threat-model command
Threat-model a sensitive design with STRIDE on request. Read-only analysis of threats, controls, and implementation constraints.
/ca:threat-model$ca-threat-model/ca-threat-modelAvailability is read from each shipped host catalog. Preview-only commands are marked on the page.
What it does
Section titled “What it does”An opt-in, lightweight STRIDE pass over a design before it’s built — invoked deliberately, never
forced on an ordinary change. It maps the attack surface (new entry points, new egress, security
boundaries crossed against .codearbiter/security-controls.md, the data handled), then walks each
of the six STRIDE categories — spoofing, tampering, repudiation, information disclosure, denial of
service, elevation of privilege — marking each threat’s mitigation PRESENT, PLANNED, or GAP.
It reads no code changes to review after the fact; for code already written, /ca:review or
/ca:checkpoint cover that ground instead.
The report distinguishes PROCEED, PROCEED-WITH-CONSTRAINTS, and STOP.
A critical, currently exploitable, unmitigated threat stops the pass. Missing required
security controls is a separate prerequisite failure. The pass and any optional
reviewers are read-only; they do not create an ADR or change project files.
/ca:threat-model "<scope description>"Name the feature or component, its data sensitivity, and the actors that reach it — that framing becomes the scope of the STRIDE pass.
Example
Section titled “Example”> /ca:threat-model "new public webhook endpoint that receives partner payment notifications"
## ScopePublic webhook receiving partner payment notifications; no prior auth boundary here.
## STRIDE findings| Threat | Category | Likelihood | Impact | Control ||---|---|---|---|---|| Unsigned payload accepted as genuine | Spoofing | H | H | GAP — no signature verification planned || Payload replay | Repudiation | M | M | PLANNED — nonce + timestamp window |
## Recommended controls before implementation- HMAC signature verification on the webhook payload before any processing.
## VerdictPROCEED-WITH-CONSTRAINTS: implement signature verification before exposing the endpoint.When to reach for it
Section titled “When to reach for it”Before writing a sensitive feature — new external endpoints, new secrets-handling paths, new auth/authz flows. Not a routine gate; skip it for ordinary changes.
| Gate | When | Effect |
|---|---|---|
| critical-gap stop | a STRIDE category comes back GAP — exploitable now, high impact | the pass halts with a stated verdict of STOP naming the specific unmitigated threat; a lesser gap is surfaced as a constraint, not a halt |
Related
Section titled “Related”Route context
Section titled “Route context”Find this entry in the workflow atlas. Compare its related teaching maps, host spelling and context inputs. The exact procedure below remains the owner.
Source
Section titled “Source”Source — plugins/ca/commands/threat-model.md (v3.7.0)
---description: "Threat-model a sensitive design with STRIDE on request. Read-only analysis of threats, controls, and implementation constraints."argument-hint: "<scope description>"disable-model-invocation: true---
# security-architecture
For every security policy reference below, follow `${CLAUDE_PLUGIN_ROOT}/includes/knowledge.md`("Read security policy before a security decision"): select the repository'scontext format, read the complete policy from exact `CTX-SECURITY-CONTROLS`records in HTML mode or the full Markdown controls in Markdown mode, and readoperative scope blocks when applicable. Required policy that is missing orunreadable blocks a security decision; scope blocks alone are not full policy.
Optional, lightweight threat-modeling pass over a design before it is built. Selected when the user deliberately requests threat modeling of a sensitive design, with or without `/ca:threat-model`. Never forced on an ordinary change. Reviews architectural intent before code exists; for code already written, dispatch `security-reviewer` instead.
## Entry boundaries
Read-only: modify no project file, decision record, control or implementation.Optional reviewers inherit this read-only analysis scope. An explanation-onlysecurity question does not start the pass; mentioning authentication in an ordinarychange does not opt in. The user need not repeat a slash command to request it.Missing required security-controls input is a prerequisite failure, separate fromthe severity of a finding. A lesser gap is a constraint, not blanket denied clearance.
## Pre-flight
- Read the complete format-selected `security-controls` policy — approved primitives, declared security boundaries and their permitted crossings, what is and is not allowed. If the required policy cannot be read, STOP and surface the gap; do not guess the boundary model.- Establish the scope from the user's request: the feature, component, or design under review.- Read relevant security ADRs under `${CLAUDE_PROJECT_DIR}/.codearbiter/decisions/`; do not invent decisions or interpret their absence as approval.
## Phase 1 — Attack surface · gate: BLOCK
Map what the change exposes. Name, for the scope:
- New or changed entry points — routes, endpoints, message consumers, CLI surfaces.- New egress — outbound calls, external dependencies, new data sinks.- Security boundaries crossed, as declared in `security-controls.md` (trust transitions, privilege changes, data leaving a controlled zone).- The data handled and its sensitivity.
A boundary crossing not described in `security-controls.md` is a finding, not a silent pass. A finding outside this scope gets one line with an inline `[NEEDS-TRIAGE]` marker.
Gate: the attack surface and every boundary crossing in scope are enumerated.
## Phase 2 — STRIDE pass · gate: STOP
Walk the surface from Phase 1 through STRIDE. For each relevant category, name the concrete threat and the control expected to mitigate it:
- **Spoofing** — identity/authentication of the actor at the boundary.- **Tampering** — integrity of data in transit and at rest.- **Repudiation** — whether actions are attributable.- **Information disclosure** — exposure of sensitive data, including in logs and errors.- **Denial of service** — exhaustion or availability impact.- **Elevation of privilege** — privilege gained across the boundary.
Mark each threat's mitigation `PRESENT`, `PLANNED`, or `GAP`. Skip a category only with a one-line reason it does not apply.
If the threat depends on auth, crypto, key handling, or secrets, MAY dispatch `${CLAUDE_PLUGIN_ROOT}/agents/auth-crypto-reviewer.md`. For broader boundary or surface concerns, MAY dispatch `${CLAUDE_PLUGIN_ROOT}/agents/security-reviewer.md`. Both govern by `security-controls.md`.
Gate: STOP only on a genuinely critical unmitigated threat — a `GAP` that is exploitable now with high impact. Lesser gaps are surfaced as constraints, not stops.
## Phase 3 — Report · gate: BLOCK
Produce a terse report:
- **Surface** — entry points, egress, boundaries crossed.- **Threats** — the STRIDE findings; lead with `GAP`s, then `PLANNED`, summarize `PRESENT` in one line.- **Verdict** — `PROCEED` (no open gap), `PROCEED-WITH-CONSTRAINTS` (gaps listed with owner), or `STOP` (a critical unmitigated threat is present; name it).
A decision-worthy gap is escalated to the user or to `${CLAUDE_PROJECT_DIR}/.codearbiter/decisions/` via `/adr` — never authored as an ADR by this skill.
Gate: report delivered with a stated verdict; every STOP-level threat from Phase 2 is reflected in it.
## Hard rules
- MUST NOT force this pass on an ordinary change. It is invoked deliberately for sensitive features only.- MUST NOT guess the boundary model — read `security-controls.md` or STOP.- MUST NOT silently pass an undeclared boundary crossing — surface it.- MUST NOT STOP on anything short of a critical, exploitable, unmitigated threat; lesser gaps are constraints.- MUST NOT author an ADR — escalate decision-worthy gaps to the user or `/adr`.