Agent skill · security · aiskillstore
pytm
Python-based threat modeling using pytm library for programmatic STRIDE analysis, data flow diagram generation, and automated security threat identification. Use when: (1) Creating threat models programmatically using Python code, (2) Generating data flow diagrams (DFDs) with automatic STRIDE threat identification, (3) Integrating threat modeling into CI/CD pipelines and shift-left security practices, (4) Analyzing system architecture for security threats across trust boundaries, (5) Producing threat reports with STRIDE categories and mitigation recommendations, (6) Maintaining threat models as code for version control and automation.
Why this skill is useful
Adds executable scripts for automated threat modeling and security analysis that aren't commonly known or available.
What it needs
Requires graphviz, python, pytm installed locally. About 8k tokens when loaded. Last updated 2026-08-07. 405 stars on the source repository.
What this skill does
Threat Modeling with pytm Overview pytm is a Python library for programmatic threat modeling based on the STRIDE methodology. It enables security engineers to define system architecture as code, automatically generate data flow diagrams (DFDs), identify security threats across trust boundaries, and produce comprehensive threat reports. This approach integrates threat modeling into CI/CD pipelines, enabling shift-left security and continuous threat analysis. Quick Start Create a basic threat model: Install pytm: Core Workflows Workflow 1: Create New Threat Model Progress: [ ] 1. Define system scope and trust boundaries [ ] 2. Identify all actors (users, administrators, external systems) [ ] 3. Map system components (servers, databases, APIs, services) [ ] 4. Define data flows between components with security attributes [ ] 5. Run tm.process() to generate threats and DFD [ ] 6. Review STRIDE threats and add mitigations [ ] 7. Generate threat report with scripts/generatereport.py Work through each step systematically. Check off completed items. Workflow 2: STRIDE Threat Analysis pytm automatically identifies threats based on STRIDE categories: Spoofing: Identity impersonation attacks Tampering: Unauthorized modification of data Repudiation: Denial of actions without traceability Information Disclosure: Unauthorized access to sensitive data Denial of Service: Availability attacks Elevation of Privilege: Unauthorized access escalation For each identified threat: 1. Review threat description and affected component 2. Assess likelihood and impact (use references/riskmatrix.md) 3. Determine if existing controls mitigate the threat 4. Add mitigation using threat.mitigation = "description" 5. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills aiskillstore/pytm