Where is the threat model data stored?

All generated threat model data, including configurations, state files, and reports, are stored locally in a hidden .threatmodel directory within your project repository.

What types of documentation can the skill analyze?

It can parse Markdown files, READMEs, OpenAPI/Swagger specs, Mermaid diagrams, Dockerfiles, Terraform scripts, and Kubernetes configurations to build a system map.

Can I use this skill on an existing project without security docs?

Yes. While documentation helps, the skill can extract significant architectural insights directly from your infrastructure-as-code files and API specifications.

Which threat modeling frameworks does tm-init support?

The skill currently supports both the STRIDE and PASTA frameworks, allowing you to choose the methodology that best fits your security requirements.

Does this skill provide visualization for the threat model?

Yes, it automatically generates Mermaid.js code for architecture, data flow, and trust boundary diagrams that can be rendered in most Markdown viewers.

Threat Model Initializer

Name: Threat Model Initializer
Author: josemlopez

byjosemlopez

0•

Seguridad y Pruebas

Automates the creation of comprehensive threat models by analyzing architecture documentation and system components.

Threat Model Initializer is a specialized security skill designed to jumpstart the threat modeling process for any software project. By intelligently parsing architectural documentation, API specifications, infrastructure code, and diagrams, it automatically generates a structured threat model environment that catalogs assets, maps data flows, and identifies critical trust boundaries. It establishes a standardized project structure compatible with the STRIDE and PASTA frameworks, producing both machine-readable JSON state files and human-readable Mermaid.js visualizations to give developers a clear overview of their system's security posture from day one.

Características Principales

01Automated discovery of system assets, data stores, and external integrations

02Generation of Mermaid.js architecture and data flow diagrams

03Support for STRIDE and PASTA security frameworks

04Comprehensive JSON output for asset tracking and attack surface mapping

05Mapping of data flows and identification of trust boundary crossings

060 GitHub stars

Casos de Uso

01Establishing a security baseline for new microservices or applications

02Automating security assessments during architectural review phases

03Maintaining an up-to-date inventory of system entry points and attack surfaces

What are Skills?·How to Install

Install with 🐟 Skill.Fish

npx skillfish add josemlopez/threat-modeling-toolkit tm-init

For use in Claude.ai and ChatGPT

Download Skill