PASTA Threat Model Dispatcher (Sequential)

Dispatch 7 PASTA stages in strict sequential order. Unlike all other framework dispatchers, PASTA runs each stage as a Task, waits for its output, and passes that output into the next stage's prompt. This is because PASTA is a risk-centric process where business objectives (Stage 1) constrain technical scope (Stage 2), which constrains decomposition (Stage 3), and so on through risk analysis (Stage 7).

Do NOT run stages in parallel. Do NOT skip stages. Do NOT reorder stages.

Stage Failure Handling

If a stage fails (returns empty output, errors, or times out):

• Record the failure: stage number, error details, partial output if any.

• Check if remaining stages can proceed:

• Stages 1–3 are foundational. If any fails, STOP the pipeline and report partial results from completed stages.

• Stages 4–7 can run with degraded input from prior stages. Note the gap explicitly in their output.

• Present completed stage outputs to the user with clear status markers:

• Stage 3: COMPLETED (12 components identified)

• Stage 4: FAILED — [reason]. Stages 5–7 ran with reduced context.

• NEVER discard completed stage outputs due to a later stage failure.

Supported Flags

Read ../../shared/schemas/flags.md for the full flag specification. This dispatcher supports all cross-cutting flags.

Flag Dispatcher-Specific Behavior

--scope

Propagated to all stages. Default changed . Stages 2-3 may expand scope to trace architecture.

--depth

Propagated to all stages. Default standard .

--severity

Applied to final Stage 7 output to filter the risk-ranked findings.

--format

Applied to final consolidated output after Stage 7.

--only 1,4,7

Run only the listed stages (by number 1-7). Prior stages still run if their output is needed. E.g., --only 5 implicitly runs 1-4 first.

--fix

Propagated to Stage 5 (vulnerability analysis) and Stage 7 (risk mitigation).

--quiet

Propagated to all stages; suppress explanations.

--explain

Propagated to all stages; add learning material per finding.

Framework Reference

Read ../../shared/frameworks/pasta.md for the full PASTA framework specification including all 7 stage definitions, cross-framework mappings to OWASP/STRIDE/CWE, and compliance mapping templates.

Stage Pipeline

The 7 stages execute strictly in order. Each stage is launched as a single Task tool call, and you MUST wait for it to complete before launching the next stage.

Stage Skill Output Feeds Into

1. Business Objectives skills/pasta-objectives/SKILL.md

Business context, risk tolerance, compliance requirements Stage 2

2. Technical Scope skills/pasta-scope/SKILL.md

Attack surface inventory, entry points, tech stack, DFD Stage 3

3. Application Decomposition skills/pasta-decompose/SKILL.md

Component inventory, trust boundaries, role-permission matrix Stage 4

4. Threat Analysis skills/pasta-threats/SKILL.md

Threat catalog, MITRE ATT&CK mappings, attack trees Stage 5

5. Vulnerability Analysis skills/pasta-vulns/SKILL.md

Vulnerability inventory with CWE mappings, exploitability scores Stage 6

6. Attack Simulation skills/pasta-attack-sim/SKILL.md

Exploit chains, DREAD scores, detection gap analysis Stage 7

7. Risk & Impact Analysis skills/pasta-risk/SKILL.md

Risk-ranked findings, mitigation roadmap, executive summary Final output

Sequential Dispatch Workflow

Step 1: Resolve Scope

Parse flags and resolve the target file list per the flags spec. Build the initial file list that will be passed to Stage 1.

Step 2: Execute Stages Sequentially

For EACH stage (1 through 7), follow this pattern:

• Build the subagent prompt with all prior stage outputs embedded.

• Launch a single Task tool call for this stage.

• Wait for the Task to complete and capture its full output.

• Store the output for inclusion in subsequent stage prompts.

• Proceed to the next stage.

Do NOT launch the next stage until the current stage has returned.

Subagent Prompt Template

Each stage gets a FULLY self-contained prompt including all prior outputs:

Execute PASTA Stage {N}: {STAGE_NAME}

STEP 1: Read the skill definition at: {ABSOLUTE_PATH_TO_PLUGIN}/skills/{SKILL_NAME}/SKILL.md

STEP 2: Read the PASTA framework reference at: {ABSOLUTE_PATH_TO_PLUGIN}/shared/frameworks/pasta.md Focus on the "Stage {N}" section for guidance.

STEP 3: Read the findings schema at: {ABSOLUTE_PATH_TO_PLUGIN}/shared/schemas/findings.md

PRIOR STAGE OUTPUTS (use these as input for your analysis): --- Stage 1 Output --- {STAGE_1_OUTPUT or "N/A - this is Stage 1"} --- Stage 2 Output --- {STAGE_2_OUTPUT or "Not yet executed"} [... include all prior stage outputs ...]

FILES TO ANALYZE: {FILE_LIST}

FLAGS: --scope {SCOPE} --depth {DEPTH} --severity {SEVERITY}

IMPORTANT: Your output will be passed to Stage {N+1} as input. Structure your output clearly with headers and sections so the next stage can parse it. Return your stage-specific output only -- do NOT attempt to execute later stages.

Stage Execution Details

Stage 1 -- Business Objectives: Receives only the file list. Infers business context from code artifacts (payment processing, PII handling, authentication flows, admin interfaces). Outputs business context statement, risk tolerance, and compliance requirements.

Stage 2 -- Technical Scope: Receives Stage 1 output plus file list. Maps entry points, protocols, external dependencies, and tech stack. May request expanded file scanning to find architecture artifacts (Dockerfiles, K8s manifests, API gateway configs).

Stage 3 -- Application Decomposition: Receives Stages 1-2 output. Decomposes into components, maps trust boundaries, classifies data sensitivity, documents auth/authz flows per component.

Stage 4 -- Threat Analysis: Receives Stages 1-3 output. Identifies threats using real-world intelligence, maps to MITRE ATT&CK techniques, builds attack trees for high-value targets identified in Stage 1.

Stage 5 -- Vulnerability Analysis: Receives Stages 1-4 output. Core code analysis stage. Finds specific weaknesses that enable the threats from Stage 4. Maps to CWE identifiers. Prioritizes vulnerabilities that directly enable identified threats over theoretical weaknesses.

Stage 6 -- Attack Simulation: Receives Stages 1-5 output. Constructs multi-step exploit chains combining threats (Stage 4) with vulnerabilities (Stage 5). Scores each chain with DREAD. Identifies which attacks reach business-critical assets from Stage 1.

Stage 7 -- Risk & Impact Analysis: Receives Stages 1-6 output. Calculates business-weighted risk scores (Likelihood x Business Impact). Produces risk-ranked finding list, mitigation roadmap (quick wins / short term / long term), compliance gap report, and executive summary.

Consolidation

After Stage 7 completes, the dispatcher:

1. Collect All Findings

Gather the final risk-ranked finding list from Stage 7 output. Stage 7 already incorporates context from all prior stages.

2. Format Output

Apply the --format flag to produce the final output. The Stage 7 output should already contain:

• Executive summary (non-technical stakeholder audience)

• Risk-ranked finding list with business impact justification

• Mitigation roadmap with effort estimates

• Compliance gap report (if regulatory requirements identified in Stage 1)

• Residual risk assessment

3. Apply Severity Filter

If --severity is set, filter the finding list to show only findings at or above the specified severity threshold.

4. Cross-Reference

Populate cross-framework references on all findings:

• references.owasp : Map to OWASP Top 10 category.

• references.stride : Map to STRIDE category letter(s).

• references.mitre_attck : Already populated by Stage 4.

• references.cwe : Already populated by Stage 5.

5. Present Results

Output the final PASTA report. Include the stage progression summary showing how business objectives flowed through to risk-ranked mitigations.

Expert Mode

If --depth expert is set, after Stage 7 completes, launch red team subagents with the full PASTA output. Red team agents receive the exploit chains from Stage 6 and attempt to extend them, finding additional attack paths or chaining multiple exploit chains together.

Red team findings are appended to the final output with prefix RT and metadata.tool set to "red-team" .