What is PASTA Stage 2?

PASTA Stage 2 is the technical discovery phase of the Process for Attack Simulation and Threat Analysis, focusing on defining architecture, protocols, and attack surfaces.

Do I need Stage 1 results to use this skill?

Stage 1 output is preferred for context on business-critical assets, but the skill can proceed with assumptions if Stage 1 data is not available.

What are the different analysis depths?

The skill supports 'quick' (APIs only), 'standard' (dependencies + protocols), 'deep' (infrastructure + boundaries), and 'expert' (full DFD with trust levels).

Does this skill create Data Flow Diagrams?

Yes, it generates textual DFDs that include external entities, processes, data stores, and labeled data flows with trust boundaries.

What technologies can it analyze?

It scans a wide range of technologies including Express, FastAPI, GraphQL, Docker, Kubernetes, Terraform, and various message queues like Kafka or RabbitMQ.

PASTA Stage 2: Technical Scope Mapping

Name: PASTA Stage 2: Technical Scope Mapping
Author: florianbuetow

byflorianbuetow

•

Security & Testing

Maps application attack surfaces and technical boundaries to create comprehensive data flow diagrams for threat modeling.

This skill automates Stage 2 of the PASTA (Process for Attack Simulation and Threat Analysis) methodology by systematically defining the technical scope of an application. It scans source code, API specifications, and infrastructure-as-code configurations to catalog entry points, external dependencies, and network boundaries. By generating detailed Data Flow Diagrams (DFDs) and technical scope documents, it provides a structured foundation for security audits and vulnerability assessments, ensuring all potential ingress paths and trust boundaries are documented and analyzed.

Key Features

01Infrastructure analysis of Docker, Kubernetes, and Terraform for network boundary mapping.

02Generation of textual Data Flow Diagrams (DFDs) with annotated trust boundaries.

03Scalable analysis depths ranging from quick API scans to expert-level infrastructure audits.

04Comprehensive cataloging of external dependencies and third-party service integrations.

05Automated entry point enumeration across REST, GraphQL, WebSockets, and Message Queues.

066 GitHub stars

Use Cases

01Generating attack surface maps for new features or legacy system documentation.

02Visualizing data flows and trust boundaries for security compliance and audits.

03Conducting the technical discovery phase of a PASTA threat modeling exercise.

What are Skills?·How to Install

Install with 🐟 Skill.Fish

npx skillfish add florianbuetow/claude-code pasta-scope

For use in Claude.ai and ChatGPT

Download Skill