security-architecture skill
Routed skill
Threat-model a sensitive design with STRIDE on request. Read-only analysis of threats, controls, and implementation constraints.
How it is used
The orchestrator routes to this skill from an owning command. It is not a direct user entry point.
What it does
Section titled “What it does”This is an opt-in threat-modeling pass over a design, invoked deliberately through the threat-model command for a sensitive feature — never forced on an ordinary change. It maps what the change exposes, walks that surface through a structured set of threat categories, and reports a verdict. It reviews architectural intent before code exists; once code is written, a security reviewer covers that ground instead.
Phases
Section titled “Phases”- Map the attack surface — new entry points, new outbound calls, security boundaries crossed, and the sensitivity of the data involved.
- Walk that surface through six threat categories, marking each relevant one’s mitigation as present, planned, or a gap, and optionally dispatching a specialist reviewer for auth, crypto, or broader boundary concerns.
- Report the surface, the threats found — gaps first — and a verdict: proceed, proceed with named constraints, or stop.
The report hands any decision-worthy gap to you or to a decision record — this skill never authors one itself. It only halts the design outright on a genuinely critical, exploitable, unmitigated threat; everything short of that is surfaced as a constraint to carry forward.
| Gate | When | Effect |
|---|---|---|
| critical unmitigated threat | during the structured threat pass | the only condition that stops the pass outright — an exploitable, high-impact gap with no mitigation; lesser gaps are reported as constraints instead |
Related
Section titled “Related”Source
Section titled “Source”Source — plugins/ca/skills/security-architecture/SKILL.md (v3.7.0)
---name: security-architecturedescription: "Threat-model a sensitive design with STRIDE on request. Read-only analysis of threats, controls, and implementation constraints."argument-hint: "<scope description>"---
# security-architecture
For every security policy reference below, follow `${CLAUDE_PLUGIN_ROOT}/includes/knowledge.md`("Read security policy before a security decision"): select the repository'scontext format, read the complete policy from exact `CTX-SECURITY-CONTROLS`records in HTML mode or the full Markdown controls in Markdown mode, and readoperative scope blocks when applicable. Required policy that is missing orunreadable blocks a security decision; scope blocks alone are not full policy.
Optional, lightweight threat-modeling pass over a design before it is built. Selected when the user deliberately requests threat modeling of a sensitive design, with or without `/ca:threat-model`. Never forced on an ordinary change. Reviews architectural intent before code exists; for code already written, dispatch `security-reviewer` instead.
## Entry boundaries
Read-only: modify no project file, decision record, control or implementation.Optional reviewers inherit this read-only analysis scope. An explanation-onlysecurity question does not start the pass; mentioning authentication in an ordinarychange does not opt in. The user need not repeat a slash command to request it.Missing required security-controls input is a prerequisite failure, separate fromthe severity of a finding. A lesser gap is a constraint, not blanket denied clearance.
## Pre-flight
- Read the complete format-selected `security-controls` policy — approved primitives, declared security boundaries and their permitted crossings, what is and is not allowed. If the required policy cannot be read, STOP and surface the gap; do not guess the boundary model.- Establish the scope from the user's request: the feature, component, or design under review.- Read relevant security ADRs under `${CLAUDE_PROJECT_DIR}/.codearbiter/decisions/`; do not invent decisions or interpret their absence as approval.
## Phase 1 — Attack surface · gate: BLOCK
Map what the change exposes. Name, for the scope:
- New or changed entry points — routes, endpoints, message consumers, CLI surfaces.- New egress — outbound calls, external dependencies, new data sinks.- Security boundaries crossed, as declared in `security-controls.md` (trust transitions, privilege changes, data leaving a controlled zone).- The data handled and its sensitivity.
A boundary crossing not described in `security-controls.md` is a finding, not a silent pass. A finding outside this scope gets one line with an inline `[NEEDS-TRIAGE]` marker.
Gate: the attack surface and every boundary crossing in scope are enumerated.
## Phase 2 — STRIDE pass · gate: STOP
Walk the surface from Phase 1 through STRIDE. For each relevant category, name the concrete threat and the control expected to mitigate it:
- **Spoofing** — identity/authentication of the actor at the boundary.- **Tampering** — integrity of data in transit and at rest.- **Repudiation** — whether actions are attributable.- **Information disclosure** — exposure of sensitive data, including in logs and errors.- **Denial of service** — exhaustion or availability impact.- **Elevation of privilege** — privilege gained across the boundary.
Mark each threat's mitigation `PRESENT`, `PLANNED`, or `GAP`. Skip a category only with a one-line reason it does not apply.
If the threat depends on auth, crypto, key handling, or secrets, MAY dispatch `${CLAUDE_PLUGIN_ROOT}/agents/auth-crypto-reviewer.md`. For broader boundary or surface concerns, MAY dispatch `${CLAUDE_PLUGIN_ROOT}/agents/security-reviewer.md`. Both govern by `security-controls.md`.
Gate: STOP only on a genuinely critical unmitigated threat — a `GAP` that is exploitable now with high impact. Lesser gaps are surfaced as constraints, not stops.
## Phase 3 — Report · gate: BLOCK
Produce a terse report:
- **Surface** — entry points, egress, boundaries crossed.- **Threats** — the STRIDE findings; lead with `GAP`s, then `PLANNED`, summarize `PRESENT` in one line.- **Verdict** — `PROCEED` (no open gap), `PROCEED-WITH-CONSTRAINTS` (gaps listed with owner), or `STOP` (a critical unmitigated threat is present; name it).
A decision-worthy gap is escalated to the user or to `${CLAUDE_PROJECT_DIR}/.codearbiter/decisions/` via `/adr` — never authored as an ADR by this skill.
Gate: report delivered with a stated verdict; every STOP-level threat from Phase 2 is reflected in it.
## Hard rules
- MUST NOT force this pass on an ordinary change. It is invoked deliberately for sensitive features only.- MUST NOT guess the boundary model — read `security-controls.md` or STOP.- MUST NOT silently pass an undeclared boundary crossing — surface it.- MUST NOT STOP on anything short of a critical, exploitable, unmitigated threat; lesser gaps are constraints.- MUST NOT author an ADR — escalate decision-worthy gaps to the user or `/adr`.