Can attacker deny actions? | Logging\u002FAudit |\n| **Info Disclosure** | Can attacker access unauthorized data? | Encryption |\n| **DoS** | Can attacker disrupt availability? | Rate limiting |\n| **Elevation** | Can attacker gain higher privileges? | Authorization |\n\n## Templates\n\n### Template 1: STRIDE Threat Model Document\n\n```markdown\n# Threat Model: [System Name]\n\n## 1. System Overview\n\n### 1.1 Description\n[Brief description of the system and its purpose]\n\n### 1.2 Data Flow Diagram\n```\n[User] --> [Web App] --> [API Gateway] --> [Backend Services]\n                              |\n                              v\n                        [Database]\n```\n\n### 1.3 Trust Boundaries\n- **External Boundary**: Internet to DMZ\n- **Internal Boundary**: DMZ to Internal Network\n- **Data Boundary**: Application to Database\n\n## 2. Assets\n\n| Asset | Sensitivity | Description |\n|-------|-------------|-------------|\n| User Credentials | High | Authentication tokens, passwords |\n| Personal Data | High | PII, financial information |\n| Session Data | Medium | Active user sessions |\n| Application Logs | Medium | System activity records |\n| Configuration | High | System settings, secrets |\n\n## 3. STRIDE Analysis\n\n### 3.1 Spoofing Threats\n\n| ID | Threat | Target | Impact | Likelihood |\n|----|--------|--------|--------|------------|\n| S1 | Session hijacking | User sessions | High | Medium |\n| S2 | Token forgery | JWT tokens | High | Low |\n| S3 | Credential stuffing | Login endpoint | High | High |\n\n**Mitigations:**\n- [ ] Implement MFA\n- [ ] Use secure session management\n- [ ] Implement account lockout policies\n\n### 3.2 Tampering Threats\n\n| ID | Threat | Target | Impact | Likelihood |\n|----|--------|--------|--------|------------|\n| T1 | SQL injection | Database queries | Critical | Medium |\n| T2 | Parameter manipulation | API requests | High | High |\n| T3 | File upload abuse | File storage | High | Medium |\n\n**Mitigations:**\n- [ ] Input validation on all endpoints\n- [ ] Parameterized queries\n- [ ] File type validation\n\n### 3.3 Repudiation Threats\n\n| ID | Threat | Target | Impact | Likelihood |\n|----|--------|--------|--------|------------|\n| R1 | Transaction denial | Financial ops | High | Medium |\n| R2 | Access log tampering | Audit logs | Medium | Low |\n| R3 | Action attribution | User actions | Medium | Medium |\n\n**Mitigations:**\n- [ ] Comprehensive audit logging\n- [ ] Log integrity protection\n- [ ] Digital signatures for critical actions\n\n### 3.4 Information Disclosure Threats\n\n| ID | Threat | Target | Impact | Likelihood |\n|----|--------|--------|--------|------------|\n| I1 | Data breach | User PII | Critical | Medium |\n| I2 | Error message leakage | System info | Low | High |\n| I3 | Insecure transmission | Network traffic | High | Medium |\n\n**Mitigations:**\n- [ ] Encryption at rest and in transit\n- [ ] Sanitize error messages\n- [ ] Implement TLS 1.3\n\n### 3.5 Denial of Service Threats\n\n| ID | Threat | Target | Impact | Likelihood |\n|----|--------|--------|--------|------------|\n| D1 | Resource exhaustion | API servers | High | High |\n| D2 | Database overload | Database | Critical | Medium |\n| D3 | Bandwidth saturation | Network | High | Medium |\n\n**Mitigations:**\n- [ ] Rate limiting\n- [ ] Auto-scaling\n- [ ] DDoS protection\n\n### 3.6 Elevation of Privilege Threats\n\n| ID | Threat | Target | Impact | Likelihood |\n|----|--------|--------|--------|------------|\n| E1 | IDOR vulnerabilities | User resources | High | High |\n| E2 | Role manipulation | Admin access | Critical | Low |\n| E3 | JWT claim tampering | Authorization | High | Medium |\n\n**Mitigations:**\n- [ ] Proper authorization checks\n- [ ] Principle of least privilege\n- [ ] Server-side role validation\n\n## 4. Risk Assessment\n\n### 4.1 Risk Matrix\n\n```\n              IMPACT\n         Low  Med  High Crit\n    Low   1    2    3    4\nL   Med   2    4    6    8\nI   High  3    6    9    12\nK   Crit  4    8   12    16\n```\n\n### 4.2 Prioritized Risks\n\n| Rank | Threat | Risk Score | Priority |\n|------|--------|------------|----------|\n| 1 | SQL Injection (T1) | 12 | Critical |\n| 2 | IDOR (E1) | 9 | High |\n| 3 | Credential Stuffing (S3) | 9 | High |\n| 4 | Data Breach (I1) | 8 | High |\n\n## 5. Recommendations\n\n### Immediate Actions\n1. Implement input validation framework\n2. Add rate limiting to authentication endpoints\n3. Enable comprehensive audit logging\n\n### Short-term (30 days)\n1. Deploy WAF with OWASP ruleset\n2. Implement MFA for sensitive operations\n3. Encrypt all PII at rest\n\n### Long-term (90 days)\n1. Security awareness training\n2. Penetration testing\n3. Bug bounty program\n```\n\n### Template 2: STRIDE Analysis Code\n\n```python\nfrom dataclasses import dataclass, field\nfrom enum import Enum\nfrom typing import List, Dict, Optional\nimport json\n\nclass StrideCategory(Enum):\n    SPOOFING = \"S\"\n    TAMPERING = \"T\"\n    REPUDIATION = \"R\"\n    INFORMATION_DISCLOSURE = \"I\"\n    DENIAL_OF_SERVICE = \"D\"\n    ELEVATION_OF_PRIVILEGE = \"E\"\n\n\nclass Impact(Enum):\n    LOW = 1\n    MEDIUM = 2\n    HIGH = 3\n    CRITICAL = 4\n\n\nclass Likelihood(Enum):\n    LOW = 1\n    MEDIUM = 2\n    HIGH = 3\n    CRITICAL = 4\n\n\n@dataclass\nclass Threat:\n    id: str\n    category: StrideCategory\n    title: str\n    description: str\n    target: str\n    impact: Impact\n    likelihood: Likelihood\n    mitigations: List[str] = field(default_factory=list)\n    status: str = \"open\"\n\n    @property\n    def risk_score(self) -> int:\n        return self.impact.value * self.likelihood.value\n\n    @property\n    def risk_level(self) -> str:\n        score = self.risk_score\n        if score >= 12:\n            return \"Critical\"\n        elif score >= 6:\n            return \"High\"\n        elif score >= 3:\n            return \"Medium\"\n        return \"Low\"\n\n\n@dataclass\nclass Asset:\n    name: str\n    sensitivity: str\n    description: str\n    data_classification: str\n\n\n@dataclass\nclass TrustBoundary:\n    name: str\n    description: str\n    from_zone: str\n    to_zone: str\n\n\n@dataclass\nclass ThreatModel:\n    name: str\n    version: str\n    description: str\n    assets: List[Asset] = field(default_factory=list)\n    boundaries: List[TrustBoundary] = field(default_factory=list)\n    threats: List[Threat] = field(default_factory=list)\n\n    def add_threat(self, threat: Threat) -> None:\n        self.threats.append(threat)\n\n    def get_threats_by_category(self, category: StrideCategory) -> List[Threat]:\n        return [t for t in self.threats if t.category == category]\n\n    def get_critical_threats(self) -> List[Threat]:\n        return [t for t in self.threats if t.risk_level in (\"Critical\", \"High\")]\n\n    def generate_report(self) -> Dict:\n        \"\"\"Generate threat model report.\"\"\"\n        return {\n            \"summary\": {\n                \"name\": self.name,\n                \"version\": self.version,\n                \"total_threats\": len(self.threats),\n                \"critical_threats\": len([t for t in self.threats if t.risk_level == \"Critical\"]),\n                \"high_threats\": len([t for t in self.threats if t.risk_level == \"High\"]),\n            },\n            \"by_category\": {\n                cat.name: len(self.get_threats_by_category(cat))\n                for cat in StrideCategory\n            },\n            \"top_risks\": [\n                {\n                    \"id\": t.id,\n                    \"title\": t.title,\n                    \"risk_score\": t.risk_score,\n                    \"risk_level\": t.risk_level\n                }\n                for t in sorted(self.threats, key=lambda x: x.risk_score, reverse=True)[:10]\n            ]\n        }\n\n\nclass StrideAnalyzer:\n    \"\"\"Automated STRIDE analysis helper.\"\"\"\n\n    STRIDE_QUESTIONS = {\n        StrideCategory.SPOOFING: [\n            \"Can an attacker impersonate a legitimate user?\",\n            \"Are authentication tokens properly validated?\",\n            \"Can session identifiers be predicted or stolen?\",\n            \"Is multi-factor authentication available?\",\n        ],\n        StrideCategory.TAMPERING: [\n            \"Can data be modified in transit?\",\n            \"Can data be modified at rest?\",\n            \"Are input validation controls sufficient?\",\n            \"Can an attacker manipulate application logic?\",\n        ],\n        StrideCategory.REPUDIATION: [\n            \"Are all security-relevant actions logged?\",\n            \"Can logs be tampered with?\",\n            \"Is there sufficient attribution for actions?\",\n            \"Are timestamps reliable and synchronized?\",\n        ],\n        StrideCategory.INFORMATION_DISCLOSURE: [\n            \"Is sensitive data encrypted at rest?\",\n            \"Is sensitive data encrypted in transit?\",\n            \"Can error messages reveal sensitive information?\",\n            \"Are access controls properly enforced?\",\n        ],\n        StrideCategory.DENIAL_OF_SERVICE: [\n            \"Are rate limits implemented?\",\n            \"Can resources be exhausted by malicious input?\",\n            \"Is there protection against amplification attacks?\",\n            \"Are there single points of failure?\",\n        ],\n        StrideCategory.ELEVATION_OF_PRIVILEGE: [\n            \"Are authorization checks performed consistently?\",\n            \"Can users access other users' resources?\",\n            \"Can privilege escalation occur through parameter manipulation?\",\n            \"Is the principle of least privilege followed?\",\n        ],\n    }\n\n    def generate_questionnaire(self, component: str) -> List[Dict]:\n        \"\"\"Generate STRIDE questionnaire for a component.\"\"\"\n        questionnaire = []\n        for category, questions in self.STRIDE_QUESTIONS.items():\n            for q in questions:\n                questionnaire.append({\n                    \"component\": component,\n                    \"category\": category.name,\n                    \"question\": q,\n                    \"answer\": None,\n                    \"notes\": \"\"\n                })\n        return questionnaire\n\n    def suggest_mitigations(self, category: StrideCategory) -> List[str]:\n        \"\"\"Suggest common mitigations for a STRIDE category.\"\"\"\n        mitigations = {\n            StrideCategory.SPOOFING: [\n                \"Implement multi-factor authentication\",\n                \"Use secure session management\",\n                \"Implement account lockout policies\",\n                \"Use cryptographically secure tokens\",\n                \"Validate authentication at every request\",\n            ],\n            StrideCategory.TAMPERING: [\n                \"Implement input validation\",\n                \"Use parameterized queries\",\n                \"Apply integrity checks (HMAC, signatures)\",\n                \"Implement Content Security Policy\",\n                \"Use immutable infrastructure\",\n            ],\n            StrideCategory.REPUDIATION: [\n                \"Enable comprehensive audit logging\",\n                \"Protect log integrity\",\n                \"Implement digital signatures\",\n                \"Use centralized, tamper-evident logging\",\n                \"Maintain accurate timestamps\",\n            ],\n            StrideCategory.INFORMATION_DISCLOSURE: [\n                \"Encrypt data at rest and in transit\",\n                \"Implement proper access controls\",\n                \"Sanitize error messages\",\n                \"Use secure defaults\",\n                \"Implement data classification\",\n            ],\n            StrideCategory.DENIAL_OF_SERVICE: [\n                \"Implement rate limiting\",\n                \"Use auto-scaling\",\n                \"Deploy DDoS protection\",\n                \"Implement circuit breakers\",\n                \"Set resource quotas\",\n            ],\n            StrideCategory.ELEVATION_OF_PRIVILEGE: [\n                \"Implement proper authorization\",\n                \"Follow principle of least privilege\",\n                \"Validate permissions server-side\",\n                \"Use role-based access control\",\n                \"Implement security boundaries\",\n            ],\n        }\n        return mitigations.get(category, [])\n```\n\n### Template 3: Data Flow Diagram Analysis\n\n```python\nfrom dataclasses import dataclass\nfrom typing import List, Set, Tuple\nfrom enum import Enum\n\nclass ElementType(Enum):\n    EXTERNAL_ENTITY = \"external\"\n    PROCESS = \"process\"\n    DATA_STORE = \"datastore\"\n    DATA_FLOW = \"dataflow\"\n\n\n@dataclass\nclass DFDElement:\n    id: str\n    name: str\n    type: ElementType\n    trust_level: int  # 0 = untrusted, higher = more trusted\n    description: str = \"\"\n\n\n@dataclass\nclass DataFlow:\n    id: str\n    name: str\n    source: str\n    destination: str\n    data_type: str\n    protocol: str\n    encrypted: bool = False\n\n\nclass DFDAnalyzer:\n    \"\"\"Analyze Data Flow Diagrams for STRIDE threats.\"\"\"\n\n    def __init__(self):\n        self.elements: Dict[str, DFDElement] = {}\n        self.flows: List[DataFlow] = []\n\n    def add_element(self, element: DFDElement) -> None:\n        self.elements[element.id] = element\n\n    def add_flow(self, flow: DataFlow) -> None:\n        self.flows.append(flow)\n\n    def find_trust_boundary_crossings(self) -> List[Tuple[DataFlow, int]]:\n        \"\"\"Find data flows that cross trust boundaries.\"\"\"\n        crossings = []\n        for flow in self.flows:\n            source = self.elements.get(flow.source)\n            dest = self.elements.get(flow.destination)\n            if source and dest and source.trust_level != dest.trust_level:\n                trust_diff = abs(source.trust_level - dest.trust_level)\n                crossings.append((flow, trust_diff))\n        return sorted(crossings, key=lambda x: x[1], reverse=True)\n\n    def identify_threats_per_element(self) -> Dict[str, List[StrideCategory]]:\n        \"\"\"Map applicable STRIDE categories to element types.\"\"\"\n        threat_mapping = {\n            ElementType.EXTERNAL_ENTITY: [\n                StrideCategory.SPOOFING,\n                StrideCategory.REPUDIATION,\n            ],\n            ElementType.PROCESS: [\n                StrideCategory.SPOOFING,\n                StrideCategory.TAMPERING,\n                StrideCategory.REPUDIATION,\n                StrideCategory.INFORMATION_DISCLOSURE,\n                StrideCategory.DENIAL_OF_SERVICE,\n                StrideCategory.ELEVATION_OF_PRIVILEGE,\n            ],\n            ElementType.DATA_STORE: [\n                StrideCategory.TAMPERING,\n                StrideCategory.REPUDIATION,\n                StrideCategory.INFORMATION_DISCLOSURE,\n                StrideCategory.DENIAL_OF_SERVICE,\n            ],\n            ElementType.DATA_FLOW: [\n                StrideCategory.TAMPERING,\n                StrideCategory.INFORMATION_DISCLOSURE,\n                StrideCategory.DENIAL_OF_SERVICE,\n            ],\n        }\n\n        result = {}\n        for elem_id, elem in self.elements.items():\n            result[elem_id] = threat_mapping.get(elem.type, [])\n        return result\n\n    def analyze_unencrypted_flows(self) -> List[DataFlow]:\n        \"\"\"Find unencrypted data flows crossing trust boundaries.\"\"\"\n        risky_flows = []\n        for flow in self.flows:\n            if not flow.encrypted:\n                source = self.elements.get(flow.source)\n                dest = self.elements.get(flow.destination)\n                if source and dest and source.trust_level != dest.trust_level:\n                    risky_flows.append(flow)\n        return risky_flows\n\n    def generate_threat_enumeration(self) -> List[Dict]:\n        \"\"\"Generate comprehensive threat enumeration.\"\"\"\n        threats = []\n        element_threats = self.identify_threats_per_element()\n\n        for elem_id, categories in element_threats.items():\n            elem = self.elements[elem_id]\n            for category in categories:\n                threats.append({\n                    \"element_id\": elem_id,\n                    \"element_name\": elem.name,\n                    \"element_type\": elem.type.value,\n                    \"stride_category\": category.name,\n                    \"description\": f\"{category.name} threat against {elem.name}\",\n                    \"trust_level\": elem.trust_level\n                })\n\n        return threats\n```\n\n### Template 4: STRIDE per Interaction\n\n```python\nfrom typing import List, Dict, Optional\nfrom dataclasses import dataclass\n\n@dataclass\nclass Interaction:\n    \"\"\"Represents an interaction between two components.\"\"\"\n    id: str\n    source: str\n    target: str\n    action: str\n    data: str\n    protocol: str\n\n\nclass StridePerInteraction:\n    \"\"\"Apply STRIDE to each interaction in the system.\"\"\"\n\n    INTERACTION_THREATS = {\n        # Source type -> Target type -> Applicable threats\n        (\"external\", \"process\"): {\n            \"S\": \"External entity spoofing identity to process\",\n            \"T\": \"Tampering with data sent to process\",\n            \"R\": \"External entity denying sending data\",\n            \"I\": \"Data exposure during transmission\",\n            \"D\": \"Flooding process with requests\",\n            \"E\": \"Exploiting process to gain privileges\",\n        },\n        (\"process\", \"datastore\"): {\n            \"T\": \"Process tampering with stored data\",\n            \"R\": \"Process denying data modifications\",\n            \"I\": \"Unauthorized data access by process\",\n            \"D\": \"Process exhausting storage resources\",\n        },\n        (\"process\", \"process\"): {\n            \"S\": \"Process spoofing another process\",\n            \"T\": \"Tampering with inter-process data\",\n            \"I\": \"Data leakage between processes\",\n            \"D\": \"One process overwhelming another\",\n            \"E\": \"Process gaining elevated access\",\n        },\n    }\n\n    def analyze_interaction(\n        self,\n        interaction: Interaction,\n        source_type: str,\n        target_type: str\n    ) -> List[Dict]:\n        \"\"\"Analyze a single interaction for STRIDE threats.\"\"\"\n        threats = []\n        key = (source_type, target_type)\n\n        applicable_threats = self.INTERACTION_THREATS.get(key, {})\n\n        for stride_code, description in applicable_threats.items():\n            threats.append({\n                \"interaction_id\": interaction.id,\n                \"source\": interaction.source,\n                \"target\": interaction.target,\n                \"stride_category\": stride_code,\n                \"threat_description\": description,\n                \"context\": f\"{interaction.action} - {interaction.data}\",\n            })\n\n        return threats\n\n    def generate_threat_matrix(\n        self,\n        interactions: List[Interaction],\n        element_types: Dict[str, str]\n    ) -> List[Dict]:\n        \"\"\"Generate complete threat matrix for all interactions.\"\"\"\n        all_threats = []\n\n        for interaction in interactions:\n            source_type = element_types.get(interaction.source, \"unknown\")\n            target_type = element_types.get(interaction.target, \"unknown\")\n\n            threats = self.analyze_interaction(\n                interaction, source_type, target_type\n            )\n            all_threats.extend(threats)\n\n        return all_threats\n```\n\n## Best Practices\n\n### Do's\n- **Involve stakeholders** - Security, dev, and ops perspectives\n- **Be systematic** - Cover all STRIDE categories\n- **Prioritize realistically** - Focus on high-impact threats\n- **Update regularly** - Threat models are living documents\n- **Use visual aids** - DFDs help communication\n\n### Don'ts\n- **Don't skip categories** - Each reveals different threats\n- **Don't assume security** - Question every component\n- **Don't work in isolation** - Collaborative modeling is better\n- **Don't ignore low-probability** - High-impact threats matter\n- **Don't stop at identification** - Follow through with mitigations\n\n## Resources\n\n- [Microsoft STRIDE Documentation](https:\u002F\u002Fdocs.microsoft.com\u002Fen-us\u002Fazure\u002Fsecurity\u002Fdevelop\u002Fthreat-modeling-tool-threats)\n- [OWASP Threat Modeling](https:\u002F\u002Fowasp.org\u002Fwww-community\u002FThreat_Modeling)\n- [Threat Modeling: Designing for Security](https:\u002F\u002Fwww.wiley.com\u002Fen-us\u002FThreat+Modeling%3A+Designing+for+Security-p-9781118809990)\n","# STRIDE Analysis Patterns\n\nSystematic threat identification using the STRIDE methodology.\n\n## When to Use This Skill\n\n- Starting new threat modeling sessions\n- Analyzing existing system architecture\n- Reviewing security design decisions\n- Creating threat documentation\n- Training teams on threat identification\n- Compliance and audit preparation\n\n## Core Concepts\n\n### 1. STRIDE Categories\n\n```\nS - Spoofing       → Authentication threats\nT - Tampering      → Integrity threats\nR - Repudiation    → Non-repudiation threats\nI - Information    → Confidentiality threats\n    Disclosure\nD - Denial of      → Availability threats\n    Service\nE - Elevation of   → Authorization threats\n    Privilege\n```\n\n### 2. Threat Analysis Matrix\n\n| Category | Question | Control Family |\n|----------|----------|----------------|\n| **Spoofing** | Can attacker pretend to be someone else? | Authentication |\n| **Tampering** | Can attacker modify data in transit\u002Frest? | Integrity |\n| **Repudiation** | Can attacker deny actions? | Logging\u002FAudit |\n| **Info Disclosure** | Can attacker access unauthorized data? | Encryption |\n| **DoS** | Can attacker disrupt availability? | Rate limiting |\n| **Elevation** | Can attacker gain higher privileges? | Authorization |\n\n## Templates\n\n### Template 1: STRIDE Threat Model Document\n\n```markdown\n# Threat Model: [System Name]\n\n## 1. System Overview\n\n### 1.1 Description\n[Brief description of the system and its purpose]\n\n### 1.2 Data Flow Diagram\n```\n[User] --> [Web App] --> [API Gateway] --> [Backend Services]\n                              |\n                              v\n                        [Database]\n```\n\n### 1.3 Trust Boundaries\n- **External Boundary**: Internet to DMZ\n- **Internal Boundary**: DMZ to Internal Network\n- **Data Boundary**: Application to Database\n\n## 2. Assets\n\n| Asset | Sensitivity | Description |\n|-------|-------------|-------------|\n| User Credentials | High | Authentication tokens, passwords |\n| Personal Data | High | PII, financial information |\n| Session Data | Medium | Active user sessions |\n| Application Logs | Medium | System activity records |\n| Configuration | High | System settings, secrets |\n\n## 3. STRIDE Analysis\n\n### 3.1 Spoofing Threats\n\n| ID | Threat | Target | Impact | Likelihood |\n|----|--------|--------|--------|------------|\n| S1 | Session hijacking | User sessions | High | Medium |\n| S2 | Token forgery | JWT tokens | High | Low |\n| S3 | Credential stuffing | Login endpoint | High | High |\n\n**Mitigations:**\n- [ ] Implement MFA\n- [ ] Use secure session management\n- [ ] Implement account lockout policies\n\n### 3.2 Tampering Threats\n\n| ID | Threat | Target | Impact | Likelihood |\n|----|--------|--------|--------|------------|\n| T1 | SQL injection | Database queries | Critical | Medium |\n| T2 | Parameter manipulation | API requests | High | High |\n| T3 | File upload abuse | File storage | High | Medium |\n\n**Mitigations:**\n- [ ] Input validation on all endpoints\n- [ ] Parameterized queries\n- [ ] File type validation\n\n### 3.3 Repudiation Threats\n\n| ID | Threat | Target | Impact | Likelihood |\n|----|--------|--------|--------|------------|\n| R1 | Transaction denial | Financial ops | High | Medium |\n| R2 | Access log tampering | Audit logs | Medium | Low |\n| R3 | Action attribution | User actions | Medium | Medium |\n\n**Mitigations:**\n- [ ] Comprehensive audit logging\n- [ ] Log integrity protection\n- [ ] Digital signatures for critical actions\n\n### 3.4 Information Disclosure Threats\n\n| ID | Threat | Target | Impact | Likelihood |\n|----|--------|--------|--------|------------|\n| I1 | Data breach | User PII | Critical | Medium |\n| I2 | Error message leakage | System info | Low | High |\n| I3 | Insecure transmission | Network traffic | High | Medium |\n\n**Mitigations:**\n- [ ] Encryption at rest and in transit\n- [ ] Sanitize error messages\n- [ ] Implement TLS 1.3\n\n### 3.5 Denial of Service Threats\n\n| ID | Threat | Target | Impact | Likelihood |\n|----|--------|--------|--------|------------|\n| D1 | Resource exhaustion | API servers | High | High |\n| D2 | Database overload | Database | Critical | Medium |\n| D3 | Bandwidth saturation | Network | High | Medium |\n\n**Mitigations:**\n- [ ] Rate limiting\n- [ ] Auto-scaling\n- [ ] DDoS protection\n\n### 3.6 Elevation of Privilege Threats\n\n| ID | Threat | Target | Impact | Likelihood |\n|----|--------|--------|--------|------------|\n| E1 | IDOR vulnerabilities | User resources | High | High |\n| E2 | Role manipulation | Admin access | Critical | Low |\n| E3 | JWT claim tampering | Authorization | High | Medium |\n\n**Mitigations:**\n- [ ] Proper authorization checks\n- [ ] Principle of least privilege\n- [ ] Server-side role validation\n\n## 4. Risk Assessment\n\n### 4.1 Risk Matrix\n\n```\n              IMPACT\n         Low  Med  High Crit\n    Low   1    2    3    4\nL   Med   2    4    6    8\nI   High  3    6    9    12\nK   Crit  4    8   12    16\n```\n\n### 4.2 Prioritized Risks\n\n| Rank | Threat | Risk Score | Priority |\n|------|--------|------------|----------|\n| 1 | SQL Injection (T1) | 12 | Critical |\n| 2 | IDOR (E1) | 9 | High |\n| 3 | Credential Stuffing (S3) | 9 | High |\n| 4 | Data Breach (I1) | 8 | High |\n\n## 5. Recommendations\n\n### Immediate Actions\n1. Implement input validation framework\n2. Add rate limiting to authentication endpoints\n3. Enable comprehensive audit logging\n\n### Short-term (30 days)\n1. Deploy WAF with OWASP ruleset\n2. Implement MFA for sensitive operations\n3. Encrypt all PII at rest\n\n### Long-term (90 days)\n1. Security awareness training\n2. Penetration testing\n3. Bug bounty program\n```\n\n### Template 2: STRIDE Analysis Code\n\n```python\nfrom dataclasses import dataclass, field\nfrom enum import Enum\nfrom typing import List, Dict, Optional\nimport json\n\nclass StrideCategory(Enum):\n    SPOOFING = \"S\"\n    TAMPERING = \"T\"\n    REPUDIATION = \"R\"\n    INFORMATION_DISCLOSURE = \"I\"\n    DENIAL_OF_SERVICE = \"D\"\n    ELEVATION_OF_PRIVILEGE = \"E\"\n\n\nclass Impact(Enum):\n    LOW = 1\n    MEDIUM = 2\n    HIGH = 3\n    CRITICAL = 4\n\n\nclass Likelihood(Enum):\n    LOW = 1\n    MEDIUM = 2\n    HIGH = 3\n    CRITICAL = 4\n\n\n@dataclass\nclass Threat:\n    id: str\n    category: StrideCategory\n    title: str\n    description: str\n    target: str\n    impact: Impact\n    likelihood: Likelihood\n    mitigations: List[str] = field(default_factory=list)\n    status: str = \"open\"\n\n    @property\n    def risk_score(self) -> int:\n        return self.impact.value * self.likelihood.value\n\n    @property\n    def risk_level(self) -> str:\n        score = self.risk_score\n        if score >= 12:\n            return \"Critical\"\n        elif score >= 6:\n            return \"High\"\n        elif score >= 3:\n            return \"Medium\"\n        return \"Low\"\n\n\n@dataclass\nclass Asset:\n    name: str\n    sensitivity: str\n    description: str\n    data_classification: str\n\n\n@dataclass\nclass TrustBoundary:\n    name: str\n    description: str\n    from_zone: str\n    to_zone: str\n\n\n@dataclass\nclass ThreatModel:\n    name: str\n    version: str\n    description: str\n    assets: List[Asset] = field(default_factory=list)\n    boundaries: List[TrustBoundary] = field(default_factory=list)\n    threats: List[Threat] = field(default_factory=list)\n\n    def add_threat(self, threat: Threat) -> None:\n        self.threats.append(threat)\n\n    def get_threats_by_category(self, category: StrideCategory) -> List[Threat]:\n        return [t for t in self.threats if t.category == category]\n\n    def get_critical_threats(self) -> List[Threat]:\n        return [t for t in self.threats if t.risk_level in (\"Critical\", \"High\")]\n\n    def generate_report(self) -> Dict:\n        \"\"\"Generate threat model report.\"\"\"\n        return {\n            \"summary\": {\n                \"name\": self.name,\n                \"version\": self.version,\n                \"total_threats\": len(self.threats),\n                \"critical_threats\": len([t for t in self.threats if t.risk_level == \"Critical\"]),\n                \"high_threats\": len([t for t in self.threats if t.risk_level == \"High\"]),\n            },\n            \"by_category\": {\n                cat.name: len(self.get_threats_by_category(cat))\n                for cat in StrideCategory\n            },\n            \"top_risks\": [\n                {\n                    \"id\": t.id,\n                    \"title\": t.title,\n                    \"risk_score\": t.risk_score,\n                    \"risk_level\": t.risk_level\n                }\n                for t in sorted(self.threats, key=lambda x: x.risk_score, reverse=True)[:10]\n            ]\n        }\n\n\nclass StrideAnalyzer:\n    \"\"\"Automated STRIDE analysis helper.\"\"\"\n\n    STRIDE_QUESTIONS = {\n        StrideCategory.SPOOFING: [\n            \"Can an attacker impersonate a legitimate user?\",\n            \"Are authentication tokens properly validated?\",\n            \"Can session identifiers be predicted or stolen?\",\n            \"Is multi-factor authentication available?\",\n        ],\n        StrideCategory.TAMPERING: [\n            \"Can data be modified in transit?\",\n            \"Can data be modified at rest?\",\n            \"Are input validation controls sufficient?\",\n            \"Can an attacker manipulate application logic?\",\n        ],\n        StrideCategory.REPUDIATION: [\n            \"Are all security-relevant actions logged?\",\n            \"Can logs be tampered with?\",\n            \"Is there sufficient attribution for actions?\",\n            \"Are timestamps reliable and synchronized?\",\n        ],\n        StrideCategory.INFORMATION_DISCLOSURE: [\n            \"Is sensitive data encrypted at rest?\",\n            \"Is sensitive data encrypted in transit?\",\n            \"Can error messages reveal sensitive information?\",\n            \"Are access controls properly enforced?\",\n        ],\n        StrideCategory.DENIAL_OF_SERVICE: [\n            \"Are rate limits implemented?\",\n            \"Can resources be exhausted by malicious input?\",\n            \"Is there protection against amplification attacks?\",\n            \"Are there single points of failure?\",\n        ],\n        StrideCategory.ELEVATION_OF_PRIVILEGE: [\n            \"Are authorization checks performed consistently?\",\n            \"Can users access other users' resources?\",\n            \"Can privilege escalation occur through parameter manipulation?\",\n            \"Is the principle of least privilege followed?\",\n        ],\n    }\n\n    def generate_questionnaire(self, component: str) -> List[Dict]:\n        \"\"\"Generate STRIDE questionnaire for a component.\"\"\"\n        questionnaire = []\n        for category, questions in self.STRIDE_QUESTIONS.items():\n            for q in questions:\n                questionnaire.append({\n                    \"component\": component,\n                    \"category\": category.name,\n                    \"question\": q,\n                    \"answer\": None,\n                    \"notes\": \"\"\n                })\n        return questionnaire\n\n    def suggest_mitigations(self, category: StrideCategory) -> List[str]:\n        \"\"\"Suggest common mitigations for a STRIDE category.\"\"\"\n        mitigations = {\n            StrideCategory.SPOOFING: [\n                \"Implement multi-factor authentication\",\n                \"Use secure session management\",\n                \"Implement account lockout policies\",\n                \"Use cryptographically secure tokens\",\n                \"Validate authentication at every request\",\n            ],\n            StrideCategory.TAMPERING: [\n                \"Implement input validation\",\n                \"Use parameterized queries\",\n                \"Apply integrity checks (HMAC, signatures)\",\n                \"Implement Content Security Policy\",\n                \"Use immutable infrastructure\",\n            ],\n            StrideCategory.REPUDIATION: [\n                \"Enable comprehensive audit logging\",\n                \"Protect log integrity\",\n                \"Implement digital signatures\",\n                \"Use centralized, tamper-evident logging\",\n                \"Maintain accurate timestamps\",\n            ],\n            StrideCategory.INFORMATION_DISCLOSURE: [\n                \"Encrypt data at rest and in transit\",\n                \"Implement proper access controls\",\n                \"Sanitize error messages\",\n                \"Use secure defaults\",\n                \"Implement data classification\",\n            ],\n            StrideCategory.DENIAL_OF_SERVICE: [\n                \"Implement rate limiting\",\n                \"Use auto-scaling\",\n                \"Deploy DDoS protection\",\n                \"Implement circuit breakers\",\n                \"Set resource quotas\",\n            ],\n            StrideCategory.ELEVATION_OF_PRIVILEGE: [\n                \"Implement proper authorization\",\n                \"Follow principle of least privilege\",\n                \"Validate permissions server-side\",\n                \"Use role-based access control\",\n                \"Implement security boundaries\",\n            ],\n        }\n        return mitigations.get(category, [])\n```\n\n### Template 3: Data Flow Diagram Analysis\n\n```python\nfrom dataclasses import dataclass\nfrom typing import List, Set, Tuple\nfrom enum import Enum\n\nclass ElementType(Enum):\n    EXTERNAL_ENTITY = \"external\"\n    PROCESS = \"process\"\n    DATA_STORE = \"datastore\"\n    DATA_FLOW = \"dataflow\"\n\n\n@dataclass\nclass DFDElement:\n    id: str\n    name: str\n    type: ElementType\n    trust_level: int  # 0 = untrusted, higher = more trusted\n    description: str = \"\"\n\n\n@dataclass\nclass DataFlow:\n    id: str\n    name: str\n    source: str\n    destination: str\n    data_type: str\n    protocol: str\n    encrypted: bool = False\n\n\nclass DFDAnalyzer:\n    \"\"\"Analyze Data Flow Diagrams for STRIDE threats.\"\"\"\n\n    def __init__(self):\n        self.elements: Dict[str, DFDElement] = {}\n        self.flows: List[DataFlow] = []\n\n    def add_element(self, element: DFDElement) -> None:\n        self.elements[element.id] = element\n\n    def add_flow(self, flow: DataFlow) -> None:\n        self.flows.append(flow)\n\n    def find_trust_boundary_crossings(self) -> List[Tuple[DataFlow, int]]:\n        \"\"\"Find data flows that cross trust boundaries.\"\"\"\n        crossings = []\n        for flow in self.flows:\n            source = self.elements.get(flow.source)\n            dest = self.elements.get(flow.destination)\n            if source and dest and source.trust_level != dest.trust_level:\n                trust_diff = abs(source.trust_level - dest.trust_level)\n                crossings.append((flow, trust_diff))\n        return sorted(crossings, key=lambda x: x[1], reverse=True)\n\n    def identify_threats_per_element(self) -> Dict[str, List[StrideCategory]]:\n        \"\"\"Map applicable STRIDE categories to element types.\"\"\"\n        threat_mapping = {\n            ElementType.EXTERNAL_ENTITY: [\n                StrideCategory.SPOOFING,\n                StrideCategory.REPUDIATION,\n            ],\n            ElementType.PROCESS: [\n                StrideCategory.SPOOFING,\n                StrideCategory.TAMPERING,\n                StrideCategory.REPUDIATION,\n                StrideCategory.INFORMATION_DISCLOSURE,\n                StrideCategory.DENIAL_OF_SERVICE,\n                StrideCategory.ELEVATION_OF_PRIVILEGE,\n            ],\n            ElementType.DATA_STORE: [\n                StrideCategory.TAMPERING,\n                StrideCategory.REPUDIATION,\n                StrideCategory.INFORMATION_DISCLOSURE,\n                StrideCategory.DENIAL_OF_SERVICE,\n            ],\n            ElementType.DATA_FLOW: [\n                StrideCategory.TAMPERING,\n                StrideCategory.INFORMATION_DISCLOSURE,\n                StrideCategory.DENIAL_OF_SERVICE,\n            ],\n        }\n\n        result = {}\n        for elem_id, elem in self.elements.items():\n            result[elem_id] = threat_mapping.get(elem.type, [])\n        return result\n\n    def analyze_unencrypted_flows(self) -> List[DataFlow]:\n        \"\"\"Find unencrypted data flows crossing trust boundaries.\"\"\"\n        risky_flows = []\n        for flow in self.flows:\n            if not flow.encrypted:\n                source = self.elements.get(flow.source)\n                dest = self.elements.get(flow.destination)\n                if source and dest and source.trust_level != dest.trust_level:\n                    risky_flows.append(flow)\n        return risky_flows\n\n    def generate_threat_enumeration(self) -> List[Dict]:\n        \"\"\"Generate comprehensive threat enumeration.\"\"\"\n        threats = []\n        element_threats = self.identify_threats_per_element()\n\n        for elem_id, categories in element_threats.items():\n            elem = self.elements[elem_id]\n            for category in categories:\n                threats.append({\n                    \"element_id\": elem_id,\n                    \"element_name\": elem.name,\n                    \"element_type\": elem.type.value,\n                    \"stride_category\": category.name,\n                    \"description\": f\"{category.name} threat against {elem.name}\",\n                    \"trust_level\": elem.trust_level\n                })\n\n        return threats\n```\n\n### Template 4: STRIDE per Interaction\n\n```python\nfrom typing import List, Dict, Optional\nfrom dataclasses import dataclass\n\n@dataclass\nclass Interaction:\n    \"\"\"Represents an interaction between two components.\"\"\"\n    id: str\n    source: str\n    target: str\n    action: str\n    data: str\n    protocol: str\n\n\nclass StridePerInteraction:\n    \"\"\"Apply STRIDE to each interaction in the system.\"\"\"\n\n    INTERACTION_THREATS = {\n        # Source type -> Target type -> Applicable threats\n        (\"external\", \"process\"): {\n            \"S\": \"External entity spoofing identity to process\",\n            \"T\": \"Tampering with data sent to process\",\n            \"R\": \"External entity denying sending data\",\n            \"I\": \"Data exposure during transmission\",\n            \"D\": \"Flooding process with requests\",\n            \"E\": \"Exploiting process to gain privileges\",\n        },\n        (\"process\", \"datastore\"): {\n            \"T\": \"Process tampering with stored data\",\n            \"R\": \"Process denying data modifications\",\n            \"I\": \"Unauthorized data access by process\",\n            \"D\": \"Process exhausting storage resources\",\n        },\n        (\"process\", \"process\"): {\n            \"S\": \"Process spoofing another process\",\n            \"T\": \"Tampering with inter-process data\",\n            \"I\": \"Data leakage between processes\",\n            \"D\": \"One process overwhelming another\",\n            \"E\": \"Process gaining elevated access\",\n        },\n    }\n\n    def analyze_interaction(\n        self,\n        interaction: Interaction,\n        source_type: str,\n        target_type: str\n    ) -> List[Dict]:\n        \"\"\"Analyze a single interaction for STRIDE threats.\"\"\"\n        threats = []\n        key = (source_type, target_type)\n\n        applicable_threats = self.INTERACTION_THREATS.get(key, {})\n\n        for stride_code, description in applicable_threats.items():\n            threats.append({\n                \"interaction_id\": interaction.id,\n                \"source\": interaction.source,\n                \"target\": interaction.target,\n                \"stride_category\": stride_code,\n                \"threat_description\": description,\n                \"context\": f\"{interaction.action} - {interaction.data}\",\n            })\n\n        return threats\n\n    def generate_threat_matrix(\n        self,\n        interactions: List[Interaction],\n        element_types: Dict[str, str]\n    ) -> List[Dict]:\n        \"\"\"Generate complete threat matrix for all interactions.\"\"\"\n        all_threats = []\n\n        for interaction in interactions:\n            source_type = element_types.get(interaction.source, \"unknown\")\n            target_type = element_types.get(interaction.target, \"unknown\")\n\n            threats = self.analyze_interaction(\n                interaction, source_type, target_type\n            )\n            all_threats.extend(threats)\n\n        return all_threats\n```\n\n## Best Practices\n\n### Do's\n- **Involve stakeholders** - Security, dev, and ops perspectives\n- **Be systematic** - Cover all STRIDE categories\n- **Prioritize realistically** - Focus on high-impact threats\n- **Update regularly** - Threat models are living documents\n- **Use visual aids** - DFDs help communication\n\n### Don'ts\n- **Don't skip categories** - Each reveals different threats\n- **Don't assume security** - Question every component\n- **Don't work in isolation** - Collaborative modeling is better\n- **Don't ignore low-probability** - High-impact threats matter\n- **Don't stop at identification** - Follow through with mitigations\n\n## Resources\n\n- [Microsoft STRIDE Documentation](https:\u002F\u002Fdocs.microsoft.com\u002Fen-us\u002Fazure\u002Fsecurity\u002Fdevelop\u002Fthreat-modeling-tool-threats)\n- [OWASP Threat Modeling](https:\u002F\u002Fowasp.org\u002Fwww-community\u002FThreat_Modeling)\n- [Threat Modeling: Designing for Security](https:\u002F\u002Fwww.wiley.com\u002Fen-us\u002FThreat+Modeling%3A+Designing+for+Security-p-9781118809990)\n",{"name":5,"description":7},"main","def8531e65114c0fca8fb8551c1871ee0eed705c","skills\u002Faiskillstore\u002Fmarketplace\u002Fwshobson\u002Fstride-analysis-patterns",24,"https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub","https:\u002F\u002Fskillshub.wtf","https:\u002F\u002Fgithub.com\u002FComeOnOliver","AI & Blockchain Engineer\r\n","2026-06-24 22:07:19",{"source":8,"skillName":5,"commands":48,"prompt":58,"zipAvailable":59},[49,52,55],{"tool":50,"command":51},"npx","npx skills add ComeOnOliver\u002Fskillshub --skill stride-analysis-patterns",{"tool":53,"command":54},"bunx","bunx skills add ComeOnOliver\u002Fskillshub --skill stride-analysis-patterns",{"tool":56,"command":57},"pnpm","pnpm dlx skills add ComeOnOliver\u002Fskillshub --skill stride-analysis-patterns","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub\u002Fblob\u002Fmain\u002Fskills\u002Faiskillstore\u002Fmarketplace\u002Fwshobson\u002Fstride-analysis-patterns\u002FSKILL.md",true,[61],{"path":62,"resourceType":63,"resourceTypeDesc":64,"sizeBytes":65,"sourceHtmlUrl":66},"skill-report.json","REFERENCE","参考文档",12559,"https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub\u002Fblob\u002Fmain\u002Fskills\u002Faiskillstore\u002Fmarketplace\u002Fwshobson\u002Fstride-analysis-patterns\u002Fskill-report.json",[68,82,92,101,107,114],{"skillNo":69,"name":70,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":71,"categories":72,"keywords":78,"publishedAt":33},"01M6FKJN13GMG4KY57J3QD8GY5","model-hierarchy-skill","https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub\u002Fblob\u002Fmain\u002Fskills\u002Fzscole\u002Fmodel-hierarchy-skill\u002Fmodel-hierarchy-skill\u002FSKILL.md",[73],{"categoryNo":74,"categoryName":75,"taxonomyType":76,"taxonomyTypeDesc":77},"01JBSEEDCAT000000000000023","Skill与智能体开发","SCENARIO","使用场景",[79,80,81],"model","model hierarchy","model hierarchy skill",{"skillNo":83,"name":84,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":85,"categories":86,"keywords":88,"publishedAt":33},"01M6FKJJJ6GCAMR4PPPRD12M5X","zoom-mcp","https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub\u002Fblob\u002Fmain\u002Fskills\u002Fzoom\u002Fskills\u002Fzoom-mcp\u002FSKILL.md",[87],{"categoryNo":74,"categoryName":75,"taxonomyType":76,"taxonomyTypeDesc":77},[89,90,91],"MCP","zoom","zoom mcp",{"skillNo":93,"name":94,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":95,"categories":96,"keywords":97,"publishedAt":33},"01M6FKJE3KYT3KPEZMEEHYKA6K","zoom-apps-sdk","https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub\u002Fblob\u002Fmain\u002Fskills\u002Fzoom\u002Fskills\u002Fzoom-apps-sdk\u002FSKILL.md",[],[98,99,100,90],"sdk","zoom apps sdk","apps",{"skillNo":102,"name":103,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":104,"categories":105,"keywords":106,"publishedAt":33},"01M6FKJ9EDH9Q5VWDF8HAJRSP0","windows","https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub\u002Fblob\u002Fmain\u002Fskills\u002Fzoom\u002Fskills\u002Fwindows\u002FSKILL.md",[],[103],{"skillNo":108,"name":109,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":110,"categories":111,"keywords":113,"publishedAt":33},"01M6FKJ666BEEFC3AE9GJ72Q93","whiteboard","https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub\u002Fblob\u002Fmain\u002Fskills\u002Fzoom\u002Fskills\u002Fwhiteboard\u002FSKILL.md",[112],{"categoryNo":74,"categoryName":75,"taxonomyType":76,"taxonomyTypeDesc":77},[109],{"skillNo":115,"name":116,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":117,"categories":118,"keywords":119,"publishedAt":33},"01M6FKJ21WFCDGTJQ2Q91T9DVW","websockets","https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub\u002Fblob\u002Fmain\u002Fskills\u002Fzoom\u002Fskills\u002Fwebsockets\u002FSKILL.md",[],[116]]