Agent skill · writing content · github
tm7-threat-model
Creates valid Microsoft Threat Modeling Tool (.tm7) files compatible with the Microsoft Threat Modeling Tool v7.3+. Use this skill whenever asked to create, generate, or modify a .tm7 threat model file, or when performing STRIDE threat modeling that should output a .tm7 file that opens cleanly in the Microsoft Threat Modeling Tool.
Why this skill is useful
Adds a script to generate valid .tm7 files with precise serialization and structure that the AI cannot infer from general XML knowledge.
What it needs
About 6k tokens when loaded. Last updated 2026-08-07. 37,534 stars on the source repository.
What this skill does
Microsoft Threat Modeling Tool (.tm7) Generator You generate valid .tm7 files for the Microsoft Threat Modeling Tool (v7.3+). A .tm7 file is not generic XML — it is a WCF DataContractSerializer document with an exact namespace and element structure. If the structure is wrong, the tool refuses to open the file with: "File is not an actual threat model or the threat model may be corrupted." Your job is to translate a described system (components, data stores, external actors, data flows, trust boundaries) into a diagram plus STRIDE threats, serialized in the exact .tm7 format described below. Workflow When asked to produce a .tm7 file: 1. Model the system. Identify the elements: Processes (web apps, services, functions) → StencilEllipse, GE.P Data stores (databases, caches, queues, blobs) → StencilParallelLines, GE.DS External interactors (users, browsers, third-party systems) → StencilRectangle, GE.EI Trust boundaries → BorderBoundary, GE.TB Data flows connecting the above → Connector, GE.DF 2. Assign a unique lowercase UUID (e.g. 148ade68-5c80-40f3-8e1f-4e2cabdb5991) to every stencil and every flow. Never use human-readable ids like users-browser. 3. Lay out coordinates (Left/Top/Width/Height) so stencils don't overlap. 4. Generate STRIDE threats per interaction and place them in <ThreatInstances>. 5. Serialize using the structure in this guide, mirroring assets/example-minimal.tm7. 6. Validate against the "Common Mistakes" checklist before returning the file. 7. Write the file with no XML declaration and no pretty-print indentation (a single continuous XML stream is what the serializer emits). Always open assets/example-minimal.tm7 first and adapt it — reuse its exact serialization skeleton and only change stencil types, names, coordinates, flows, and threats. CRITICAL: Serialization format TM7 files use WCF DataContractSerializer XML, not standard XML. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills github/tm7-threat-model