Define technical scope and map attack surfaces for PASTA threat modeling.
npx skills add https://github.com/florianbuetow/claude-code --skill pasta-scope
Please help me install this Agent Skill. Skill: pasta-scope Source: https://github.com/florianbuetow/claude-code/tree/main/plugins/appsec/skills/pasta-scope Command: npx skills add https://github.com/florianbuetow/claude-code --skill pasta-scope
This Skill helps define the technical boundaries and entry points of a system, crucial for threat modeling and understanding the attack surface.
Use the pasta-scope skill to map the technical scope of the current project with a standard depth scan.
High-intent search queries and answers about installing and using this skill.
To define the technical scope and attack surface for threat modeling, you must enumerate system entry points, external dependencies, and network boundaries. This process maps architecture and protocols to visualize data movement across trust boundaries.
Generating a data flow diagram (DFD) for PASTA threat modeling requires visualizing data movement and trust boundaries within your system. This is achieved by parsing route definitions, API specs, and network configurations to map external-facing APIs and internal service dependencies.
Yes, you can parse Dockerfiles and IaC to map network boundaries and identify external dependencies. Analyzing these infrastructure configurations alongside route definitions and API specs allows you to accurately define the technical scope and enumerate all system entry points.
The best way to identify external-facing APIs and internal service dependencies is by running a standard depth scan of your project's technical scope. This maps architecture, protocols, and entry points to visualize data movement and establish trust boundaries for vulnerability analysis.
Yes, this approach works directly with the PASTA threat modeling methodology for web applications. It supports the methodology by generating technical scope documents and data flow diagrams that map system attack surfaces, external APIs, and internal service data paths.
inbharataiGenerate Dockerfiles and docker-compose configurations with multi-stage builds, health checks, volumes, and networks.
hpsgdIdentify and document system threats using STRIDE analysis.
reececoakes99Track and assess CVEs affecting payment infrastructure using NVD and external databases.
florianbuetowProfile threat actors and map MITRE ATT&CK techniques to system threats.
