Add threat-model-analyst skill: STRIDE-A threat modeling for repositories by cheguv · Pull Request #1177 · github/awesome-copilot

cheguv · 2026-03-26T09:45:52Z

Description

Adds a comprehensive threat-model-analyst Agent Skill that performs security audits using STRIDE-A (STRIDE + Abuse) threat modeling, Zero Trust principles, and defense-in-depth analysis.

Details on the skill usage : https:/aka.ms/threatmodelanalystvideo

Supported Modes

Single analysis — Full STRIDE-A threat model of a repository, producing architecture overviews, DFD diagrams, STRIDE-A analysis, prioritized findings, and executive assessments.
Incremental analysis — Security posture diff between a baseline report and current code, producing a standalone report with embedded comparison (supersedes the old compare mode).

Bundled Reference Assets (17 files)

Asset	Purpose
\orchestrator.md\	Complete 10-step single-analysis workflow with 34 mandatory rules
\incremental-orchestrator.md\	Incremental/comparison workflow inheriting baseline reports
\analysis-principles.md\	Core analysis methodology and STRIDE-A definitions
\verification-checklist.md\	Quality gates and verification process
\output-formats.md\	Output format specifications
\diagram-conventions.md\	DFD diagram conventions using Mermaid
\tmt-element-taxonomy.md\	Microsoft Threat Modeling Tool element taxonomy
\skeleton-architecture.md\	Architecture overview section template
\skeleton-assessment.md\	Executive assessment section template
\skeleton-dfd.md\	Data flow diagram section template
\skeleton-findings.md\	Prioritized findings section template
\skeleton-incremental-html.md\	Incremental comparison HTML report template
\skeleton-inventory.md\	Threat inventory section template
\skeleton-stride-analysis.md\	STRIDE-A analysis section template
\skeleton-summary-dfd.md\	Summary DFD section template
\skeleton-threatmodel.md\	Main threat model report template

Checklist

SKILL.md has valid frontmatter (name, description)
Skill passes npm run skill:validate
All bundled assets under 5MB (largest: 69.8 KB)
LF line endings on all files
Branch based off staged
"npm run build" ran successfully
"docs/README.skills.md" updated with new skill entry
File names follow lowercase-with-hyphens convention

Copilot

Pull request overview

Adds a new threat-model-analyst skill under skills/ that guides users through STRIDE-A threat modeling (single and incremental modes) using orchestrators, reference guidance, and fill-in report skeletons.

Changes:

Introduces the threat-model-analyst skill (SKILL.md) plus comprehensive reference docs (orchestrators, analysis principles, diagram conventions, output formats, TMT taxonomy).
Adds multiple skeleton templates for the generated report artifacts (architecture, DFDs, STRIDE analysis, findings, inventory JSON, incremental comparison HTML).
Registers the new skill in docs/README.skills.md.

Reviewed changes

Copilot reviewed 18 out of 18 changed files in this pull request and generated 8 comments.

Show a summary per file

File	Description
skills/threat-model-analyst/SKILL.md	Defines skill activation criteria and mode selection (single vs incremental/compare guidance).
skills/threat-model-analyst/references/orchestrator.md	Full single-run workflow + mandatory rules for report generation and verification.
skills/threat-model-analyst/references/incremental-orchestrator.md	Incremental workflow built around baseline `threat-inventory.json` + comparison outputs.
skills/threat-model-analyst/references/analysis-principles.md	Analysis methodology, verification requirements, tiering rules, and checklists.
skills/threat-model-analyst/references/diagram-conventions.md	Mermaid diagram standards (palette, boundaries, sidecars, syntax gates).
skills/threat-model-analyst/references/output-formats.md	Canonical templates and validation/self-check rules for all output artifacts.
skills/threat-model-analyst/references/tmt-element-taxonomy.md	Maps code patterns to Microsoft TMT element categories and detection guidance.
skills/threat-model-analyst/references/skeletons/skeleton-architecture.md	Fill-in template for `0.1-architecture.md`.
skills/threat-model-analyst/references/skeletons/skeleton-dfd.md	Fill-in template for `1.1-threatmodel.mmd`.
skills/threat-model-analyst/references/skeletons/skeleton-summary-dfd.md	Fill-in template for `1.2-threatmodel-summary.mmd`.
skills/threat-model-analyst/references/skeletons/skeleton-threatmodel.md	Fill-in template for `1-threatmodel.md`.
skills/threat-model-analyst/references/skeletons/skeleton-stride-analysis.md	Fill-in template for `2-stride-analysis.md`.
skills/threat-model-analyst/references/skeletons/skeleton-findings.md	Fill-in template for `3-findings.md`.
skills/threat-model-analyst/references/skeletons/skeleton-inventory.md	Fill-in template for `threat-inventory.json`.
skills/threat-model-analyst/references/skeletons/skeleton-incremental-html.md	Fill-in template for `incremental-comparison.html`.
skills/threat-model-analyst/references/skeletons/skeleton-assessment.md	Fill-in template for `0-assessment.md`.
docs/README.skills.md	Adds the skill to the docs index and enumerates reference assets.

aaronpowell · 2026-03-26T23:13:29Z

@cheguv there's a number of comments from Copilot, can you review to see if any are accurate and need actioning, or can be ignored, and close them all for merging

…ries Add a comprehensive threat model analysis skill that performs security audits using STRIDE-A (STRIDE + Abuse) threat modeling, Zero Trust principles, and defense-in-depth analysis. Supports two modes: - Single analysis: full STRIDE-A threat model producing architecture overviews, DFD diagrams, prioritized findings, and executive assessments - Incremental analysis: security posture diff between baseline report and current code, producing standalone reports with embedded comparison Includes bundled reference assets: - Orchestrator workflows (full and incremental) - Analysis principles and verification checklists - Output format specifications and skeleton templates - DFD diagram conventions and TMT element taxonomy

- Fix SKILL.md description: use single-quoted scalar, rename mode (2) to 'Incremental analysis' with accurate description - Replace 'Compare Mode (Deprecated)' sections with 'Comparing Commits or Reports' redirect (no deprecated language for first release) - Fix skeleton-findings.md: move Tier 1 table rows under header, add CONDITIONAL-EMPTY block after END-REPEAT (matching Tier 2/3 structure) - Fix skeleton-threatmodel.md and skeleton-architecture.md: use 4-backtick outer fences to avoid nested fence conflicts with inner mermaid fences - Fix skeleton-incremental-html.md: correct section count from 9 to 8 - Fix output-formats.md: change status 'open' to 'Open' in JSON example, move stride_category warning outside JSON fence as blockquote - Fix incremental-orchestrator.md: replace stale compare-output-formats.md reference with inline color conventions - Regenerate docs/README.skills.md with updated description

Copilot

Pull request overview

Copilot reviewed 18 out of 18 changed files in this pull request and generated 9 comments.

- Fix diagram-conventions.md: bidirectional flow notation now uses <--> matching orchestrator.md and DFD templates - Fix tmt-element-taxonomy.md: normalize SE.DF.SSH/LDAP/LDAPS to use SE.DF.TMCore.* prefix consistent with all other data flow IDs - Fix output-formats.md: correct TMT category example from SQLDatabase to SQL matching taxonomy, fix component type from 'datastore' to 'data_store' matching canonical enum, remove DaprSidecar from inbound_from per no-standalone-sidecar rule - Fix 5 skeleton files: clarify VERBATIM instruction to 'copy the template content below (excluding the outer code fence)' to prevent agents from wrapping output in markdown fences - Genericize product-specific names in examples: replace edgerag with myapp, BitNetManager with TaskProcessor, AzureLocalMCP with MyApp.Core, AzureLocalInfra with OnPremInfra, MilvusVectorDB with VectorDB

Copilot

Pull request overview

Copilot reviewed 18 out of 18 changed files in this pull request and generated 4 comments.

Copilot

Pull request overview

Copilot reviewed 18 out of 18 changed files in this pull request and generated 5 comments.

Copilot

Pull request overview

Copilot reviewed 18 out of 18 changed files in this pull request and generated 5 comments.

Copilot

Pull request overview

Copilot reviewed 18 out of 18 changed files in this pull request and generated 3 comments.

Copilot

Pull request overview

Copilot reviewed 18 out of 18 changed files in this pull request and generated 1 comment.

- Fix diagram-conventions.md: second bidirectional two-arrow pattern in Quick Reference section now uses <--> - Fix incremental-orchestrator.md: renumber HTML sections 5-9 to 4-8 matching skeleton-incremental-html.md 8-section structure - Fix output-formats.md: add incremental-comparison.html to File List as conditional output for incremental mode - Fix skeleton-inventory.md: add tmt_type, sidecars, and boundary_kind fields to match output-formats.md JSON schema example

Copilot

Pull request overview

Copilot reviewed 18 out of 18 changed files in this pull request and generated 4 comments.

cheguv · 2026-03-28T22:24:40Z

@cheguv there's a number of comments from Copilot, can you review to see if any are accurate and need actioning, or can be ignored, and close them all for merging

Hi @aaronpowell fixed the comments and did few more iterations.

I see many of these are good to have changes versus actually causing the problems.
I have reverified and we are good with current changes. We should be good to approve. Let me know if you have any questions.
We will be incorporating a few more new features into the same skill in future iterations. That gives us opportunity to fix any superficial ones that the copilot reviewer is tagging.

cheguv requested a review from aaronpowell as a code owner March 26, 2026 09:45

Copilot AI review requested due to automatic review settings March 26, 2026 09:45

Copilot started reviewing on behalf of cheguv March 26, 2026 09:46 View session

Copilot AI reviewed Mar 26, 2026

View reviewed changes

aaronpowell previously approved these changes Mar 26, 2026

View reviewed changes

cheguv added 2 commits March 27, 2026 14:26

cheguv dismissed aaronpowell’s stale review via 591a7c0 March 28, 2026 01:33

cheguv force-pushed the add-threat-model-analyst-skill branch from fea6cb2 to 591a7c0 Compare March 28, 2026 01:33

cheguv requested a review from Copilot March 28, 2026 17:23

Copilot started reviewing on behalf of cheguv March 28, 2026 17:24 View session