From appsec
This skill should be used when the user asks to "define technical scope", "map attack surface", "identify entry points", "build a data flow diagram", or is running PASTA stage 2. Also triggers when the user asks about DFDs, network boundaries, external dependencies, or deployment topology in a threat modeling context. Part of the PASTA threat modeling methodology (Stage 2 of 7).
npx claudepluginhub florianbuetow/claude-code --plugin appsecThis skill uses the workspace's default tool permissions.
Map the technical boundaries of the system -- architecture, protocols, entry
Acquire memory dumps from live systems/VMs and analyze with Volatility 3 for processes, networks, DLLs, injections in incident response or malware hunts.
Provides x86-64/ARM disassembly patterns, calling conventions, control flow recognition for static analysis of executables and compiled binaries.
Identifies anti-debugging checks like IsDebuggerPresent, NtQueryInformationProcess in Windows binaries; suggests bypasses via patches/hooks/scripts for malware analysis, CTFs, authorized RE.
Map the technical boundaries of the system -- architecture, protocols, entry points, and attack surface. Build data flow diagrams (DFDs) showing how data moves through the system and where trust boundaries exist.
Read ../../shared/schemas/flags.md for the full flag specification. Key behaviors:
| Flag | Stage 2 Behavior |
|---|---|
--scope | Default changed. Scans routes, API specs, Dockerfiles, IaC, and network configs. |
--depth quick | Entry points from route definitions and API specs only. |
--depth standard | Full entry point scan + dependency catalog + protocol identification. |
--depth deep | Standard + infrastructure analysis (Docker, K8s, Terraform) + network boundary mapping. |
--depth expert | Deep + complete DFD with trust levels annotated on every data flow. |
--severity | Not applicable at this stage. |
Read ../../shared/frameworks/pasta.md, Stage 2 section. PASTA is SEQUENTIAL.
Stage 2 consumes Stage 1 output and feeds Stage 3.
Required: Stage 1 output -- business-critical assets, compliance requirements, and risk tolerance thresholds. If unavailable, warn and proceed with assumptions.
Parse --scope flag (default: changed). Prioritize: route files, controllers,
API gateway configs, Dockerfiles, docker-compose.yml, K8s manifests, Terraform,
nginx configs, OpenAPI/Swagger specs, GraphQL schemas.
Scan for all data ingress paths:
@RequestMapping, Django URLs.Catalog outbound connections: third-party APIs (payment, auth, email), databases, caches (Redis, Memcached), cloud services (S3, SQS, Pub/Sub), and package dependencies from manifest files.
Construct a textual DFD: external entities, processes, data stores, data flows with protocol labels, and trust boundary lines.
Stage 2 produces a Technical Scope Document with DFD. ID prefix: PASTA (e.g., PASTA-S2-001).
## PASTA Stage 2: Technical Scope
### Technology Stack
| Layer | Technology | Version |
|-------|-----------|---------|
| Language / Framework / Database / Cache / Deployment | ... | ... |
### Entry Points
| ID | Type | Path/Handler | Auth Required | Protocol |
|----|------|-------------|---------------|----------|
| EP-01 | REST API | POST /api/users | No | HTTPS |
| EP-02 | WebSocket | /ws/chat | Yes (JWT) | WSS |
### External Dependencies
| Service | Purpose | Data Exchanged | Protocol |
|---------|---------|---------------|----------|
| Stripe | Payments | Card tokens | HTTPS |
### Data Flow Diagram
User --> [API Gateway] --> [Auth] --> [App Server] --> [Database]
Trust Boundaries:
- Internet | DMZ: User to API Gateway
- DMZ | Internal: API Gateway to App Server
- App | Data: App Server to Database
### Attack Surface Summary
| Surface | Entry Points | Internet-Facing | Auth Required |
|---------|-------------|-----------------|---------------|
| REST API | N | Yes | Mixed |
Findings follow ../../shared/schemas/findings.md with:
metadata.tool: "pasta-scope", metadata.framework: "pasta", metadata.category: "Stage-2"Stage 3: Application Decomposition (pasta-decompose). Pass entry points,
DFD, dependencies, and network boundaries. Stage 3 decomposes into components,
maps trust boundaries, and catalogs roles and permissions.