skills.rest
florianbuetow
florianbuetowCOMMUNITY
Explore all skills by this author →
Website𝕏@bytetweetsGitHub

pasta-decompose

Decompose applications into components and map trust boundaries for PASTA threat modeling.

12|1|Updated Feb 9, 2026
Search Tags:#security#threat modeling#PASTA#data classification#trust boundaries#application decomposition
One-click install
npx skills add https://github.com/florianbuetow/claude-code --skill pasta-decompose
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: pasta-decompose
Source: https://github.com/florianbuetow/claude-code/tree/main/plugins/appsec/skills/pasta-decompose
Command: npx skills add https://github.com/florianbuetow/claude-code --skill pasta-decompose

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) and scripts (resource) components.

What problem does it solve?

This Skill addresses the complexity of understanding application architecture by systematically breaking it down into components, mapping trust boundaries, and classifying data sensitivity, which is crucial for effective threat modeling.

Core Features & Use Cases

  • Application Decomposition: Identifies and inventories all functional units within an application.
  • Trust Boundary Mapping: Visualizes where security perimeters exist between components and services.
  • Data Classification: Assigns sensitivity levels (Public, Internal, Confidential, Restricted) to data entities.
  • Role & Permission Analysis: Catalogs user roles and their associated permissions across components.
  • Use Case: When performing a PASTA threat model, use this skill in Stage 3 to get a clear picture of your application's structure, data flow, and security posture before identifying specific threats.

Quick Start

Use the pasta-decompose skill to decompose the application and map trust boundaries with standard depth.

Frequently Asked Questions about pasta-decompose

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
What is application decomposition in threat modeling?▼

Application decomposition in threat modeling is the process of breaking an application down into functional components, mapping trust boundaries, identifying roles and permissions, and classifying data sensitivity to understand security posture.

How do I map trust boundaries for my application architecture?▼

You map trust boundaries by identifying and inventorying all application functional units, then visualizing where security perimeters exist between those components and services to clarify data flow and security posture.

How do I classify data sensitivity when analyzing application components?▼

You classify data sensitivity by assigning levels such as Public, Internal, Confidential, or Restricted to data entities identified during application decomposition, alongside cataloging user roles and associated permissions.

When do I need to decompose an application using the PASTA methodology?▼

You decompose an application using the PASTA methodology during Stage 3 to get a clear picture of application structure, data flow, and security posture before identifying specific threats in later stages.

Do I need prior PASTA threat modeling context to map application components?▼

Yes, you need prior Stage 2 output for context to perform application decomposition, mapping trust boundaries, and analyzing roles and permissions effectively within the PASTA threat modeling methodology.

Can I analyze database schemas and middleware during application decomposition?▼

Yes, application decomposition supports various depth levels for detailed analysis of middleware, authentication modules, role definitions, permission configurations, and database schemas within your application architecture.

Related Skills

Explore More Software Engineering Skills→
florianbuetowflorianbuetow
12

pasta

Automate the 7-stage PASTA threat modeling framework for security evaluation.

Community
Advanced
Jayarr03Jayarr03

stride-spoofing

Analyze trust boundaries and data flows to generate STRIDE spoofing threats.

Community
Advanced
sendaifunsendaifun
125

zz-code-recon

Map data flows, trust boundaries, and component relationships in unfamiliar codebases.

Official
Advanced
yusufcmgyusufcmg
1

stride-analysis-patterns

Apply the STRIDE methodology to identify and categorize security threats in software systems.

Community
Advanced