Borrowing it
Nothing to install: this file belongs to Everyone-Needs-A-Copilot/claude-copilot. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/Everyone-Needs-A-Copilot/claude-copilot/main/.claude/skills/security/stride-dread/SKILL.mdgit clone --depth 1 https://github.com/Everyone-Needs-A-Copilot/claude-copilotWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/everyone-needs-a-copilot/claude-copilot/stride-dread)<a href="https://agentmods.dev/skills/everyone-needs-a-copilot/claude-copilot/stride-dread"><img src="https://agentmods.dev/badge/skills/everyone-needs-a-copilot/claude-copilot/stride-dread.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00145 | $0.01609 |
| Opus 5 | $0.00072 | $0.00805 |
| Sonnet 5 | $0.00029 | $0.00322 |
| Haiku 4.5 | $0.00015 | $0.00161 |
Grade A, and why
stride-dread scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 151 lines — stays where its author put it; the contents beside it link to each section on GitHub.
STRIDE + DREAD Security Framework
Use this skill for structured threat identification and severity scoring. Apply before code review, not after.
STRIDE enumeration is prose judgment — the model reasons through each category. DREAD scoring is deterministic arithmetic — the script computes it exactly and consistently. Never re-derive DREAD scores by hand; always run the scorer.
STRIDE Threat Categories
Enumerate ALL six categories before reviewing code. Never skip categories — absence of a threat is still a finding.
| Category | Question to Answer |
|---|---|
| Spoofing | Can an attacker impersonate a user, service, or system component? |
| Tampering | Can data be modified in transit, at rest, or in processing? |
| Repudiation | Can actions be denied without an audit trail? |
| Information Disclosure | Can sensitive data leak to unauthorized parties? |
| Denial of Service | Can availability be degraded or exhausted? |
| Elevation of Privilege | Can an attacker gain access beyond their authorization? |
DREAD Severity Scoring
Rate each identified threat 1–10 on each of the five DREAD dimensions. The script computes the per-finding average and assigns a severity band.
| Key | Dimension | 1 | 5 | 10 |
|---|---|---|---|---|
| D | Damage potential | Minimal | User data exposed | Mass compromise |
| R | Reproducibility | Requires specific state | Usually reproducible | Always reproducible |
| E | Exploitability | Expert + physical access | Authenticated user | Anyone, unauthenticated |
| A | Affected users | Single user | Subset of users | All users |
| D2 | Discoverability | Obscure internals | Documented behavior | Visible in source/network |
Band thresholds (documented in script, not guessed):
- 9.0–10.0: Critical — block deployment
- 7.0–8.9: High — fix in current cycle
- 4.0–6.9: Medium — fix next cycle
- 0.0–3.9: Low — track, accept risk
Invocation — DREAD Scorer (L3 Script)
After enumerating STRIDE threats, assemble findings as a JSON array and run the scorer. Consume its output only — the script source never enters context.
What ships with it
3 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- yesterday First seen · 151 lines · 145 tokens per session scan A 8fba1b8bbc7f
stride-dread is a skill published in the GitHub repository Everyone-Needs-A-Copilot/claude-copilot (13 stars, last pushed yesterday), licensed MIT. It adds 145 tokens to every session and 1,609 once invoked, about $0.0007 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-04.
Other skills, from other repositories
cpp-coding-standards
C++ coding standards based on the C++ Core Guidelines (isocpp.github.io). Use when writing, reviewing, or refactoring C++ code to enforce modern, safe, and idiomatic practices.
review-loop
Run the adversarial verification loop — implement, then hand the change to a fresh checker that did not write it, fix what it finds, and re-dispatch until APPROVE. Use before claiming any behavioural change is done, and on requests like "review loop", "adversarial review", "independent review", "get this verified"…
security-review
Perform a focused security review of pending git changes to identify high-confidence security vulnerabilities with real exploitation potential. Use this skill when the user asks for a security review, security audit, vulnerability scan, or wants to check pending changes on a branch for security issues before merging.…
huggingface-llm-trainer
Train or fine-tune language models with TRL or Unsloth on Hugging Face Jobs, including SFT, DPO, GRPO, reward models, and GGUF conversion. Use for cloud LLM training; use huggingface-vision-trainer for vision tasks.
huggingface-vision-trainer
Train object-detection, image-classification, or SAM segmentation models on Hugging Face Jobs. Use for vision fine-tuning and evaluation; use huggingface-llm-trainer for language models.
code-quality
Agents should invoke this skill for code reviews, linting/formatting setup, maintainability checks, complexity concerns, warning cleanup, coding standards, or quality gates in Rust, TypeScript, Python, shell, and mixed repos.