How does this skill differ from other threat modelers?

Unlike other tools that might run analysis in parallel, this skill executes 7 stages sequentially, ensuring each stage provides the necessary context for the next, leading to a more accurate and business-aligned risk assessment.

What is the PASTA framework?

PASTA (Process for Attack Simulation and Threat Analysis) is a risk-centric threat modeling methodology that focuses on aligning technical security requirements with business objectives across seven distinct stages.

Can I run specific stages of the PASTA analysis?

Yes, you can use the --only flag to run specific stages (e.g., --only 1,4,7), though the skill will implicitly run necessary prior stages to ensure the integrity of the input data for the requested stage.

Does this skill provide fix recommendations?

Yes, when using the --fix flag, the skill generates specific mitigation roadmaps, effort estimates, and remediation steps for every identified vulnerability.

What security standards are supported?

The skill automatically maps findings to the OWASP Top 10, STRIDE categories, MITRE ATT&CK techniques, and CWE identifiers for comprehensive industry-standard coverage.

PASTA Threat Modeling

Name: PASTA Threat Modeling
Author: florianbuetow

byflorianbuetow

•

セキュリティとテスト

Conducts sequential, risk-centric threat modeling using the 7-stage PASTA framework to align security findings with business objectives.

PASTA (Process for Attack Simulation and Threat Analysis) is a specialized security skill for Claude Code that performs a deep, 7-stage risk analysis of your application. Unlike traditional threat models, this skill runs sequentially, ensuring that business objectives and technical scope inform every subsequent step, from application decomposition to final risk-ranked mitigation strategies. It integrates industry standards like MITRE ATT&CK, STRIDE, and CWE to provide a comprehensive view of your security posture, prioritizing vulnerabilities that pose the greatest risk to your specific business assets.

主な機能

01Business-weighted risk scoring and executive summary generation

02Automated attack simulation and exploit chain construction

03Sequential 7-stage risk-centric analysis (Objectives to Impact)

04Deep integration with MITRE ATT&CK, STRIDE, and CWE frameworks

056 GitHub stars

06Advanced Expert Mode for automated red team subagent analysis

ユースケース

01Aligning technical vulnerability remediation with high-level business risk tolerance

02Performing a comprehensive security audit before a major production release

03Generating compliance-ready threat models for regulatory requirements like GDPR or PCI-DSS

What are Skills?·How to Install

Install with 🐟 Skill.Fish

npx skillfish add florianbuetow/claude-code pasta

For use in Claude.ai and ChatGPT

Download Skill