davidmatousekCommunity·25 Agent Skills Included

tachi

Architecture threat modeling and logic-level vulnerability detection

Scans your system architecture description to find logic-level security flaws like broken auth flows, prompt injection paths, and agent autonomy gaps that traditional code scanners miss. Covers 50/50 OWASP threats across five frameworks and maps findings to MITRE ATT&CK, ATLAS, and NIST AI RMF. Produces risk scores, attack trees, SARIF files for CI/CD, and a professional PDF security report from one command.

86|21

↗

npx skills add davidmatousek/tachi --all -g -y

Available:

Gives the agent the project's core constraints, git workflow rules, command routing for the AOD lifecycle, and strict limits on how subagents report results back.

All Skills in This Repository (25)

Pure Emerald Level Indicators

📦 In Repo

davidmatousek

tachi-risk-scoring

Convert qualitative threat findings into four-dimensional risk scores with governance fields.

~aod-blueprint

Bootstrap projects and generate GitHub issues via YAML-driven workflows.

~aod-define

Generate comprehensive PRDs with governance-driven frameworks and structured sections.

~aod-run

Orchestrate the full AOD lifecycle with governance gates and state persistence.

tachi-shared

Load canonical threat modeling references via the Read tool.

aod-lens

Routes problems to one of 14 thinking lenses for guided analysis.

aod-stack

Activate, deactivate, list, and scaffold AI stack packs from STACK.md contracts.

security

Run automated SAST and SCA scans on changed code and dependencies.

tachi-orchestration

Load on-demand domain references for tachi orchestrator pipeline phases.

tachi-report-assembly

Assemble Typst security report data from threat artifacts and brand assets.

aod-orchestrate

Translate /aod.blueprint into priority-ordered waves of tasks and batches.

~aod-plan

Automate Plan-stage governance across spec.md, plan.md, and tasks.md with gate-based approvals.

Community

Advanced

Frequently Asked Questions

FAQPage Schema

How to install tachi?▼

Run `npx skills add davidmatousek/tachi --all -g -y` in your terminal to install all skills globally. You also need the typst and mermaid-cli packages for PDF reports and attack tree diagrams.

What does tachi detect that SAST tools miss?▼

It reasons over your architecture description to catch logic-level flaws like broken authentication flows, missing privilege boundaries, and prompt injection paths, rather than just syntax-level bugs.

How do I run my first threat model?▼

Create a docs/security/architecture.md file describing your system (Mermaid, ASCII, PlantUML, C4, or free text), then run the /tachi.threat-model command. It dispatches 14 specialized analyzers and writes all results to a timestamped folder.

Does tachi work with CI/CD pipelines?▼

Yes. It generates SARIF 2.1.0 output that imports directly into GitHub Code Scanning and other security dashboards, plus baseline delta tracking to compare findings across runs.

Can non-security engineers use tachi?▼

Yes. You describe your architecture in plain text or a diagram, and the commands handle threat analysis, risk scoring, and report generation automatically.