Add tm7-threat-model skill for valid TM7 file generation by prasadgd9022 · Pull Request #2280 · github/awesome-copilot

prasadgd9022 · 2026-07-12T17:44:24Z

Description

Adds a new tm7-threat-model skill that generates valid Microsoft Threat Modeling Tool (.tm7) files.

.tm7 files use the WCF DataContractSerializer format (not generic XML); the Threat Modeling Tool refuses to open files that use a plain-XML structure. This skill documents the exact root element, namespace prefixes, stencil/data-flow/threat serialization, and a checklist of common mistakes that corrupt .tm7 files. It bundles a validated example-minimal.tm7 reference (well-formed, no <?xml?> declaration).

This is a clean re-submission of #1660 (which was closed only because it targeted main and had a polluted, auto-regenerated diff). This PR targets staged and changes only the new skill folder plus its single generated row in docs/README.skills.md.

Type of Contribution

New skill file.

Additional Notes

npm run skill:validate → ✅ tm7-threat-model is valid.
npm run build regenerated docs/README.skills.md (single added row).
Targeting the staged branch as required.

Adds a skill that generates valid Microsoft Threat Modeling Tool (.tm7) files using the correct WCF DataContractSerializer format, with a minimal reference file. Includes STRIDE threat generation workflow and a checklist of common serialization mistakes that corrupt .tm7 files. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Copilot

Pull request overview

Adds a skill for generating Microsoft Threat Modeling Tool .tm7 files.

Changes:

Documents TM7 serialization and STRIDE modeling.
Adds a bundled TM7 reference model.
Registers the skill in generated documentation.

Reviewed changes

Copilot reviewed 2 out of 3 changed files in this pull request and generated 4 comments.

File	Description
`skills/tm7-threat-model/SKILL.md`	Defines generation instructions and serialization examples.
`skills/tm7-threat-model/example-minimal.tm7`	Provides the reference TM7 model.
`docs/README.skills.md`	Adds the skill catalog entry.

prasadgd9022 · 2026-07-13T13:08:41Z

+Threats go in `<ThreatInstances>` using `<KeyValueOfstringThreatpc_P0_PhBB>`:
+
+```xml
+<ThreatInstances>
+  <KeyValueOfstringThreatpc_P0_PhBB xmlns:a="...Arrays">


prasadgd9022 · 2026-07-13T13:08:54Z

+- Custom elements such as `<MetaInformation>`, `<SecurityGaps>`, `<Mitigations>`,
+  `<Assumptions>` — they do not exist in the TM7 schema.


prasadgd9022 · 2026-07-13T13:09:02Z

aaronpowell

Minor change to match required structure

aaronpowell · 2026-07-12T23:58:45Z

Per the spec, this file should be in the assets folder

@aaronpowell , moved the file to assets folder

…to assets - Move example-minimal.tm7 into assets/ per repo convention (aaronpowell). - Remove personal/corporate metadata from the reference model (Owner, Contributors, ChangedBy domain account, project names). - Make the reference model self-contained: add a second stencil so the data flow and threat SourceGuid/TargetGuid/FlowGuid all resolve to real elements. - Fix SKILL.md threat contract (KeyValueOfstringThreatpc_P0_PhOB with b:-prefixed KnowledgeBase fields) to match the bundled reference. - Reconcile guidance: MetaInformation/Notes/KnowledgeBase are valid schema elements and must be preserved; only SecurityGaps/Mitigations are invalid. - Regenerate docs/README.skills.md and normalize line endings to LF. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

prasadgd9022 · 2026-07-13T13:06:34Z

Thanks for the review! Pushed 7a93150 addressing all comments:

@aaronpowell — Moved the reference model to skills/tm7-threat-model/assets/example-minimal.tm7 per the spec, and re-ran npm run build so the catalog entry points at the new path.

Copilot review comments:

Threat contract mismatch (PhBB vs PhOB). Rewrote the Threat instances section to the exact contract the bundled file uses: a:KeyValueOfstringThreatpc_P0_PhOB with b:-prefixed KnowledgeBase fields and the TH<id>+Source+Flow+Target key format.
MetaInformation contradiction. Reconciled the guidance: MetaInformation, Notes and KnowledgeBase are valid schema elements and must be preserved; only SecurityGaps/Mitigations are non-schema. Updated the "NEVER use" list, the file-structure section, and the common-mistakes list to match the asset.
PII / source-model metadata. Sanitized the reference: removed owner/contributor names, the FAREAST\... domain account in ChangedBy, and project names — all replaced with synthetic/empty values.
Dangling diagram/threat references. Made the model self-contained — added a second stencil (cloned from the validated one) so the data flow and the threat's SourceGuid/TargetGuid/FlowGuid now all resolve to included elements. Verified the file is well-formed XML and every reference resolves.

Also normalized line endings to LF. npm run skill:validate → ✅ tm7-threat-model is valid.

Copilot

Pull request overview

Copilot reviewed 2 out of 3 changed files in this pull request and generated 6 comments.

+A full tool export contains, in this order: `DrawingSurfaceList`, `MetaInformation`, `Notes`,
+`ThreatInstances`, then `ThreatMetaData` (which embeds the large generic `KnowledgeBase`).


+  <ThreatMetaData>
+    <!-- Threat category/property metadata + the embedded generic KnowledgeBase -->
+  </ThreatMetaData>


+| `SE.P.TMCore.AzureEventHub` | Azure Event Hub |
+| `SE.P.TMCore.DynamicsCRM` | Dynamics CRM |
+| `SE.DS.TMCore.SQL` | SQL Database |
+| `SE.DS.TMCore.AzureCosmosDB` | Azure Cosmos DB |


+| `SE.DS.TMCore.SQL` | SQL Database |
+| `SE.DS.TMCore.AzureCosmosDB` | Azure Cosmos DB |
+| `SE.EI.TMCore.Browser` | Browser |
+| `SE.EI.TMCore.HumanUser` | Human User |


+    <GenericTypeId xmlns="...Abstracts">GE.DF</GenericTypeId>
+    <Guid xmlns="...Abstracts">{line-guid}</Guid>
+    <Properties xmlns="...Abstracts">...</Properties>
+    <TypeId xmlns="...Abstracts">SE.DF.TMCore.GenericDataFlow</TypeId>


+6. **Dangling references** — a `Line`, threat `SourceGuid`/`TargetGuid`, or threat `FlowGuid`
+   that points to a stencil/flow GUID that isn't actually defined in `<Borders>`/`<Lines>`.
+   Every reference must resolve to an included element.
+7. **Missing `z:Id` reference attributes** on serialized objects.


…:Id uniqueness - Document KnowledgeBase as a top-level sibling after ThreatMetaData (not embedded) - Update skeleton to show <ThreatMetaData/>, sibling <KnowledgeBase>, and <Profile> - Replace TypeIds absent from the bundled KB: AzureCosmosDB -> AzureSQLDB, HumanUser -> Mobile, GenericDataFlow -> Request - Require z:Id uniqueness across the file in the common-mistakes checklist Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

prasadgd9022 · 2026-07-13T15:03:20Z

@reply.txt

Copilot AI review requested due to automatic review settings July 12, 2026 17:44

prasadgd9022 requested a review from aaronpowell as a code owner July 12, 2026 17:44

github-actions Bot added new-submission PR adds at least one new contribution skills PR touches skills labels Jul 12, 2026

Copilot started reviewing on behalf of prasadgd9022 July 12, 2026 17:44 View session

Copilot AI reviewed Jul 12, 2026

View reviewed changes

aaronpowell reviewed Jul 13, 2026

View reviewed changes

prasadgd9022 requested review from aaronpowell and Copilot July 13, 2026 14:48

Copilot started reviewing on behalf of prasadgd9022 July 13, 2026 14:49 View session

Copilot AI reviewed Jul 13, 2026

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Add tm7-threat-model skill for valid TM7 file generation#2280

Add tm7-threat-model skill for valid TM7 file generation#2280
prasadgd9022 wants to merge 3 commits into
github:stagedfrom
prasadgd9022:add-tm7-threat-model-skill

prasadgd9022 commented Jul 12, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

prasadgd9022 Jul 13, 2026

Uh oh!

prasadgd9022 Jul 13, 2026

Uh oh!

prasadgd9022 Jul 13, 2026

Uh oh!

aaronpowell left a comment

Uh oh!

aaronpowell Jul 12, 2026

Uh oh!

prasadgd9022 Jul 13, 2026

Uh oh!

prasadgd9022 commented Jul 13, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

prasadgd9022 commented Jul 13, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

		- Custom elements such as `<MetaInformation>`, `<SecurityGaps>`, `<Mitigations>`,
		`<Assumptions>` — they do not exist in the TM7 schema.

		A full tool export contains, in this order: `DrawingSurfaceList`, `MetaInformation`, `Notes`,
		`ThreatInstances`, then `ThreatMetaData` (which embeds the large generic `KnowledgeBase`).

Uh oh!

Conversation

prasadgd9022 commented Jul 12, 2026

Description

Type of Contribution

Additional Notes

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

prasadgd9022 Jul 13, 2026

Choose a reason for hiding this comment

Uh oh!

prasadgd9022 Jul 13, 2026

Choose a reason for hiding this comment

Uh oh!

prasadgd9022 Jul 13, 2026

Choose a reason for hiding this comment

Uh oh!

aaronpowell left a comment

Choose a reason for hiding this comment

Uh oh!

aaronpowell Jul 12, 2026

Choose a reason for hiding this comment

Uh oh!

prasadgd9022 Jul 13, 2026

Choose a reason for hiding this comment

Uh oh!

prasadgd9022 commented Jul 13, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

prasadgd9022 commented Jul 13, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants