What is PASTA Stage 3 in threat modeling?

PASTA Stage 3 focuses on Application Decomposition, where the application is broken down into its constituent components, roles, and data flows to establish a foundation for threat identification.

How does this skill help with security audits?

It automatically generates a Role-Permission Matrix and maps trust boundaries, making it easier to spot unauthorized access paths or missing authentication checks.

Do I need previous PASTA stage outputs to use this skill?

Ideally, yes. This skill consumes Stage 2 outputs like entry point inventories and data flow diagrams to provide a high-fidelity decomposition of the application.

What levels of analysis depth are supported?

The skill supports four depth levels: quick (structure-only), standard (full decomposition), deep (cross-component flows), and expert (formal trust boundary and privilege escalation mapping).

PASTA Application Decomposition

Name: PASTA Application Decomposition
Author: florianbuetow

byflorianbuetow

•

Security & Testing

Analyzes application architecture to identify components, trust boundaries, and data sensitivity for formal threat modeling.

This skill automates Stage 3 of the Process for Attack Simulation and Threat Analysis (PASTA) methodology by decomposing applications into functional components and mapping their security relationships. It meticulously catalogs user roles, permission matrices, and data classifications while identifying critical trust boundaries between services and external interfaces. By providing a structured inventory of components and authorization flows, it enables security engineers and developers to pinpoint potential privilege escalation paths and authorization gaps before they can be exploited in production environments.

Key Features

016 GitHub stars

02Automated component inventory and functional unit identification

03Detailed Role-Based Access Control (RBAC) and permission matrix generation

04Identification of authorization gaps and elevated privilege components

05Multi-level data classification (Public, Internal, Confidential, Restricted)

06Comprehensive mapping of trust boundaries and service-to-service authentication

Use Cases

01Auditing complex role-permission configurations and service-to-service trust levels

02Documenting sensitive data flows and classification levels across microservices

03Performing formal PASTA Stage 3 threat modeling assessments during the design phase

What are Skills?·How to Install

Install with 🐟 Skill.Fish

npx skillfish add florianbuetow/claude-code pasta-decompose

For use in Claude.ai and ChatGPT

Download Skill