Where is the threat model data stored?

All generated threat model data, including configurations, state files, and reports, are stored locally in a hidden .threatmodel directory within your project repository.

What types of documentation can the skill analyze?

It can parse Markdown files, READMEs, OpenAPI/Swagger specs, Mermaid diagrams, Dockerfiles, Terraform scripts, and Kubernetes configurations to build a system map.

Can I use this skill on an existing project without security docs?

Yes. While documentation helps, the skill can extract significant architectural insights directly from your infrastructure-as-code files and API specifications.

Which threat modeling frameworks does tm-init support?

The skill currently supports both the STRIDE and PASTA frameworks, allowing you to choose the methodology that best fits your security requirements.

Does this skill provide visualization for the threat model?

Yes, it automatically generates Mermaid.js code for architecture, data flow, and trust boundary diagrams that can be rendered in most Markdown viewers.

Threat Model Initializer

Name: Threat Model Initializer
Author: josemlopez

byjosemlopez

보안 및 테스팅

Automates the creation of comprehensive threat models by analyzing architecture documentation and system components.

소개

Threat Model Initializer is a specialized security skill designed to jumpstart the threat modeling process for any software project. By intelligently parsing architectural documentation, API specifications, infrastructure code, and diagrams, it automatically generates a structured threat model environment that catalogs assets, maps data flows, and identifies critical trust boundaries. It establishes a standardized project structure compatible with the STRIDE and PASTA frameworks, producing both machine-readable JSON state files and human-readable Mermaid.js visualizations to give developers a clear overview of their system's security posture from day one.

주요 기능

Automated discovery of system assets, data stores, and external integrations
Generation of Mermaid.js architecture and data flow diagrams
Support for STRIDE and PASTA security frameworks
Comprehensive JSON output for asset tracking and attack surface mapping
Mapping of data flows and identification of trust boundary crossings
0 GitHub stars

사용 사례

Establishing a security baseline for new microservices or applications
Automating security assessments during architectural review phases
Maintaining an up-to-date inventory of system entry points and attack surfaces

소개

주요 기능

Automated discovery of system assets, data stores, and external integrations
Generation of Mermaid.js architecture and data flow diagrams
Support for STRIDE and PASTA security frameworks
Comprehensive JSON output for asset tracking and attack surface mapping
Mapping of data flows and identification of trust boundary crossings
0 GitHub stars

사용 사례

Establishing a security baseline for new microservices or applications
Automating security assessments during architectural review phases
Maintaining an up-to-date inventory of system entry points and attack surfaces