[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M73G4EQPHS7J0EEX6Q2587CF":3,"skill-same:01M73G4EQPHS7J0EEX6Q2587CF":48},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":18,"publishedAt":19,"linkOnly":20,"markdownContent":21,"markdownBody":22,"frontMatter":23,"refName":24,"commitSha":25,"skillDirectory":26,"forksCount":27,"repositoryHtmlUrl":28,"repositoryHomepageUrl":29,"ownerHtmlUrl":30,"ownerBlogUrl":31,"ownerDescription":32,"updatedAt":33,"install":34,"resources":47},"01M73G4EQPHS7J0EEX6Q2587CF","stride-analysis-patterns",null,"Apply STRIDE methodology to systematically identify threats. Use when analyzing system security, conducting threat modeling sessions, or creating security documentation.","Horonomos-laps\u002FYana-AI","Horonomos-laps","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F355299122?v=4","01M76B3QPXE88ET2SQPDPVATZT"," Horonomos-laps","01M72ZQRJPCYPSSWT4D00VJR2A",13,"Apache-2.0","https:\u002F\u002Fgithub.com\u002FHoronomos-laps\u002FYana-AI\u002Fblob\u002Fmain\u002Fcore\u002Fskills\u002Fstride-analysis-patterns\u002FSKILL.md",[],[],"2026-11-11 15:11:14",false,"---\nname: stride-analysis-patterns\ndescription: Apply STRIDE methodology to systematically identify threats. Use when analyzing system security, conducting threat modeling sessions, or creating security documentation.\n---\n\n# STRIDE Analysis Patterns\n\nSystematic threat identification using the STRIDE methodology.\n\n## When to Use This Skill\n\n- Starting new threat modeling sessions\n- Analyzing existing system architecture\n- Reviewing security design decisions\n- Creating threat documentation\n- Training teams on threat identification\n- Compliance and audit preparation\n\n## Core Concepts\n\n### 1. STRIDE Categories\n\n```\nS - Spoofing       → Authentication threats\nT - Tampering      → Integrity threats\nR - Repudiation    → Non-repudiation threats\nI - Information    → Confidentiality threats\n    Disclosure\nD - Denial of      → Availability threats\n    Service\nE - Elevation of   → Authorization threats\n    Privilege\n```\n\n### 2. Threat Analysis Matrix\n\n| Category            | Question                                  | Control Family |\n| ------------------- | ----------------------------------------- | -------------- |\n| **Spoofing**        | Can attacker pretend to be someone else?  | Authentication |\n| **Tampering**       | Can attacker modify data in transit\u002Frest? | Integrity      |\n| **Repudiation**     | Can attacker deny actions?                | Logging\u002FAudit  |\n| **Info Disclosure** | Can attacker access unauthorized data?    | Encryption     |\n| **DoS**             | Can attacker disrupt availability?        | Rate limiting  |\n| **Elevation**       | Can attacker gain higher privileges?      | Authorization  |\n\n## Templates\n\n### Template 1: STRIDE Threat Model Document\n\n```markdown\n# Threat Model: [System Name]\n\n## 1. System Overview\n\n### 1.1 Description\n\n[Brief description of the system and its purpose]\n\n### 1.2 Data Flow Diagram\n```\n\n[User] --> [Web App] --> [API Gateway] --> [Backend Services]\n|\nv\n[Database]\n\n```\n\n### 1.3 Trust Boundaries\n- **External Boundary**: Internet to DMZ\n- **Internal Boundary**: DMZ to Internal Network\n- **Data Boundary**: Application to Database\n\n## 2. Assets\n\n| Asset | Sensitivity | Description |\n|-------|-------------|-------------|\n| User Credentials | High | Authentication tokens, passwords |\n| Personal Data | High | PII, financial information |\n| Session Data | Medium | Active user sessions |\n| Application Logs | Medium | System activity records |\n| Configuration | High | System settings, secrets |\n\n## 3. STRIDE Analysis\n\n### 3.1 Spoofing Threats\n\n| ID | Threat | Target | Impact | Likelihood |\n|----|--------|--------|--------|------------|\n| S1 | Session hijacking | User sessions | High | Medium |\n| S2 | Token forgery | JWT tokens | High | Low |\n| S3 | Credential stuffing | Login endpoint | High | High |\n\n**Mitigations:**\n- [ ] Implement MFA\n- [ ] Use secure session management\n- [ ] Implement account lockout policies\n\n### 3.2 Tampering Threats\n\n| ID | Threat | Target | Impact | Likelihood |\n|----|--------|--------|--------|------------|\n| T1 | SQL injection | Database queries | Critical | Medium |\n| T2 | Parameter manipulation | API requests | High | High |\n| T3 | File upload abuse | File storage | High | Medium |\n\n**Mitigations:**\n- [ ] Input validation on all endpoints\n- [ ] Parameterized queries\n- [ ] File type validation\n\n### 3.3 Repudiation Threats\n\n| ID | Threat | Target | Impact | Likelihood |\n|----|--------|--------|--------|------------|\n| R1 | Transaction denial | Financial ops | High | Medium |\n| R2 | Access log tampering | Audit logs | Medium | Low |\n| R3 | Action attribution | User actions | Medium | Medium |\n\n**Mitigations:**\n- [ ] Comprehensive audit logging\n- [ ] Log integrity protection\n- [ ] Digital signatures for critical actions\n\n### 3.4 Information Disclosure Threats\n\n| ID | Threat | Target | Impact | Likelihood |\n|----|--------|--------|--------|------------|\n| I1 | Data breach | User PII | Critical | Medium |\n| I2 | Error message leakage | System info | Low | High |\n| I3 | Insecure transmission | Network traffic | High | Medium |\n\n**Mitigations:**\n- [ ] Encryption at rest and in transit\n- [ ] Sanitize error messages\n- [ ] Implement TLS 1.3\n\n### 3.5 Denial of Service Threats\n\n| ID | Threat | Target | Impact | Likelihood |\n|----|--------|--------|--------|------------|\n| D1 | Resource exhaustion | API servers | High | High |\n| D2 | Database overload | Database | Critical | Medium |\n| D3 | Bandwidth saturation | Network | High | Medium |\n\n**Mitigations:**\n- [ ] Rate limiting\n- [ ] Auto-scaling\n- [ ] DDoS protection\n\n### 3.6 Elevation of Privilege Threats\n\n| ID | Threat | Target | Impact | Likelihood |\n|----|--------|--------|--------|------------|\n| E1 | IDOR vulnerabilities | User resources | High | High |\n| E2 | Role manipulation | Admin access | Critical | Low |\n| E3 | JWT claim tampering | Authorization | High | Medium |\n\n**Mitigations:**\n- [ ] Proper authorization checks\n- [ ] Principle of least privilege\n- [ ] Server-side role validation\n\n## 4. Risk Assessment\n\n### 4.1 Risk Matrix\n\n```\n\n              IMPACT\n         Low  Med  High Crit\n    Low   1    2    3    4\n\nL Med 2 4 6 8\nI High 3 6 9 12\nK Crit 4 8 12 16\n\n```\n\n### 4.2 Prioritized Risks\n\n| Rank | Threat | Risk Score | Priority |\n|------|--------|------------|----------|\n| 1 | SQL Injection (T1) | 12 | Critical |\n| 2 | IDOR (E1) | 9 | High |\n| 3 | Credential Stuffing (S3) | 9 | High |\n| 4 | Data Breach (I1) | 8 | High |\n\n## 5. Recommendations\n\n### Immediate Actions\n1. Implement input validation framework\n2. Add rate limiting to authentication endpoints\n3. Enable comprehensive audit logging\n\n### Short-term (30 days)\n1. Deploy WAF with OWASP ruleset\n2. Implement MFA for sensitive operations\n3. Encrypt all PII at rest\n\n### Long-term (90 days)\n1. Security awareness training\n2. Penetration testing\n3. Bug bounty program\n```\n\n### Template 2: STRIDE Analysis Code\n\n```python\nfrom dataclasses import dataclass, field\nfrom enum import Enum\nfrom typing import List, Dict, Optional\nimport json\n\nclass StrideCategory(Enum):\n    SPOOFING = \"S\"\n    TAMPERING = \"T\"\n    REPUDIATION = \"R\"\n    INFORMATION_DISCLOSURE = \"I\"\n    DENIAL_OF_SERVICE = \"D\"\n    ELEVATION_OF_PRIVILEGE = \"E\"\n\n\nclass Impact(Enum):\n    LOW = 1\n    MEDIUM = 2\n    HIGH = 3\n    CRITICAL = 4\n\n\nclass Likelihood(Enum):\n    LOW = 1\n    MEDIUM = 2\n    HIGH = 3\n    CRITICAL = 4\n\n\n@dataclass\nclass Threat:\n    id: str\n    category: StrideCategory\n    title: str\n    description: str\n    target: str\n    impact: Impact\n    likelihood: Likelihood\n    mitigations: List[str] = field(default_factory=list)\n    status: str = \"open\"\n\n    @property\n    def risk_score(self) -> int:\n        return self.impact.value * self.likelihood.value\n\n    @property\n    def risk_level(self) -> str:\n        score = self.risk_score\n        if score >= 12:\n            return \"Critical\"\n        elif score >= 6:\n            return \"High\"\n        elif score >= 3:\n            return \"Medium\"\n        return \"Low\"\n\n\n@dataclass\nclass Asset:\n    name: str\n    sensitivity: str\n    description: str\n    data_classification: str\n\n\n@dataclass\nclass TrustBoundary:\n    name: str\n    description: str\n    from_zone: str\n    to_zone: str\n\n\n@dataclass\nclass ThreatModel:\n    name: str\n    version: str\n    description: str\n    assets: List[Asset] = field(default_factory=list)\n    boundaries: List[TrustBoundary] = field(default_factory=list)\n    threats: List[Threat] = field(default_factory=list)\n\n    def add_threat(self, threat: Threat) -> None:\n        self.threats.append(threat)\n\n    def get_threats_by_category(self, category: StrideCategory) -> List[Threat]:\n        return [t for t in self.threats if t.category == category]\n\n    def get_critical_threats(self) -> List[Threat]:\n        return [t for t in self.threats if t.risk_level in (\"Critical\", \"High\")]\n\n    def generate_report(self) -> Dict:\n        \"\"\"Generate threat model report.\"\"\"\n        return {\n            \"summary\": {\n                \"name\": self.name,\n                \"version\": self.version,\n                \"total_threats\": len(self.threats),\n                \"critical_threats\": len([t for t in self.threats if t.risk_level == \"Critical\"]),\n                \"high_threats\": len([t for t in self.threats if t.risk_level == \"High\"]),\n            },\n            \"by_category\": {\n                cat.name: len(self.get_threats_by_category(cat))\n                for cat in StrideCategory\n            },\n            \"top_risks\": [\n                {\n                    \"id\": t.id,\n                    \"title\": t.title,\n                    \"risk_score\": t.risk_score,\n                    \"risk_level\": t.risk_level\n                }\n                for t in sorted(self.threats, key=lambda x: x.risk_score, reverse=True)[:10]\n            ]\n        }\n\n\nclass StrideAnalyzer:\n    \"\"\"Automated STRIDE analysis helper.\"\"\"\n\n    STRIDE_QUESTIONS = {\n        StrideCategory.SPOOFING: [\n            \"Can an attacker impersonate a legitimate user?\",\n            \"Are authentication tokens properly validated?\",\n            \"Can session identifiers be predicted or stolen?\",\n            \"Is multi-factor authentication available?\",\n        ],\n        StrideCategory.TAMPERING: [\n            \"Can data be modified in transit?\",\n            \"Can data be modified at rest?\",\n            \"Are input validation controls sufficient?\",\n            \"Can an attacker manipulate application logic?\",\n        ],\n        StrideCategory.REPUDIATION: [\n            \"Are all security-relevant actions logged?\",\n            \"Can logs be tampered with?\",\n            \"Is there sufficient attribution for actions?\",\n            \"Are timestamps reliable and synchronized?\",\n        ],\n        StrideCategory.INFORMATION_DISCLOSURE: [\n            \"Is sensitive data encrypted at rest?\",\n            \"Is sensitive data encrypted in transit?\",\n            \"Can error messages reveal sensitive information?\",\n            \"Are access controls properly enforced?\",\n        ],\n        StrideCategory.DENIAL_OF_SERVICE: [\n            \"Are rate limits implemented?\",\n            \"Can resources be exhausted by malicious input?\",\n            \"Is there protection against amplification attacks?\",\n            \"Are there single points of failure?\",\n        ],\n        StrideCategory.ELEVATION_OF_PRIVILEGE: [\n            \"Are authorization checks performed consistently?\",\n            \"Can users access other users' resources?\",\n            \"Can privilege escalation occur through parameter manipulation?\",\n            \"Is the principle of least privilege followed?\",\n        ],\n    }\n\n    def generate_questionnaire(self, component: str) -> List[Dict]:\n        \"\"\"Generate STRIDE questionnaire for a component.\"\"\"\n        questionnaire = []\n        for category, questions in self.STRIDE_QUESTIONS.items():\n            for q in questions:\n                questionnaire.append({\n                    \"component\": component,\n                    \"category\": category.name,\n                    \"question\": q,\n                    \"answer\": None,\n                    \"notes\": \"\"\n                })\n        return questionnaire\n\n    def suggest_mitigations(self, category: StrideCategory) -> List[str]:\n        \"\"\"Suggest common mitigations for a STRIDE category.\"\"\"\n        mitigations = {\n            StrideCategory.SPOOFING: [\n                \"Implement multi-factor authentication\",\n                \"Use secure session management\",\n                \"Implement account lockout policies\",\n                \"Use cryptographically secure tokens\",\n                \"Validate authentication at every request\",\n            ],\n            StrideCategory.TAMPERING: [\n                \"Implement input validation\",\n                \"Use parameterized queries\",\n                \"Apply integrity checks (HMAC, signatures)\",\n                \"Implement Content Security Policy\",\n                \"Use immutable infrastructure\",\n            ],\n            StrideCategory.REPUDIATION: [\n                \"Enable comprehensive audit logging\",\n                \"Protect log integrity\",\n                \"Implement digital signatures\",\n                \"Use centralized, tamper-evident logging\",\n                \"Maintain accurate timestamps\",\n            ],\n            StrideCategory.INFORMATION_DISCLOSURE: [\n                \"Encrypt data at rest and in transit\",\n                \"Implement proper access controls\",\n                \"Sanitize error messages\",\n                \"Use secure defaults\",\n                \"Implement data classification\",\n            ],\n            StrideCategory.DENIAL_OF_SERVICE: [\n                \"Implement rate limiting\",\n                \"Use auto-scaling\",\n                \"Deploy DDoS protection\",\n                \"Implement circuit breakers\",\n                \"Set resource quotas\",\n            ],\n            StrideCategory.ELEVATION_OF_PRIVILEGE: [\n                \"Implement proper authorization\",\n                \"Follow principle of least privilege\",\n                \"Validate permissions server-side\",\n                \"Use role-based access control\",\n                \"Implement security boundaries\",\n            ],\n        }\n        return mitigations.get(category, [])\n```\n\n### Template 3: Data Flow Diagram Analysis\n\n```python\nfrom dataclasses import dataclass\nfrom typing import List, Set, Tuple\nfrom enum import Enum\n\nclass ElementType(Enum):\n    EXTERNAL_ENTITY = \"external\"\n    PROCESS = \"process\"\n    DATA_STORE = \"datastore\"\n    DATA_FLOW = \"dataflow\"\n\n\n@dataclass\nclass DFDElement:\n    id: str\n    name: str\n    type: ElementType\n    trust_level: int  # 0 = untrusted, higher = more trusted\n    description: str = \"\"\n\n\n@dataclass\nclass DataFlow:\n    id: str\n    name: str\n    source: str\n    destination: str\n    data_type: str\n    protocol: str\n    encrypted: bool = False\n\n\nclass DFDAnalyzer:\n    \"\"\"Analyze Data Flow Diagrams for STRIDE threats.\"\"\"\n\n    def __init__(self):\n        self.elements: Dict[str, DFDElement] = {}\n        self.flows: List[DataFlow] = []\n\n    def add_element(self, element: DFDElement) -> None:\n        self.elements[element.id] = element\n\n    def add_flow(self, flow: DataFlow) -> None:\n        self.flows.append(flow)\n\n    def find_trust_boundary_crossings(self) -> List[Tuple[DataFlow, int]]:\n        \"\"\"Find data flows that cross trust boundaries.\"\"\"\n        crossings = []\n        for flow in self.flows:\n            source = self.elements.get(flow.source)\n            dest = self.elements.get(flow.destination)\n            if source and dest and source.trust_level != dest.trust_level:\n                trust_diff = abs(source.trust_level - dest.trust_level)\n                crossings.append((flow, trust_diff))\n        return sorted(crossings, key=lambda x: x[1], reverse=True)\n\n    def identify_threats_per_element(self) -> Dict[str, List[StrideCategory]]:\n        \"\"\"Map applicable STRIDE categories to element types.\"\"\"\n        threat_mapping = {\n            ElementType.EXTERNAL_ENTITY: [\n                StrideCategory.SPOOFING,\n                StrideCategory.REPUDIATION,\n            ],\n            ElementType.PROCESS: [\n                StrideCategory.SPOOFING,\n                StrideCategory.TAMPERING,\n                StrideCategory.REPUDIATION,\n                StrideCategory.INFORMATION_DISCLOSURE,\n                StrideCategory.DENIAL_OF_SERVICE,\n                StrideCategory.ELEVATION_OF_PRIVILEGE,\n            ],\n            ElementType.DATA_STORE: [\n                StrideCategory.TAMPERING,\n                StrideCategory.REPUDIATION,\n                StrideCategory.INFORMATION_DISCLOSURE,\n                StrideCategory.DENIAL_OF_SERVICE,\n            ],\n            ElementType.DATA_FLOW: [\n                StrideCategory.TAMPERING,\n                StrideCategory.INFORMATION_DISCLOSURE,\n                StrideCategory.DENIAL_OF_SERVICE,\n            ],\n        }\n\n        result = {}\n        for elem_id, elem in self.elements.items():\n            result[elem_id] = threat_mapping.get(elem.type, [])\n        return result\n\n    def analyze_unencrypted_flows(self) -> List[DataFlow]:\n        \"\"\"Find unencrypted data flows crossing trust boundaries.\"\"\"\n        risky_flows = []\n        for flow in self.flows:\n            if not flow.encrypted:\n                source = self.elements.get(flow.source)\n                dest = self.elements.get(flow.destination)\n                if source and dest and source.trust_level != dest.trust_level:\n                    risky_flows.append(flow)\n        return risky_flows\n\n    def generate_threat_enumeration(self) -> List[Dict]:\n        \"\"\"Generate comprehensive threat enumeration.\"\"\"\n        threats = []\n        element_threats = self.identify_threats_per_element()\n\n        for elem_id, categories in element_threats.items():\n            elem = self.elements[elem_id]\n            for category in categories:\n                threats.append({\n                    \"element_id\": elem_id,\n                    \"element_name\": elem.name,\n                    \"element_type\": elem.type.value,\n                    \"stride_category\": category.name,\n                    \"description\": f\"{category.name} threat against {elem.name}\",\n                    \"trust_level\": elem.trust_level\n                })\n\n        return threats\n```\n\n### Template 4: STRIDE per Interaction\n\n```python\nfrom typing import List, Dict, Optional\nfrom dataclasses import dataclass\n\n@dataclass\nclass Interaction:\n    \"\"\"Represents an interaction between two components.\"\"\"\n    id: str\n    source: str\n    target: str\n    action: str\n    data: str\n    protocol: str\n\n\nclass StridePerInteraction:\n    \"\"\"Apply STRIDE to each interaction in the system.\"\"\"\n\n    INTERACTION_THREATS = {\n        # Source type -> Target type -> Applicable threats\n        (\"external\", \"process\"): {\n            \"S\": \"External entity spoofing identity to process\",\n            \"T\": \"Tampering with data sent to process\",\n            \"R\": \"External entity denying sending data\",\n            \"I\": \"Data exposure during transmission\",\n            \"D\": \"Flooding process with requests\",\n            \"E\": \"Exploiting process to gain privileges\",\n        },\n        (\"process\", \"datastore\"): {\n            \"T\": \"Process tampering with stored data\",\n            \"R\": \"Process denying data modifications\",\n            \"I\": \"Unauthorized data access by process\",\n            \"D\": \"Process exhausting storage resources\",\n        },\n        (\"process\", \"process\"): {\n            \"S\": \"Process spoofing another process\",\n            \"T\": \"Tampering with inter-process data\",\n            \"I\": \"Data leakage between processes\",\n            \"D\": \"One process overwhelming another\",\n            \"E\": \"Process gaining elevated access\",\n        },\n    }\n\n    def analyze_interaction(\n        self,\n        interaction: Interaction,\n        source_type: str,\n        target_type: str\n    ) -> List[Dict]:\n        \"\"\"Analyze a single interaction for STRIDE threats.\"\"\"\n        threats = []\n        key = (source_type, target_type)\n\n        applicable_threats = self.INTERACTION_THREATS.get(key, {})\n\n        for stride_code, description in applicable_threats.items():\n            threats.append({\n                \"interaction_id\": interaction.id,\n                \"source\": interaction.source,\n                \"target\": interaction.target,\n                \"stride_category\": stride_code,\n                \"threat_description\": description,\n                \"context\": f\"{interaction.action} - {interaction.data}\",\n            })\n\n        return threats\n\n    def generate_threat_matrix(\n        self,\n        interactions: List[Interaction],\n        element_types: Dict[str, str]\n    ) -> List[Dict]:\n        \"\"\"Generate complete threat matrix for all interactions.\"\"\"\n        all_threats = []\n\n        for interaction in interactions:\n            source_type = element_types.get(interaction.source, \"unknown\")\n            target_type = element_types.get(interaction.target, \"unknown\")\n\n            threats = self.analyze_interaction(\n                interaction, source_type, target_type\n            )\n            all_threats.extend(threats)\n\n        return all_threats\n```\n\n## Best Practices\n\n### Do's\n\n- **Involve stakeholders** - Security, dev, and ops perspectives\n- **Be systematic** - Cover all STRIDE categories\n- **Prioritize realistically** - Focus on high-impact threats\n- **Update regularly** - Threat models are living documents\n- **Use visual aids** - DFDs help communication\n\n### Don'ts\n\n- **Don't skip categories** - Each reveals different threats\n- **Don't assume security** - Question every component\n- **Don't work in isolation** - Collaborative modeling is better\n- **Don't ignore low-probability** - High-impact threats matter\n- **Don't stop at identification** - Follow through with mitigations\n\n## Resources\n\n- [Microsoft STRIDE Documentation](https:\u002F\u002Fdocs.microsoft.com\u002Fen-us\u002Fazure\u002Fsecurity\u002Fdevelop\u002Fthreat-modeling-tool-threats)\n- [OWASP Threat Modeling](https:\u002F\u002Fowasp.org\u002Fwww-community\u002FThreat_Modeling)\n- [Threat Modeling: Designing for Security](https:\u002F\u002Fwww.wiley.com\u002Fen-us\u002FThreat+Modeling%3A+Designing+for+Security-p-9781118809990)\n","# STRIDE Analysis Patterns\n\nSystematic threat identification using the STRIDE methodology.\n\n## When to Use This Skill\n\n- Starting new threat modeling sessions\n- Analyzing existing system architecture\n- Reviewing security design decisions\n- Creating threat documentation\n- Training teams on threat identification\n- Compliance and audit preparation\n\n## Core Concepts\n\n### 1. STRIDE Categories\n\n```\nS - Spoofing       → Authentication threats\nT - Tampering      → Integrity threats\nR - Repudiation    → Non-repudiation threats\nI - Information    → Confidentiality threats\n    Disclosure\nD - Denial of      → Availability threats\n    Service\nE - Elevation of   → Authorization threats\n    Privilege\n```\n\n### 2. Threat Analysis Matrix\n\n| Category            | Question                                  | Control Family |\n| ------------------- | ----------------------------------------- | -------------- |\n| **Spoofing**        | Can attacker pretend to be someone else?  | Authentication |\n| **Tampering**       | Can attacker modify data in transit\u002Frest? | Integrity      |\n| **Repudiation**     | Can attacker deny actions?                | Logging\u002FAudit  |\n| **Info Disclosure** | Can attacker access unauthorized data?    | Encryption     |\n| **DoS**             | Can attacker disrupt availability?        | Rate limiting  |\n| **Elevation**       | Can attacker gain higher privileges?      | Authorization  |\n\n## Templates\n\n### Template 1: STRIDE Threat Model Document\n\n```markdown\n# Threat Model: [System Name]\n\n## 1. System Overview\n\n### 1.1 Description\n\n[Brief description of the system and its purpose]\n\n### 1.2 Data Flow Diagram\n```\n\n[User] --> [Web App] --> [API Gateway] --> [Backend Services]\n|\nv\n[Database]\n\n```\n\n### 1.3 Trust Boundaries\n- **External Boundary**: Internet to DMZ\n- **Internal Boundary**: DMZ to Internal Network\n- **Data Boundary**: Application to Database\n\n## 2. Assets\n\n| Asset | Sensitivity | Description |\n|-------|-------------|-------------|\n| User Credentials | High | Authentication tokens, passwords |\n| Personal Data | High | PII, financial information |\n| Session Data | Medium | Active user sessions |\n| Application Logs | Medium | System activity records |\n| Configuration | High | System settings, secrets |\n\n## 3. STRIDE Analysis\n\n### 3.1 Spoofing Threats\n\n| ID | Threat | Target | Impact | Likelihood |\n|----|--------|--------|--------|------------|\n| S1 | Session hijacking | User sessions | High | Medium |\n| S2 | Token forgery | JWT tokens | High | Low |\n| S3 | Credential stuffing | Login endpoint | High | High |\n\n**Mitigations:**\n- [ ] Implement MFA\n- [ ] Use secure session management\n- [ ] Implement account lockout policies\n\n### 3.2 Tampering Threats\n\n| ID | Threat | Target | Impact | Likelihood |\n|----|--------|--------|--------|------------|\n| T1 | SQL injection | Database queries | Critical | Medium |\n| T2 | Parameter manipulation | API requests | High | High |\n| T3 | File upload abuse | File storage | High | Medium |\n\n**Mitigations:**\n- [ ] Input validation on all endpoints\n- [ ] Parameterized queries\n- [ ] File type validation\n\n### 3.3 Repudiation Threats\n\n| ID | Threat | Target | Impact | Likelihood |\n|----|--------|--------|--------|------------|\n| R1 | Transaction denial | Financial ops | High | Medium |\n| R2 | Access log tampering | Audit logs | Medium | Low |\n| R3 | Action attribution | User actions | Medium | Medium |\n\n**Mitigations:**\n- [ ] Comprehensive audit logging\n- [ ] Log integrity protection\n- [ ] Digital signatures for critical actions\n\n### 3.4 Information Disclosure Threats\n\n| ID | Threat | Target | Impact | Likelihood |\n|----|--------|--------|--------|------------|\n| I1 | Data breach | User PII | Critical | Medium |\n| I2 | Error message leakage | System info | Low | High |\n| I3 | Insecure transmission | Network traffic | High | Medium |\n\n**Mitigations:**\n- [ ] Encryption at rest and in transit\n- [ ] Sanitize error messages\n- [ ] Implement TLS 1.3\n\n### 3.5 Denial of Service Threats\n\n| ID | Threat | Target | Impact | Likelihood |\n|----|--------|--------|--------|------------|\n| D1 | Resource exhaustion | API servers | High | High |\n| D2 | Database overload | Database | Critical | Medium |\n| D3 | Bandwidth saturation | Network | High | Medium |\n\n**Mitigations:**\n- [ ] Rate limiting\n- [ ] Auto-scaling\n- [ ] DDoS protection\n\n### 3.6 Elevation of Privilege Threats\n\n| ID | Threat | Target | Impact | Likelihood |\n|----|--------|--------|--------|------------|\n| E1 | IDOR vulnerabilities | User resources | High | High |\n| E2 | Role manipulation | Admin access | Critical | Low |\n| E3 | JWT claim tampering | Authorization | High | Medium |\n\n**Mitigations:**\n- [ ] Proper authorization checks\n- [ ] Principle of least privilege\n- [ ] Server-side role validation\n\n## 4. Risk Assessment\n\n### 4.1 Risk Matrix\n\n```\n\n              IMPACT\n         Low  Med  High Crit\n    Low   1    2    3    4\n\nL Med 2 4 6 8\nI High 3 6 9 12\nK Crit 4 8 12 16\n\n```\n\n### 4.2 Prioritized Risks\n\n| Rank | Threat | Risk Score | Priority |\n|------|--------|------------|----------|\n| 1 | SQL Injection (T1) | 12 | Critical |\n| 2 | IDOR (E1) | 9 | High |\n| 3 | Credential Stuffing (S3) | 9 | High |\n| 4 | Data Breach (I1) | 8 | High |\n\n## 5. Recommendations\n\n### Immediate Actions\n1. Implement input validation framework\n2. Add rate limiting to authentication endpoints\n3. Enable comprehensive audit logging\n\n### Short-term (30 days)\n1. Deploy WAF with OWASP ruleset\n2. Implement MFA for sensitive operations\n3. Encrypt all PII at rest\n\n### Long-term (90 days)\n1. Security awareness training\n2. Penetration testing\n3. Bug bounty program\n```\n\n### Template 2: STRIDE Analysis Code\n\n```python\nfrom dataclasses import dataclass, field\nfrom enum import Enum\nfrom typing import List, Dict, Optional\nimport json\n\nclass StrideCategory(Enum):\n    SPOOFING = \"S\"\n    TAMPERING = \"T\"\n    REPUDIATION = \"R\"\n    INFORMATION_DISCLOSURE = \"I\"\n    DENIAL_OF_SERVICE = \"D\"\n    ELEVATION_OF_PRIVILEGE = \"E\"\n\n\nclass Impact(Enum):\n    LOW = 1\n    MEDIUM = 2\n    HIGH = 3\n    CRITICAL = 4\n\n\nclass Likelihood(Enum):\n    LOW = 1\n    MEDIUM = 2\n    HIGH = 3\n    CRITICAL = 4\n\n\n@dataclass\nclass Threat:\n    id: str\n    category: StrideCategory\n    title: str\n    description: str\n    target: str\n    impact: Impact\n    likelihood: Likelihood\n    mitigations: List[str] = field(default_factory=list)\n    status: str = \"open\"\n\n    @property\n    def risk_score(self) -> int:\n        return self.impact.value * self.likelihood.value\n\n    @property\n    def risk_level(self) -> str:\n        score = self.risk_score\n        if score >= 12:\n            return \"Critical\"\n        elif score >= 6:\n            return \"High\"\n        elif score >= 3:\n            return \"Medium\"\n        return \"Low\"\n\n\n@dataclass\nclass Asset:\n    name: str\n    sensitivity: str\n    description: str\n    data_classification: str\n\n\n@dataclass\nclass TrustBoundary:\n    name: str\n    description: str\n    from_zone: str\n    to_zone: str\n\n\n@dataclass\nclass ThreatModel:\n    name: str\n    version: str\n    description: str\n    assets: List[Asset] = field(default_factory=list)\n    boundaries: List[TrustBoundary] = field(default_factory=list)\n    threats: List[Threat] = field(default_factory=list)\n\n    def add_threat(self, threat: Threat) -> None:\n        self.threats.append(threat)\n\n    def get_threats_by_category(self, category: StrideCategory) -> List[Threat]:\n        return [t for t in self.threats if t.category == category]\n\n    def get_critical_threats(self) -> List[Threat]:\n        return [t for t in self.threats if t.risk_level in (\"Critical\", \"High\")]\n\n    def generate_report(self) -> Dict:\n        \"\"\"Generate threat model report.\"\"\"\n        return {\n            \"summary\": {\n                \"name\": self.name,\n                \"version\": self.version,\n                \"total_threats\": len(self.threats),\n                \"critical_threats\": len([t for t in self.threats if t.risk_level == \"Critical\"]),\n                \"high_threats\": len([t for t in self.threats if t.risk_level == \"High\"]),\n            },\n            \"by_category\": {\n                cat.name: len(self.get_threats_by_category(cat))\n                for cat in StrideCategory\n            },\n            \"top_risks\": [\n                {\n                    \"id\": t.id,\n                    \"title\": t.title,\n                    \"risk_score\": t.risk_score,\n                    \"risk_level\": t.risk_level\n                }\n                for t in sorted(self.threats, key=lambda x: x.risk_score, reverse=True)[:10]\n            ]\n        }\n\n\nclass StrideAnalyzer:\n    \"\"\"Automated STRIDE analysis helper.\"\"\"\n\n    STRIDE_QUESTIONS = {\n        StrideCategory.SPOOFING: [\n            \"Can an attacker impersonate a legitimate user?\",\n            \"Are authentication tokens properly validated?\",\n            \"Can session identifiers be predicted or stolen?\",\n            \"Is multi-factor authentication available?\",\n        ],\n        StrideCategory.TAMPERING: [\n            \"Can data be modified in transit?\",\n            \"Can data be modified at rest?\",\n            \"Are input validation controls sufficient?\",\n            \"Can an attacker manipulate application logic?\",\n        ],\n        StrideCategory.REPUDIATION: [\n            \"Are all security-relevant actions logged?\",\n            \"Can logs be tampered with?\",\n            \"Is there sufficient attribution for actions?\",\n            \"Are timestamps reliable and synchronized?\",\n        ],\n        StrideCategory.INFORMATION_DISCLOSURE: [\n            \"Is sensitive data encrypted at rest?\",\n            \"Is sensitive data encrypted in transit?\",\n            \"Can error messages reveal sensitive information?\",\n            \"Are access controls properly enforced?\",\n        ],\n        StrideCategory.DENIAL_OF_SERVICE: [\n            \"Are rate limits implemented?\",\n            \"Can resources be exhausted by malicious input?\",\n            \"Is there protection against amplification attacks?\",\n            \"Are there single points of failure?\",\n        ],\n        StrideCategory.ELEVATION_OF_PRIVILEGE: [\n            \"Are authorization checks performed consistently?\",\n            \"Can users access other users' resources?\",\n            \"Can privilege escalation occur through parameter manipulation?\",\n            \"Is the principle of least privilege followed?\",\n        ],\n    }\n\n    def generate_questionnaire(self, component: str) -> List[Dict]:\n        \"\"\"Generate STRIDE questionnaire for a component.\"\"\"\n        questionnaire = []\n        for category, questions in self.STRIDE_QUESTIONS.items():\n            for q in questions:\n                questionnaire.append({\n                    \"component\": component,\n                    \"category\": category.name,\n                    \"question\": q,\n                    \"answer\": None,\n                    \"notes\": \"\"\n                })\n        return questionnaire\n\n    def suggest_mitigations(self, category: StrideCategory) -> List[str]:\n        \"\"\"Suggest common mitigations for a STRIDE category.\"\"\"\n        mitigations = {\n            StrideCategory.SPOOFING: [\n                \"Implement multi-factor authentication\",\n                \"Use secure session management\",\n                \"Implement account lockout policies\",\n                \"Use cryptographically secure tokens\",\n                \"Validate authentication at every request\",\n            ],\n            StrideCategory.TAMPERING: [\n                \"Implement input validation\",\n                \"Use parameterized queries\",\n                \"Apply integrity checks (HMAC, signatures)\",\n                \"Implement Content Security Policy\",\n                \"Use immutable infrastructure\",\n            ],\n            StrideCategory.REPUDIATION: [\n                \"Enable comprehensive audit logging\",\n                \"Protect log integrity\",\n                \"Implement digital signatures\",\n                \"Use centralized, tamper-evident logging\",\n                \"Maintain accurate timestamps\",\n            ],\n            StrideCategory.INFORMATION_DISCLOSURE: [\n                \"Encrypt data at rest and in transit\",\n                \"Implement proper access controls\",\n                \"Sanitize error messages\",\n                \"Use secure defaults\",\n                \"Implement data classification\",\n            ],\n            StrideCategory.DENIAL_OF_SERVICE: [\n                \"Implement rate limiting\",\n                \"Use auto-scaling\",\n                \"Deploy DDoS protection\",\n                \"Implement circuit breakers\",\n                \"Set resource quotas\",\n            ],\n            StrideCategory.ELEVATION_OF_PRIVILEGE: [\n                \"Implement proper authorization\",\n                \"Follow principle of least privilege\",\n                \"Validate permissions server-side\",\n                \"Use role-based access control\",\n                \"Implement security boundaries\",\n            ],\n        }\n        return mitigations.get(category, [])\n```\n\n### Template 3: Data Flow Diagram Analysis\n\n```python\nfrom dataclasses import dataclass\nfrom typing import List, Set, Tuple\nfrom enum import Enum\n\nclass ElementType(Enum):\n    EXTERNAL_ENTITY = \"external\"\n    PROCESS = \"process\"\n    DATA_STORE = \"datastore\"\n    DATA_FLOW = \"dataflow\"\n\n\n@dataclass\nclass DFDElement:\n    id: str\n    name: str\n    type: ElementType\n    trust_level: int  # 0 = untrusted, higher = more trusted\n    description: str = \"\"\n\n\n@dataclass\nclass DataFlow:\n    id: str\n    name: str\n    source: str\n    destination: str\n    data_type: str\n    protocol: str\n    encrypted: bool = False\n\n\nclass DFDAnalyzer:\n    \"\"\"Analyze Data Flow Diagrams for STRIDE threats.\"\"\"\n\n    def __init__(self):\n        self.elements: Dict[str, DFDElement] = {}\n        self.flows: List[DataFlow] = []\n\n    def add_element(self, element: DFDElement) -> None:\n        self.elements[element.id] = element\n\n    def add_flow(self, flow: DataFlow) -> None:\n        self.flows.append(flow)\n\n    def find_trust_boundary_crossings(self) -> List[Tuple[DataFlow, int]]:\n        \"\"\"Find data flows that cross trust boundaries.\"\"\"\n        crossings = []\n        for flow in self.flows:\n            source = self.elements.get(flow.source)\n            dest = self.elements.get(flow.destination)\n            if source and dest and source.trust_level != dest.trust_level:\n                trust_diff = abs(source.trust_level - dest.trust_level)\n                crossings.append((flow, trust_diff))\n        return sorted(crossings, key=lambda x: x[1], reverse=True)\n\n    def identify_threats_per_element(self) -> Dict[str, List[StrideCategory]]:\n        \"\"\"Map applicable STRIDE categories to element types.\"\"\"\n        threat_mapping = {\n            ElementType.EXTERNAL_ENTITY: [\n                StrideCategory.SPOOFING,\n                StrideCategory.REPUDIATION,\n            ],\n            ElementType.PROCESS: [\n                StrideCategory.SPOOFING,\n                StrideCategory.TAMPERING,\n                StrideCategory.REPUDIATION,\n                StrideCategory.INFORMATION_DISCLOSURE,\n                StrideCategory.DENIAL_OF_SERVICE,\n                StrideCategory.ELEVATION_OF_PRIVILEGE,\n            ],\n            ElementType.DATA_STORE: [\n                StrideCategory.TAMPERING,\n                StrideCategory.REPUDIATION,\n                StrideCategory.INFORMATION_DISCLOSURE,\n                StrideCategory.DENIAL_OF_SERVICE,\n            ],\n            ElementType.DATA_FLOW: [\n                StrideCategory.TAMPERING,\n                StrideCategory.INFORMATION_DISCLOSURE,\n                StrideCategory.DENIAL_OF_SERVICE,\n            ],\n        }\n\n        result = {}\n        for elem_id, elem in self.elements.items():\n            result[elem_id] = threat_mapping.get(elem.type, [])\n        return result\n\n    def analyze_unencrypted_flows(self) -> List[DataFlow]:\n        \"\"\"Find unencrypted data flows crossing trust boundaries.\"\"\"\n        risky_flows = []\n        for flow in self.flows:\n            if not flow.encrypted:\n                source = self.elements.get(flow.source)\n                dest = self.elements.get(flow.destination)\n                if source and dest and source.trust_level != dest.trust_level:\n                    risky_flows.append(flow)\n        return risky_flows\n\n    def generate_threat_enumeration(self) -> List[Dict]:\n        \"\"\"Generate comprehensive threat enumeration.\"\"\"\n        threats = []\n        element_threats = self.identify_threats_per_element()\n\n        for elem_id, categories in element_threats.items():\n            elem = self.elements[elem_id]\n            for category in categories:\n                threats.append({\n                    \"element_id\": elem_id,\n                    \"element_name\": elem.name,\n                    \"element_type\": elem.type.value,\n                    \"stride_category\": category.name,\n                    \"description\": f\"{category.name} threat against {elem.name}\",\n                    \"trust_level\": elem.trust_level\n                })\n\n        return threats\n```\n\n### Template 4: STRIDE per Interaction\n\n```python\nfrom typing import List, Dict, Optional\nfrom dataclasses import dataclass\n\n@dataclass\nclass Interaction:\n    \"\"\"Represents an interaction between two components.\"\"\"\n    id: str\n    source: str\n    target: str\n    action: str\n    data: str\n    protocol: str\n\n\nclass StridePerInteraction:\n    \"\"\"Apply STRIDE to each interaction in the system.\"\"\"\n\n    INTERACTION_THREATS = {\n        # Source type -> Target type -> Applicable threats\n        (\"external\", \"process\"): {\n            \"S\": \"External entity spoofing identity to process\",\n            \"T\": \"Tampering with data sent to process\",\n            \"R\": \"External entity denying sending data\",\n            \"I\": \"Data exposure during transmission\",\n            \"D\": \"Flooding process with requests\",\n            \"E\": \"Exploiting process to gain privileges\",\n        },\n        (\"process\", \"datastore\"): {\n            \"T\": \"Process tampering with stored data\",\n            \"R\": \"Process denying data modifications\",\n            \"I\": \"Unauthorized data access by process\",\n            \"D\": \"Process exhausting storage resources\",\n        },\n        (\"process\", \"process\"): {\n            \"S\": \"Process spoofing another process\",\n            \"T\": \"Tampering with inter-process data\",\n            \"I\": \"Data leakage between processes\",\n            \"D\": \"One process overwhelming another\",\n            \"E\": \"Process gaining elevated access\",\n        },\n    }\n\n    def analyze_interaction(\n        self,\n        interaction: Interaction,\n        source_type: str,\n        target_type: str\n    ) -> List[Dict]:\n        \"\"\"Analyze a single interaction for STRIDE threats.\"\"\"\n        threats = []\n        key = (source_type, target_type)\n\n        applicable_threats = self.INTERACTION_THREATS.get(key, {})\n\n        for stride_code, description in applicable_threats.items():\n            threats.append({\n                \"interaction_id\": interaction.id,\n                \"source\": interaction.source,\n                \"target\": interaction.target,\n                \"stride_category\": stride_code,\n                \"threat_description\": description,\n                \"context\": f\"{interaction.action} - {interaction.data}\",\n            })\n\n        return threats\n\n    def generate_threat_matrix(\n        self,\n        interactions: List[Interaction],\n        element_types: Dict[str, str]\n    ) -> List[Dict]:\n        \"\"\"Generate complete threat matrix for all interactions.\"\"\"\n        all_threats = []\n\n        for interaction in interactions:\n            source_type = element_types.get(interaction.source, \"unknown\")\n            target_type = element_types.get(interaction.target, \"unknown\")\n\n            threats = self.analyze_interaction(\n                interaction, source_type, target_type\n            )\n            all_threats.extend(threats)\n\n        return all_threats\n```\n\n## Best Practices\n\n### Do's\n\n- **Involve stakeholders** - Security, dev, and ops perspectives\n- **Be systematic** - Cover all STRIDE categories\n- **Prioritize realistically** - Focus on high-impact threats\n- **Update regularly** - Threat models are living documents\n- **Use visual aids** - DFDs help communication\n\n### Don'ts\n\n- **Don't skip categories** - Each reveals different threats\n- **Don't assume security** - Question every component\n- **Don't work in isolation** - Collaborative modeling is better\n- **Don't ignore low-probability** - High-impact threats matter\n- **Don't stop at identification** - Follow through with mitigations\n\n## Resources\n\n- [Microsoft STRIDE Documentation](https:\u002F\u002Fdocs.microsoft.com\u002Fen-us\u002Fazure\u002Fsecurity\u002Fdevelop\u002Fthreat-modeling-tool-threats)\n- [OWASP Threat Modeling](https:\u002F\u002Fowasp.org\u002Fwww-community\u002FThreat_Modeling)\n- [Threat Modeling: Designing for Security](https:\u002F\u002Fwww.wiley.com\u002Fen-us\u002FThreat+Modeling%3A+Designing+for+Security-p-9781118809990)\n",{"name":5,"description":7},"main","481dcd7dd2e288b9d627a2bd017db70e64e6c6fa","core\u002Fskills\u002Fstride-analysis-patterns",1,"https:\u002F\u002Fgithub.com\u002FHoronomos-laps\u002FYana-AI","https:\u002F\u002Fyana.vutam.link\u002F","https:\u002F\u002Fgithub.com\u002FHoronomos-laps","https:\u002F\u002Fyana.vutam.link","An open-source governed runtime & execution environment for multi-agent AI systems.","2026-11-11 23:56:26",{"source":8,"skillName":5,"commands":35,"prompt":45,"zipAvailable":46},[36,39,42],{"tool":37,"command":38},"npx","npx skills add Horonomos-laps\u002FYana-AI --skill stride-analysis-patterns",{"tool":40,"command":41},"bunx","bunx skills add Horonomos-laps\u002FYana-AI --skill stride-analysis-patterns",{"tool":43,"command":44},"pnpm","pnpm dlx skills add Horonomos-laps\u002FYana-AI --skill stride-analysis-patterns","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002FHoronomos-laps\u002FYana-AI\u002Fblob\u002Fmain\u002Fcore\u002Fskills\u002Fstride-analysis-patterns\u002FSKILL.md",true,[],[49,57,64,72,80,88],{"skillNo":50,"name":51,"nameZh":6,"description":52,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":53,"licenseFileUrl":6,"sourceHtmlUrl":54,"categories":55,"keywords":56,"publishedAt":19},"01M735GKET5YVYKAY62W2P5YXB","openai--sentry--sentry","Use when the user asks to inspect Sentry issues or events, summarize recent production errors, or pull basic Sentry health data via the Sentry API; perform read-only queries with the bundled script and require `SENTRY_AUTH_TOKEN`.","MIT","https:\u002F\u002Fgithub.com\u002FHoronomos-laps\u002FYana-AI\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fopenai--sentry--sentry\u002FSKILL.md",[],[],{"skillNo":58,"name":59,"nameZh":6,"description":60,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":61,"categories":62,"keywords":63,"publishedAt":19},"01M73DCAP83T17HY7SMGK7MGFE","ito-basket-compare","Compare Itô prediction-market baskets against a user's knowledge base, portfolio notes, financial context, watchlist, or research thesis. Use for read-only basket comparison and gap analysis without investment advice or live trading.","https:\u002F\u002Fgithub.com\u002FHoronomos-laps\u002FYana-AI\u002Fblob\u002Fmain\u002Fcore\u002Fskills\u002Fito-basket-compare\u002FSKILL.md",[],[],{"skillNo":65,"name":66,"nameZh":6,"description":67,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":68,"sourceHtmlUrl":69,"categories":70,"keywords":71,"publishedAt":19},"01M734CYEMZFDR3KH6SW0JP8TD","implementing-network-traffic-baselining","Build network traffic baselines from NetFlow\u002FIPFIX data using Python pandas for statistical analysis, z-score anomaly detection, and hourly\u002Fdaily traffic pattern profiling","https:\u002F\u002Fgithub.com\u002Fyanacuti1121\u002FYana-AI\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fimplementing-network-traffic-baselining\u002FLICENSE","https:\u002F\u002Fgithub.com\u002FHoronomos-laps\u002FYana-AI\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fimplementing-network-traffic-baselining\u002FSKILL.md",[],[],{"skillNo":73,"name":74,"nameZh":6,"description":75,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":76,"sourceHtmlUrl":77,"categories":78,"keywords":79,"publishedAt":19},"01M73ASZ6NJRJM44Z2P84NGQ3Q","detecting-evasion-techniques-in-endpoint-logs","Detects defense evasion techniques used by adversaries in endpoint logs including log tampering, timestomping, process injection, and security tool disabling. Use when investigating suspicious endpoint behavior, building detection rules for evasion tactics, or conducting threat hunting for stealthy adversary activity. Activates for requests involving evasion detection, defense evasion analysis, log tampering detection, or MITRE ATT&CK TA0005.","https:\u002F\u002Fgithub.com\u002Fyanacuti1121\u002FYana-AI\u002Fblob\u002Fmain\u002Fcore\u002Fskills\u002Fdetecting-evasion-techniques-in-endpoint-logs\u002FLICENSE","https:\u002F\u002Fgithub.com\u002FHoronomos-laps\u002FYana-AI\u002Fblob\u002Fmain\u002Fcore\u002Fskills\u002Fdetecting-evasion-techniques-in-endpoint-logs\u002FSKILL.md",[],[],{"skillNo":81,"name":82,"nameZh":6,"description":83,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":84,"sourceHtmlUrl":85,"categories":86,"keywords":87,"publishedAt":19},"01M734AFNXD06Z78QRK0VKGT7Q","implementing-microsegmentation-with-guardicore","Implementing microsegmentation using Akamai Guardicore Segmentation to map application dependencies, create granular network policies, visualize east-west traffic flows, and enforce least-privilege communication between workloads across data centers and cloud.","https:\u002F\u002Fgithub.com\u002Fyanacuti1121\u002FYana-AI\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fimplementing-microsegmentation-with-guardicore\u002FLICENSE","https:\u002F\u002Fgithub.com\u002FHoronomos-laps\u002FYana-AI\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fimplementing-microsegmentation-with-guardicore\u002FSKILL.md",[],[],{"skillNo":89,"name":90,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":91,"categories":92,"keywords":93,"publishedAt":19},"01M736TK27QMCXK0DVCH25SJN5","ramdisk-tmpfs-patterns","https:\u002F\u002Fgithub.com\u002FHoronomos-laps\u002FYana-AI\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Framdisk-tmpfs-patterns\u002FSKILL.md",[],[]]