Add tm7-threat-model skill for valid TM7 file generation (#2280)

Browse Source

* Add tm7-threat-model skill for valid TM7 file generation

Adds a skill that generates valid Microsoft Threat Modeling Tool (.tm7)
files using the correct WCF DataContractSerializer format, with a minimal
reference file. Includes STRIDE threat generation workflow and a checklist
of common serialization mistakes that corrupt .tm7 files.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* Address PR review: sanitize reference model, fix dangling refs, move to assets

- Move example-minimal.tm7 into assets/ per repo convention (aaronpowell).
- Remove personal/corporate metadata from the reference model (Owner,
  Contributors, ChangedBy domain account, project names).
- Make the reference model self-contained: add a second stencil so the data
  flow and threat SourceGuid/TargetGuid/FlowGuid all resolve to real elements.
- Fix SKILL.md threat contract (KeyValueOfstringThreatpc_P0_PhOB with
  b:-prefixed KnowledgeBase fields) to match the bundled reference.
- Reconcile guidance: MetaInformation/Notes/KnowledgeBase are valid schema
  elements and must be preserved; only SecurityGaps/Mitigations are invalid.
- Regenerate docs/README.skills.md and normalize line endings to LF.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* Address 2nd review: correct KnowledgeBase placement, valid TypeIds, z:Id uniqueness

- Document KnowledgeBase as a top-level sibling after ThreatMetaData (not embedded)
- Update skeleton to show <ThreatMetaData/>, sibling <KnowledgeBase>, and <Profile>
- Replace TypeIds absent from the bundled KB: AzureCosmosDB -> AzureSQLDB,
  HumanUser -> Mobile, GenericDataFlow -> Request
- Require z:Id uniqueness across the file in the common-mistakes checklist

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* ci: exclude *.tm7 exports from codespell

MTM DataContract .tm7 exports embed base64 icon blobs whose substrings
(oT, bu, wth, mKe, ...) trigger codespell false positives. Skip *.tm7,
matching the existing convention for binary/asset files.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

---------

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Co-authored-by: prasad <prasaddharaskar@gmail.com>
Co-authored-by: Aaron Powell <me@aaron-powell.com>

...

This commit is contained in:

prasadgd9022

2026-07-15 04:42:29 +05:30

committed by GitHub

parent e353a8cfb8

commit 36b30eb113

4 changed files with 319 additions and 1 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download Patch File Download Diff File Expand all files Collapse all files

skills/tm7-threat-model/assets/example-minimal.tm7

+4

File diff suppressed because one or more lines are too long