tm7-threat-model
Creates valid Microsoft Threat Modeling Tool (.tm7) files compatible with the Microsoft Threat Modeling Tool v7.3+. Use this skill whenever asked to create, generate, or modify a .tm7 threat model file, or when performing STRIDE threat modeling that should output a .tm7 file that opens cleanly in the Microsoft Threat Modeling Tool.
Profile →npx skills add github/awesome-copilot --skill tm7-threat-model --agent copilot
Same command for any agent — swap --agent for claude-code, codex, cursor.
Weekly change comes from our own snapshots, not the repository page — it measures attention, not adoption.
# Microsoft Threat Modeling Tool (.tm7) Generator You generate **valid `.tm7` files** for the Microsoft Threat Modeling Tool (v7.3+). A `.tm7` file is **not** generic XML — it is a **WCF `DataContractSerializer`** document with an exact namespace and element structure. If the structure is wrong, the tool refuses to open the file with: > "File is not an actual threat model or the threat model may be corrupted." Your job is to translate a described system (components, data stores, external actors, data flows, trust boundaries) into a diagram plus STRIDE threats, serialized in the exact `.tm7` format described below. ## Workflow When asked to produce a `.tm7` file: 1. **Model the system.** Identify the elements: - **Processes** (web apps, services, functions) → `StencilEllipse`, `GE.P` - **Data stores** (databases, caches, queues, blobs) → `StencilParallelLines`, `GE.DS` - **External interactors** (users, browsers, third-party systems) → `StencilRectangle`, `GE.EI` - **Trust boundaries** → `BorderBoundary`, `GE.TB` - **Data flows** connecting the above → `Connector`, `GE.DF` 2. **Assign a unique lowercase UUID** (e.g. `148ade68-5c80-40f3-8e1f-4e2cabdb5991`) to every stencil and every
- Workflow
- CRITICAL: Serialization format
- Required namespace prefixes
- File structure (correct order)
- Stencil elements
- Stencil shape types
- Common TypeId values (SDL TM knowledge base)
- Data flow lines
- Property attribute types
- Threat instances
- Common mistakes that break TM7 files
- Reference asset
What does the tm7-threat-model skill do?
Creates valid Microsoft Threat Modeling Tool (.tm7) files compatible with the Microsoft Threat Modeling Tool v7.3+. Use this skill whenever asked to create, generate, or modify a .tm7 threat model file, or when performing STRIDE threat modeling that should output a .tm7 file that opens cleanly in the Microsoft Threat Modeling Tool.
How do I install it?
Run `npx skills add github/awesome-copilot --skill tm7-threat-model --agent claude-code` — it drops the skill into your project so the agent can pick it up. Swap the --agent value for codex, cursor or copilot if you use one of those.
Where does this skill come from?
From github/awesome-copilot, a repository with 37,432 stars. We read it straight from the repository tree rather than a submitted listing, so what you see here is what is actually published.
Is a popular skill a good skill?
Not necessarily. Stars measure attention, not adoption — a repository can trend for a week and be abandoned. That is why we show the weekly change from our own snapshots next to the total, instead of a single flattering number.