Can I use this skill without completing PASTA Stages 1-3?

While it functions best with data from previous stages (assets and trust boundaries), the skill will warn the user and make informed assumptions if that data is missing.

How does this skill integrate with the MITRE ATT&CK framework?

It automatically maps identified system vulnerabilities and entry points to specific MITRE ATT&CK Technique IDs, such as T1190 for public-facing exploits or T1195 for supply chain compromise.

What kind of output does this skill provide?

It generates a comprehensive Threat Catalog containing threat actor profiles, likelihood assessments, and attack trees to visualize how an attacker might reach critical assets.

What is the primary purpose of the pasta-threats skill?

It implements Stage 4 of the PASTA threat modeling framework to identify, profile, and catalog threats based on real-world adversary tactics and techniques.

PASTA Threat Analysis

Name: PASTA Threat Analysis
Author: florianbuetow

byflorianbuetow

•

Security & Testing

Identifies and analyzes potential threats by profiling actors and mapping attack vectors to the MITRE ATT&CK framework using the PASTA methodology.

The PASTA Threat Analysis skill automates Stage 4 of the Process for Attack Simulation and Threat Analysis (PASTA) methodology within Claude Code. It allows security professionals and developers to ground their threat modeling in real-world intelligence by profiling adversary tactics, identifying likely threat actors, and cross-referencing system components with the MITRE ATT&CK framework. By consuming data from previous architectural stages, it generates a detailed threat catalog that evaluates the likelihood and impact of specific attacks, including supply chain risks and internal insider threats, ensuring that security measures are prioritized based on actual risk profiles.

Key Features

01Adversary Persona Profiling for targeted and opportunistic threat actors

02Automated Attack Tree construction for visualizing exploitation paths

03Customizable analysis depth ranging from quick audits to expert-level simulations

04Comprehensive Supply Chain analysis for third-party dependency risks

05Direct mapping of system entry points to MITRE ATT&CK techniques

066 GitHub stars

Use Cases

01Mapping an application's attack surface to standardized industry threat patterns

02Prioritizing security patches based on the likelihood of specific actor motivations

03Conducting deep-dive supply chain security audits for CI/CD pipelines

What are Skills?·How to Install

Install with 🐟 Skill.Fish

npx skillfish add florianbuetow/claude-code pasta-threats

For use in Claude.ai and ChatGPT

Download Skill