Generate code-grounded YAML threat models with lint-validated outputs.
npx skills add https://github.com/attasec/tmdd --skill tmdd-threat-modeling
Please help me install this Agent Skill. Skill: tmdd-threat-modeling Source: https://github.com/attasec/tmdd/tree/main/.cursor/skills/threat-model Command: npx skills add https://github.com/attasec/tmdd --skill tmdd-threat-modeling
Threat modeling often relies on generic templates. This skill grounds threat modeling in the actual codebase architecture, producing actionable YAML threat models that reflect real components, data flows, and technologies to guide secure development decisions.
Invoke the tmdd threat-modeling workflow to analyze your repository and generate a code-grounded threat model.
High-intent search queries and answers about installing and using this skill.
Yes, you can incrementally update existing threat models by applying the tmdd workflow during feature planning. It traces new data flows and components against the current architecture, appending validated threats and mitigations to the existing YAML artifacts.
Threat modeling with tmdd outputs machine-readable YAML artifacts stored under the .tmdd directory. These files contain mapped components, traced data flows, and generated threats with mitigations, using strict ID conventions and lint-validated outputs for reproducible security reviews.
Yes, YAML linting validates threat model artifacts to ensure strict ID conventions and reproducible security reviews. The tmdd commands integrate initialization, feature planning, and linting to enforce consistent, machine-readable outputs under the .tmdd directory.
Yes, you can use tmdd for reproducible security reviews across deployments. It integrates initialization, feature planning, and linting commands to generate consistent YAML threat models grounded in your codebase architecture, facilitating collaboration between developers and security analysts.
dakshrawat298-gifMap architecture, trust boundaries, data flows, and threat models into an Audit Context Document.
open-haxHalts task completion when lint or type errors are detected in codebase.
xotongSimulate DAST security testing via static codebase analysis without running the application.
hbvg234Identify and document security threats using STRIDE across system components.
