Compare current threat models against a baseline and generate drift-report.md.
npx skills add https://github.com/josemlopez/threat-modeling-toolkit --skill tm-drift
Please help me install this Agent Skill. Skill: tm-drift Source: https://github.com/josemlopez/threat-modeling-toolkit/tree/main/skills/tm-drift Command: npx skills add https://github.com/josemlopez/threat-modeling-toolkit --skill tm-drift
Drift in threat models can obscure misconfigurations and new risks; tm-drift continuously compares current state to a baseline to surface changes.
Run the drift detection against the current threat model baseline, for example: /tm-drift --baseline .threatmodel/baseline/snapshot-20250120.json
High-intent search queries and answers about installing and using this skill.
Threat model drift detection compares current state against a baseline to surface changes in assets, data flows, attack surfaces, trust boundaries, and controls. It loads state from .threatmodel/state and generates a drift-report.md identifying additions, removals, and modifications.
Threat model drift occurs when changes to architecture or deployment obscure misconfigurations and new risks. During versioning and post-deployment reviews, comparing against a baseline file surfaces untracked modifications to attack surfaces and trust boundaries that require remediation.
Compare your current threat model against a baseline by specifying a snapshot file with the --baseline flag, or it defaults to the most recent baseline in .threatmodel/baseline. The process outputs a drift-report.md and suggests re-analysis actions for validated changes.
You can update a threat model baseline after validating changes. The drift detection process optionally updates the baseline file in .threatmodel/baseline, allowing you to establish a new reference point once new assets, data flows, and controls are reviewed and accepted.
A threat model drift report includes identified additions, removals, and modifications across assets, data flows, attack surfaces, trust boundaries, and controls. It also suggests specific remediation and re-analysis actions to address newly surfaced risks during post-deployment reviews.
No external dependencies are required to run threat model drift detection. The process loads current state from the .threatmodel/state directory and baseline files from .threatmodel/baseline, generating a markdown report and optionally updating the baseline without additional packages.
josemlopezAnalyze architecture documentation to generate asset inventories, data flows, trust boundaries, and attack surface mappings.
hohai99Update specifications with approved changes and log rationale.
dether-netPopulate security attributes, MITRE ATT&CK references, credentials, and monitoring tools in Dethernety threat models.
offers-pngIdentify and document security threats into a threat_model.md report.
