skills.rest
github
githubOFFICIAL
Explore all skills by this author →
WebsiteGitHub

tm7-threat-model

Generates valid Microsoft Threat Modeling Tool .tm7 files with STRIDE threats.

38.5k|4.9k|Updated Jun 11, 2025
Search Tags:#Security#Threat Modeling#datacontract#Stride#microsoft threat modeling tool#xml serialization#tm7
One-click install
npx skills add https://github.com/github/awesome-copilot --skill tm7-threat-model
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: tm7-threat-model
Source: https://github.com/github/awesome-copilot/tree/main/skills/tm7-threat-model
Command: npx skills add https://github.com/github/awesome-copilot --skill tm7-threat-model

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes assets (resource) components.

What problem does it solve?

Creating .tm7 files by hand is error-prone because the Microsoft Threat Modeling Tool uses a strict WCF DataContractSerializer XML format, and any structural mistake causes the tool to reject the file as corrupted. This Skill produces files that open cleanly in the tool v7.3+.

Core Features & Use Cases

  • Valid .tm7 Generation: Serializes threat models using the exact DataContract namespaces, wrapper elements, and element ordering the tool expects.
  • STRIDE Threat Modeling: Maps processes, data stores, external interactors, trust boundaries, and data flows to Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, and Elevation of Privilege threats.
  • Reference Integrity: Ensures every stencil, flow, and threat GUID resolves correctly and every z:Id is unique to avoid deserialization failures.
  • Use Case: Describe your system architecture (web app, SQL database, browser client) and receive a ready-to-open .tm7 file with a diagram and prioritized STRIDE threats.

Quick Start

Ask the assistant to create a .tm7 threat model for your system, listing its components, data stores, external users, and data flows.

Frequently Asked Questions about tm7-threat-model

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I create a .tm7 threat model file?▼

Describe your system's processes, data stores, external actors, trust boundaries, and data flows, and the Skill serializes them into the WCF DataContractSerializer XML format. The output opens directly in Microsoft Threat Modeling Tool v7.3+.

What is STRIDE threat modeling?▼

STRIDE is a threat classification framework covering Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, and Elevation of Privilege. The Skill generates threats in these categories for each interaction in your model.

Why does the Threat Modeling Tool say my file is corrupted?▼

The tool rejects files that include an XML declaration, use xmlns:xsi instead of DataContract namespaces, contain invented elements, or have dangling GUID references. The Skill avoids these mistakes by following the exact serialization structure.

Can I use custom stencil types in a .tm7 file?▼

Only stencil TypeId values present in the bundled KnowledgeBase are supported, such as SE.P.TMCore.WebApp or SE.DS.TMCore.SQL. The tool resolves every TypeId against this catalog, so unknown types will fail.

Does the .tm7 file support threat priorities and mitigation status?▼

Yes, each threat instance includes Priority (such as High), State (such as Mitigated), SDLPhase, and PossibleMitigations properties. These fields follow the ThreatModeling.KnowledgeBase namespace structure the tool emits.

Related Skills

Explore More Software Engineering Skills→
me2reshme2resh
489

dfd

Generate Data Flow Diagrams with trust boundaries and data classifications from codebases.

Community
Advanced
webrix-aiwebrix-ai
1

threat-model-generator

Generate STRIDE threat models with prioritized mitigations and Jira-ready tasks.

Official
Advanced
AgLyx3AgLyx3

senior-security

Identify and analyze security threats across system components with STRIDE and DREAD.

Community
Advanced
AgentSecOpsAgentSecOps
183

pytm

Generate STRIDE-based threat models and reports from Python code with pytm and Graphviz.

Official
Advanced