tm-full

Orchestrate the complete threat modeling workflow from initialization through reporting.

8|1|Updated Jan 20, 2026

Search Tags:#documentation #compliance #threat-modeling #workflow-orchestration #security-automation #risk-analysis

Ready to run

npx skills add https://github.com/josemlopez/threat-modeling-toolkit --skill tm-full

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: tm-full
Source: https://github.com/josemlopez/threat-modeling-toolkit/tree/main/skills/tm-full
Command: npx skills add https://github.com/josemlopez/threat-modeling-toolkit --skill tm-full

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This skill automates the complete threat modeling workflow from initialization through reporting, consolidating multiple steps into a single, repeatable process.

Core Features & Use Cases

Orchestrates tm-init, tm-threats, tm-verify, tm-compliance, and tm-report to produce a comprehensive threat model.
Supports configurable inputs such as --docs, --framework, --compliance, --output, and --report-level for flexible deployments.
Ideal for teams needing end-to-end security assessment, risk documentation, and framework mapping across architecture artifacts.

Quick Start

Run the full threat modeling workflow with a sample architecture: /tm-full --docs ./docs --framework stride --compliance owasp,soc2 --output .threatmodel --report-level standard

Frequently Asked Questions about tm-full

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I automate end-to-end threat modeling and compliance mapping in one step?▼

End-to-end threat modeling is automated by orchestrating initialization, threat identification, verification, compliance mapping, and reporting into a single configurable command. This workflow processes architecture documents to produce comprehensive risk analysis and security documentation.

What is included in a full threat modeling workflow for software architecture?▼

A full threat modeling workflow includes initializing the threat model, identifying threats, verifying security posture, mapping compliance controls, and generating a final report. This process yields comprehensive risk documentation and framework mapping across architecture artifacts.

Can I map multiple compliance frameworks like OWASP and SOC2 during security automation?▼

Yes, multiple compliance frameworks like OWASP and SOC2 can be mapped simultaneously during security automation. The workflow accepts configurable compliance parameters alongside threat modeling frameworks like STRIDE to generate tailored security assessment documentation.

How do I run a complete security assessment with configurable reporting levels?▼

A complete security assessment is run using a single command that accepts architecture documents, a threat modeling framework, and a specified report level. This orchestrates the entire risk analysis process and outputs the results to a designated threat model directory.

Does automated threat generation work without external dependencies or components?▼

Automated threat generation works without external dependencies or components, operating independently to orchestrate the full security assessment workflow. It directly processes your input architecture documentation to produce the required compliance and threat reports.

When should I use a single command for risk analysis instead of individual threat modeling steps?▼

A single command for risk analysis should be used when teams need repeatable, end-to-end security assessments across architecture artifacts. It consolidates initialization, verification, and reporting into one process, replacing manual execution of individual threat modeling steps.