threat-model
Opt-in lightweight STRIDE pass for a sensitive feature before implementation. Not a routine gate — invoke it when a change warrants security thought.
What it does
Section titled “What it does”An opt-in, lightweight STRIDE pass over a design before it’s built — invoked deliberately, never
forced on an ordinary change. It maps the attack surface (new entry points, new egress, security
boundaries crossed against .codearbiter/security-controls.md, the data handled), then walks each
of the six STRIDE categories — spoofing, tampering, repudiation, information disclosure, denial of
service, elevation of privilege — marking each threat’s mitigation PRESENT, PLANNED, or GAP.
It reads no code changes to review after the fact; for code already written, /ca:review or
/ca:checkpoint cover that ground instead.
/ca:threat-model "<scope description>"Name the feature or component, its data sensitivity, and the actors that reach it — that framing becomes the scope of the STRIDE pass.
Example
Section titled “Example”> /ca:threat-model "new public webhook endpoint that receives partner payment notifications"
## ScopePublic webhook receiving partner payment notifications; no prior auth boundary here.
## STRIDE findings| Threat | Category | Likelihood | Impact | Control ||---|---|---|---|---|| Unsigned payload accepted as genuine | Spoofing | H | H | GAP — no signature verification planned || Payload replay | Repudiation | M | M | PLANNED — nonce + timestamp window |
## Recommended controls before implementation- HMAC signature verification on the webhook payload before any processing.
## ClearanceBLOCKED — resolve findings firstWhen to reach for it
Section titled “When to reach for it”Before writing a sensitive feature — new external endpoints, new secrets-handling paths, new auth/authz flows. Not a routine gate; skip it for ordinary changes.
| Gate | When | Effect |
|---|---|---|
| critical-gap stop | a STRIDE category comes back GAP — exploitable now, high impact | the pass halts with a stated verdict of STOP naming the specific unmitigated threat; a lesser gap is surfaced as a constraint, not a halt |
Related
Section titled “Related”Source
Section titled “Source”Source — plugins/ca/commands/threat-model.md (v2.9.1)
---description: Opt-in lightweight STRIDE pass for a sensitive feature before implementation. Not a routine gate — invoke it when a change warrants security thought.argument-hint: "<scope description>"---
# /ca:threat-model — STRIDE pass (opt-in)
Optional, lightweight pre-implementation security review for a sensitive change — new external endpoints, new secrets-handling paths, new auth/authz flows. **Opt-in, not a routine gate**: nothing routes here automatically. Invoke it when a change warrants the thought; skip it otherwise. Read-only — modifies no file. Describe what the component does, what data it handles, and which actors interact with it.
## Routes to
`security-architecture` (`${CLAUDE_PLUGIN_ROOT}/skills/security-architecture/SKILL.md`). The skill reads:
- `${CLAUDE_PROJECT_DIR}/.codearbiter/security-controls.md` — compliance requirements.- `${CLAUDE_PROJECT_DIR}/.codearbiter/decisions/` — existing security-relevant ADRs.
## Output
```## Scope<what is being analyzed>
## STRIDE findings| Threat | Category | Likelihood | Impact | Control ||--------|-------------|------------|--------|------------------------------|| ... | S/T/R/I/D/E | H/M/L | H/M/L | <control or NONE — needs one> |
## Recommended controls before implementation- <control 1>
## ClearanceCLEAR TO IMPLEMENT | BLOCKED — resolve findings first```
## When NOT to use
- Reviewing already-written code → `/ca:review`.- A full cross-cutting review → `/ca:checkpoint`.- A security question → `/ca:btw`.
## Hard gate
Read-only — modifies no file. This is an advisory pass, not a routine gate; it never runs unlessinvoked.