/gaia-threat-model

user-facing
Category:
Planning
Lifecycle phase:
3 -- Solutioning
Arguments:
None

What it does

/gaia-threat-model creates a security threat model using STRIDE methodology for threat identification and DREAD scoring for risk prioritization. It analyzes each system component and data flow for all six STRIDE threat categories, scores every threat, and produces mitigation strategies and security requirements.

When to use it

  • After creating the architecture, before implementation begins.
  • When you want a systematic security analysis of your system design.

Prerequisites

  • Architecture must exist at .gaia/artifacts/planning-artifacts/architecture.md.

How to invoke

/gaia-threat-model

What it does step by step

  1. Load architecture Extracts system components, data flows, trust boundaries, external interfaces, and APIs.
  2. Identify assets Catalogs valuable data and systems (credentials, PII, financial data, API keys). Classifies sensitivity: critical, high, medium, low.
  3. STRIDE analysis For each component and data flow, evaluates: Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, Elevation of Privilege.
  4. DREAD scoring Rates each threat 1-10 on: Damage potential, Reproducibility, Exploitability, Affected users, Discoverability. Calculates risk level: Critical (8-10), High (6-8), Medium (4-6), Low (1-4).
  5. Mitigation strategies Proposes mitigations for each identified threat, prioritized by DREAD score.
  6. Generate output Writes the threat model document with all assets, threats, scores, mitigations, and security requirements.

Inputs

InputSourceDescription
Architecture.gaia/artifacts/planning-artifacts/architecture.mdSystem components and data flows to analyze (required).

Outputs

OutputLocationDescription
Threat model.gaia/artifacts/planning-artifacts/threat-model.mdSTRIDE analysis, DREAD scores, mitigations, and security requirements.

Example session

> /gaia-threat-model

Loading architecture... 8 components, 12 data flows, 3 trust boundaries.

Assets identified: 6 (2 critical, 2 high, 2 medium)

STRIDE Analysis: 18 threats identified
DREAD Scoring:
  Critical: 2 threats (auth bypass, SQL injection)
  High: 5 threats
  Medium: 8 threats
  Low: 3 threats

Mitigations proposed for all 18 threats.

Threat model written to: .gaia/artifacts/planning-artifacts/threat-model.md

What to run next

Troubleshooting

"Architecture doc not found"

Run /gaia-create-arch first.