ca-threat-model · diff
git:20260724.a3a2df2 to git:20260925.34b459c
56 added, 27 removed. Audit A to A.
---
name: ca-threat-model
- description: Opt-in lightweight STRIDE pass for a sensitive feature before implementation. Not a routine gate — invoke it when a change warrants security thought.
+ description: "Threat-model a sensitive design with STRIDE on request. Read-only analysis of threats, controls, and implementation constraints."
argument-hint: "<scope description>"
---
- # /ca-threat-model — STRIDE pass (opt-in)
+ # security-architecture
- Optional, lightweight pre-implementation security review for a sensitive change — new external endpoints, new secrets-handling paths, new auth/authz flows. **Opt-in, not a routine gate**: nothing routes here automatically. Invoke it when a change warrants the thought; skip it otherwise. Read-only — modifies no file. Describe what the component does, what data it handles, and which actors interact with it.
+ Optional, lightweight threat-modeling pass over a design before it is built. Selected when the user deliberately requests threat modeling of a sensitive design, with or without `/ca-threat-model`. Never forced on an ordinary change. Reviews architectural intent before code exists; for code already written, dispatch `security-reviewer` instead.
- ## Routes to
+ ## Entry boundaries
- `security-architecture` (`<plugin-root>/routines/security-architecture/SKILL.md`). The skill reads:
+ Read-only: modify no project file, decision record, control or implementation.
+ Optional reviewers inherit this read-only analysis scope. An explanation-only
+ security question does not start the pass; mentioning authentication in an ordinary
+ change does not opt in. The user need not repeat a slash command to request it.
+ Missing required security-controls input is a prerequisite failure, separate from
+ the severity of a finding. A lesser gap is a constraint, not blanket denied clearance.
- - `<project-root>/.codearbiter/security-controls.md` — compliance requirements.
- - `<project-root>/.codearbiter/decisions/` — existing security-relevant ADRs.
+ ## Pre-flight
- ## Output
+ - Read `<project-root>/.codearbiter/security-controls.md` — approved primitives, declared security boundaries and their permitted crossings, what is and is not allowed. If it cannot be read, STOP and surface the gap; do not guess the boundary model.
+ - Establish the scope from the user's request: the feature, component, or design under review.
+ - Read relevant security ADRs under `<project-root>/.codearbiter/decisions/`; do not invent decisions or interpret their absence as approval.
- ```
- ## Scope
- <what is being analyzed>
+ ## Phase 1 — Attack surface · gate: BLOCK
- ## STRIDE findings
- | Threat | Category | Likelihood | Impact | Control |
- |--------|-------------|------------|--------|------------------------------|
- | ... | S/T/R/I/D/E | H/M/L | H/M/L | <control or NONE — needs one> |
+ Map what the change exposes. Name, for the scope:
- ## Recommended controls before implementation
- - <control 1>
+ - New or changed entry points — routes, endpoints, message consumers, CLI surfaces.
+ - New egress — outbound calls, external dependencies, new data sinks.
+ - Security boundaries crossed, as declared in `security-controls.md` (trust transitions, privilege changes, data leaving a controlled zone).
+ - The data handled and its sensitivity.
- ## Clearance
- CLEAR TO IMPLEMENT | BLOCKED — resolve findings first
- ```
+ A boundary crossing not described in `security-controls.md` is a finding, not a silent pass. A finding outside this scope gets one line with an inline `[NEEDS-TRIAGE]` marker.
- ## When NOT to use
+ Gate: the attack surface and every boundary crossing in scope are enumerated.
- - Reviewing already-written code → `/ca-review`.
- - A full cross-cutting review → `/ca-checkpoint`.
- - A security question → `/ca-btw`.
+ ## Phase 2 — STRIDE pass · gate: STOP
- ## Hard gate
+ Walk the surface from Phase 1 through STRIDE. For each relevant category, name the concrete threat and the control expected to mitigate it:
- Read-only — modifies no file. This is an advisory pass, not a routine gate; it never runs unless
- invoked.
+ - **Spoofing** — identity/authentication of the actor at the boundary.
+ - **Tampering** — integrity of data in transit and at rest.
+ - **Repudiation** — whether actions are attributable.
+ - **Information disclosure** — exposure of sensitive data, including in logs and errors.
+ - **Denial of service** — exhaustion or availability impact.
+ - **Elevation of privilege** — privilege gained across the boundary.
+
+ Mark each threat's mitigation `PRESENT`, `PLANNED`, or `GAP`. Skip a category only with a one-line reason it does not apply.
+
+ If the threat depends on auth, crypto, key handling, or secrets, MAY dispatch `<plugin-root>/agents/auth-crypto-reviewer.md`. For broader boundary or surface concerns, MAY dispatch `<plugin-root>/agents/security-reviewer.md`. Both govern by `security-controls.md`.
+
+ Gate: STOP only on a genuinely critical unmitigated threat — a `GAP` that is exploitable now with high impact. Lesser gaps are surfaced as constraints, not stops.
+
+ ## Phase 3 — Report · gate: BLOCK
+
+ Produce a terse report:
+
+ - **Surface** — entry points, egress, boundaries crossed.
+ - **Threats** — the STRIDE findings; lead with `GAP`s, then `PLANNED`, summarize `PRESENT` in one line.
+ - **Verdict** — `PROCEED` (no open gap), `PROCEED-WITH-CONSTRAINTS` (gaps listed with owner), or `STOP` (a critical unmitigated threat is present; name it).
+
+ A decision-worthy gap is escalated to the user or to `<project-root>/.codearbiter/decisions/` via `/adr` — never authored as an ADR by this skill.
+
+ Gate: report delivered with a stated verdict; every STOP-level threat from Phase 2 is reflected in it.
+
+ ## Hard rules
+
+ - MUST NOT force this pass on an ordinary change. It is invoked deliberately for sensitive features only.
+ - MUST NOT guess the boundary model — read `security-controls.md` or STOP.
+ - MUST NOT silently pass an undeclared boundary crossing — surface it.
+ - MUST NOT STOP on anything short of a critical, exploitable, unmitigated threat; lesser gaps are constraints.
+ - MUST NOT author an ADR — escalate decision-worthy gaps to the user or `/adr`.