Help us improve
Share bugs, ideas, or general feedback.
Share bugs, ideas, or general feedback.
Share bugs, ideas, or general feedback.
By allsmog
AI-powered PASTA threat modeling plugin for Claude Code. Walks through the 7-stage Process for Attack Simulation and Threat Analysis with STRIDE classification, MITRE ATT&CK mapping, DFD generation, and evidence-anchored threat scenarios.
npx claudepluginhub allsmog/randori-pluginRun a full PASTA threat modeling analysis through all available stages sequentially
PASTA Stage 1: Define business objectives, security requirements, and compliance context
PASTA Stage 2: Map technical scope — software components, actors, data sources/sinks, services
PASTA Stage 3: Application decomposition — DFD, trust boundaries, entry points, access control matrix
PASTA Stage 4: Threat analysis — STRIDE classification, ATT&CK mapping, probabilistic assessment, attack tree drafts
Use this agent when building attack trees, analyzing attack surfaces, or modeling multi-step attack paths. Triggered by PASTA Stage 4 (attack tree drafts) and Stage 6 (full attack modeling). Also triggered when user asks about "attack trees", "attack paths", "attack surface", "kill chain", or "multi-step attacks".
Use this agent when assessing risk levels, prioritizing threats, or producing risk management recommendations. Triggered by PASTA Stage 7 (risk management) and when user asks about "risk assessment", "risk prioritization", "mitigation priorities", "residual risk", or "risk treatment".
Use this agent when identifying and classifying threats using STRIDE methodology with MITRE ATT&CK mapping. Triggered by PASTA Stage 4 (threat analysis), or when user asks about "threat identification", "STRIDE analysis", "what threats exist", "ATT&CK mapping", or "threat scenarios".
Use this agent when correlating threats to known vulnerabilities (CVE/CWE), checking dependencies for known issues, or mapping threat scenarios to vulnerability databases. Triggered by PASTA Stage 5 (vulnerability analysis) and when user asks about "CVE lookup", "vulnerability correlation", "known vulnerabilities", "dependency vulnerabilities", or "CWE mapping".
This skill should be used when building attack trees, when the user mentions "attack tree", "attack path", "AND/OR tree", "threat tree", "multi-step attack", or needs to construct structured attack decompositions.
This skill should be used when creating data flow diagrams, when the user mentions "DFD", "data flow diagram", "trust boundaries", "data flows", "Mermaid diagram", or needs to visualize how data moves through the system.
This skill should be used when mapping threats to MITRE ATT&CK techniques, when the user mentions "ATT&CK", "MITRE", "T-codes", "attack techniques", "tactics and techniques", "kill chain", or needs to reference the ATT&CK Enterprise framework for threat classification.
This skill should be used when the user mentions "PASTA", "threat modeling methodology", "Process for Attack Simulation", "7-stage threat model", "OWASP threat modeling", or needs to understand the PASTA framework stages, outputs, and how they connect.
This skill should be used when classifying threats using STRIDE methodology, when the user mentions "STRIDE", "spoofing threats", "tampering threats", "repudiation", "information disclosure", "denial of service", "elevation of privilege", or needs to categorize security threats by type.
Uses power tools
Uses Bash, Write, or Edit tools
Share bugs, ideas, or general feedback.
Own this plugin?
Verify ownership to unlock analytics, metadata editing, and a verified badge.
Sign in to claimOwn this plugin?
Verify ownership to unlock analytics, metadata editing, and a verified badge.
Sign in to claimBased on adoption, maintenance, documentation, and repository signals. Not a security audit or endorsement.
Comprehensive threat modeling toolkit using STRIDE, attack trees, data flow analysis, and risk scoring. Model threats, analyze attack surfaces, assess organizational risk, and map trust boundaries.
Repository-grounded threat modeling that enumerates trust boundaries, assets, attacker capabilities, abuse paths, and mitigations, and writes a concise Markdown threat model. Trigger only when the user explicitly asks to threat model a codebase or path, enumerate threats/abuse paths, or perform AppSec threat modeling. Do not trigger for general architecture summaries, code review, or non-security design work. Originally from OpenAI's curated skills catalog.
Security skills for vibe coding — pre-coding security assessment, code vulnerability review, and threat modeling. Works without any MCP server or Jira/Confluence setup.
AI-powered whitebox penetration testing plugin for Claude Code. 9 languages, 27 skills, 8 autonomous agents. STRIDE threat modeling, hotspot-aware findings, SARIF output, and polyglot monorepo support.
Builds multi-language source code graphs for security analysis: call graphs, attack surface mapping, blast radius, taint propagation, complexity hotspots, and entry point enumeration. Generates Mermaid diagrams (call graphs, class hierarchies, dependency maps, heatmaps). Compares code graph snapshots for structural diff and evolution analysis. Runs graph-informed mutation testing triage (genotoxic). Generates mutation-driven test vectors (vector-forge). Extracts crypto protocol message flows and converts Mermaid diagrams to ProVerif models. Projects SARIF and weAudit findings onto code graphs. Use when analyzing call paths, mapping attack surface, visualizing code architecture, triaging survived mutants, generating cryptographic test vectors, diagramming crypto protocols, formally verifying protocols, or augmenting audits with static analysis findings.
Complete offensive security operator workspace: 27 specialist agents, 6 engagement commands, 5 reference skill libraries, scope-gated hooks, and evidence logging for professional penetration testing and red-team operations.
AI-powered whitebox penetration testing plugin for Claude Code. 9 languages, 27 skills, 8 autonomous agents. STRIDE threat modeling, hotspot-aware findings, SARIF output, and polyglot monorepo support.
AI-first compliance assessment plugin for Claude Code. Runs prompt-orchestrated ISO 27001 Annex A and NIST SP 800-53 Rev 5 assessments with enterprise evidence packs, evidence-backed findings, cold review rounds, and durable run artifacts.
AI-powered threat modeling implementing the full PASTA (Process for Attack Simulation and Threat Analysis) methodology. STRIDE classification, MITRE ATT&CK mapping, data flow diagrams, attack trees, and evidence-anchored threat scenarios — all from your source code.
Most teams skip threat modeling because it feels academic. Randori makes it a 10-minute conversation: type /randori:pasta, and Claude walks through all 7 PASTA stages, reads your code, builds DFDs, identifies threats with STRIDE, maps to ATT&CK techniques, and produces attack trees.
claude mcp add-plugin randori-plugin --path /path/to/randori-plugin
Or clone and add manually:
git clone https://github.com/allsmog/randori-plugin.git
Then add to your Claude Code settings:
{
"plugins": ["/path/to/randori-plugin"]
}
# Full PASTA threat model (stages 1-4)
/randori:pasta
# Individual stages
/randori:s1 # Define business objectives
/randori:s2 # Map technical scope
/randori:s3 # Decompose app + generate DFD
/randori:s4 # Threat analysis (STRIDE + ATT&CK)
# Generate report from completed stages
/randori:threat-report
| Command | Description | Free |
|---|---|---|
/randori:pasta | Full PASTA run (all available stages) | S1-S4 |
/randori:s1 | Stage 1: Define business objectives | Yes |
/randori:s2 | Stage 2: Technical scope | Yes |
/randori:s3 | Stage 3: App decomposition + DFD | Yes |
/randori:s4 | Stage 4: Threat analysis (STRIDE) | Yes |
/randori:s5 | Stage 5: Vulnerability analysis | Pro |
/randori:s6 | Stage 6: Attack modeling | Pro |
/randori:s7 | Stage 7: Risk management | Pro |
/randori:threat-report | Generate report | Yes |
| Flag | Effect |
|---|---|
--stages s1,s2,s3,s4 | Run specific stages only |
--format json|md|mermaid | Output format |
--resume | Resume from previous incomplete analysis |
S1 Define Objectives → Business context, risk profile
↓
S2 Technical Scope → Components, actors, services
↓
S3 Decomposition → DFD, trust boundaries, entry points
↓
S4 Threat Analysis → STRIDE threats, ATT&CK, attack trees
↓
S5 Vulnerability Analysis → CVE/CWE correlation (Pro)
↓
S6 Attack Modeling → Full attack trees, simulation (Pro)
↓
S7 Risk Management → Mitigations, residual risk (Pro)
Provides a complete foundational threat model:
Adds deep analysis via the Randori API:
| Agent | Role | Used In |
|---|---|---|
| threat-analyst | STRIDE threats + ATT&CK mapping | S4 |
| attack-modeler | Attack trees + attack surface | S4, S6 |
| risk-assessor | Probabilistic risk scoring | S4, S7 |
| vuln-correlator | CVE/CWE correlation | S5 |
| Skill | Description |
|---|---|
| STRIDE Classification | Complete STRIDE reference with code patterns, ATT&CK mappings, and CWE cross-references |
| PASTA Methodology | Full 7-stage methodology reference with inputs, outputs, and dependencies |
| MITRE ATT&CK Mapping | Enterprise technique reference organized by tactic |
| Attack Tree Generation | AND/OR tree construction with VerSprite node roles and probability propagation |
| DFD Generation | Data flow diagram creation in Mermaid format with trust zones |
Every threat includes:
[TS-001] Brute-force authentication bypass
- STRIDE: Spoofing
- ATT&CK: T1110 (Brute Force)
- OWASP: A07 (Auth Failures)
- Evidence: src/routes/auth.ts:45 — No rate limiting on login
- Probability: 0.72 (5-factor assessment)
- Impact: High
Mermaid DFDs saved to .claude/dfd.mmd: