Security Planning

MicrosoftOfficialPublished by Microsoft

Skill
Tool integration
Security
MIT
Medium risk
Has scripts

From the author

Security planning and plan-drift analysis for STRIDE, standards, controls, backlog handoff, current findings, and TM7 generation.

— the description by Microsoft

AutoGineer summary

Written by AutoGineer from the skill’s own files, not by the author

Security Planning provides a structured framework for managing application security throughout the development lifecycle. It includes methodologies for STRIDE threat analysis, NIST control mapping, and data classification. The skill supports plan-drift analysis to correlate security baselines with current findings, and provides robust workflows for generating and validating Microsoft Threat Modeling Tool (TM7) files, including an optional Windows-native feedback loop for visual model validation.

What it does

Classifies application components into operational security buckets.
Performs STRIDE-based threat analysis with support for AI-specific extensions.
Maps security findings to industry standards and NIST control families.
Generates security-focused backlog items for implementation handoff.
Analyzes plan-drift by comparing security baselines against current repository findings.
Automates the generation of TM7 threat models and associated markdown reports.

When to use it

When performing initial security planning or threat modeling for an application.
When you need to reconcile an existing security plan with current audit or code review findings.
When preparing security-related work items for a development backlog.
When generating or updating TM7 threat model files for compliance or audit workflows.

Advantages

Provides a consistent, repeatable methodology for security planning and threat modeling.
Reduces manual effort in mapping security findings to regulatory standards.
Enables automated detection of drift between planned security controls and actual implementation.
Supports both portable markdown reporting and native integration with the Microsoft Threat Modeling Tool.

Usage examples

“Analyze my application components and generate a security backlog based on the current STRIDE findings.”: The agent will classify the components into operational buckets, perform a STRIDE analysis, and output a prioritized list of security work items formatted for your backlog.
“Compare my existing security baseline with these new code review findings to identify control drift.”: The agent will correlate the findings, filter out excluded paths, and produce a report detailing validated controls, residual risks, and any identified control drift.
“Generate a TM7 threat model file from my current YAML threat-model specification.”: The agent will process the specification and output a .tm7 file compatible with the Microsoft Threat Modeling Tool, along with a corresponding markdown report.

Install

Download the skill as a ZIP:
https://autogineer.com/agent-skills/microsoft/security-planning/download

Unzip it into the cross-client skills folder of your project:

mkdir -p .agents/skills && unzip security-planning.zip -d .agents/skills

Documentation by Microsoft

Security Planning

This skill packages durable security-planning and plan-drift analysis used by Security Planner, Security Reviewer, and Code Review: operational bucket guidance, STRIDE analysis patterns, standards cross-references, NIST control-family references, security-specific backlog formats, and correlation of a Security Planner baseline with current security findings.

When to use

Use this skill when you need to:

Classify application components into the operational security buckets used during planning.
Evaluate threats with STRIDE-based analysis, including AI-specific extensions when raiEnabled is true.
Map bucket findings to standards references and control families without re-embedding long standard tables.
Derive security-specific backlog priorities and RAI work item categories for Phase 5 handoff.
Correlate a Security Planner baseline with caller-supplied current findings to identify validated controls, control drift, residual planned risks, newly introduced threats, and obsolete plan items.
Generate a dual-output TM7 model plus markdown report from a YAML/JSON threat-model spec for human-reviewed audit workflows.

Security plan drift analysis

Use the drift capability when a Security Planner baseline and current-state security findings already exist. It correlates supplied evidence only: it does not scan, profile, select security skills, verify findings, re-rate severity, invoke another agent, or modify source, plan, reviewer, backlog, or state artifacts.

Resolve and extract the baseline through drift-input-contracts.md.
Normalize caller-supplied audit, diff, or Code Review findings without treating plan-mode evidence as repository state.
Filter default exclusions, then classify only conclusions supported by drift-comparison-model.md.
Render the direct, Security Reviewer, Security Planner, or Code Review adaptation from drift-report-contract.md.
Use drift-worked-examples.md for deterministic behavior scenarios and expected category suppression.

Before full conversational or durable drift output, display the Security Planning CAUTION block in this skill verbatim. Report the default exclusions below in the canonical body's Current repository evidence section. A bounded Code Review section may point to these blocks because its containing review already carries the Code-Review disclaimer.

Default exclusions in effect. Planning and agent-customization artifacts are excluded from drift findings:
Paths: .copilot-tracking/**, docs/planning/**, docs/adrs/**, .github/agents/**, .github/prompts/**, .github/instructions/**, .github/skills/**
File globs: *.prompt.md, *.agent.md, *.instructions.md, SKILL.md
To override, pass scope= explicitly. Overlapping user scope wins and is reported as a warning.

A write-capable direct caller may create one sequence-safe report under .copilot-tracking/security-audits/<project-slug>/. Security Reviewer and Security Planner render in conversation. Code Review renders a bounded section and optional security_plan_drift field. Every destination keeps inputs read-only and recommends follow-up without dispatch.

Stop the affected conclusion when a baseline is incomplete, a required fact is unresolved, evidence scope does not cover the claim, or input format drift prevents exclusions. Report suppressed categories as insufficient evidence rather than zero findings. Stop the entire correlation when no baseline resolves or no finding location is available to enforce exclusions.

TM7 generation workflow

When the user asks for a TM7 threat model, the runtime can generate a .tm7 file and a matching markdown report from the same spec. The generator supports the pre-populated-comprehensive and diagram-only-defer-to-tmt modes and can update an existing model with --update. Use the generate_tm7.py and generate_markdown.py entry points with --template to select a profile.

The .tm7 output mirrors the Microsoft Threat Modeling Tool's real SerializableModelData DataContract and deserializes cleanly under the tool's own DataContractSerializer. Fidelity is validated against the tool's own assemblies by scripts/Deserialize-Tm7.ps1, which the pytest suite runs when the tool is installed and skips cleanly otherwise. See references/tm7-generation.md for the verified contract.

Native TM7 visual feedback workflow

The skill also supports an opt-in, Windows-local feedback loop for the native Microsoft Threat Modeling Tool UI. The feature is off by default. The generator and standard validator keep their existing portable behavior when the feedback flags are absent. Native feedback is enabled only when validate_tm7_with_tmt.py is run with --feedback-loop, --spec, and --overlay-output; optional --overlay-input, --max-iterations, and --require-feedback-evidence refine the execution contract.

The workflow requires Microsoft Threat Modeling Tool 7.3.51110.1, a Windows desktop session, and UI Automation access. The loop is bounded to a baseline run plus at most three refinement iterations, and defaults to a baseline plus one. A single run holds the mouse and keyboard continuously across the baseline and every refinement iteration; control returns only at the release notice. Replaying a corrected overlay is a new run and a new takeover. Exit codes, stop reasons, and the discovery-failure rules are defined in the generation reference.

The harness controls TMT windows and may open, close, and reopen the app for save/reopen validation. It emits a start notice before automation begins, progress updates for the baseline and each refinement candidate, and a release notice when the loop completes or aborts so the operator knows when control is returned. These are notices only; the harness does not block on operator acknowledgment. The agent-facing lockout and release obligations that surround a run are owned by references/tm7-generation-workflow.md.

The loop records one evidence bundle per run under the requested evidence directory, with per-iteration screenshots, UI Automation snapshots, summaries, and candidate models. A run that captured at least one surface and either passed the automated gates or stopped for layout exhaustion also emits agent-review-request.json at the bundle root. The overlay payload remains in approval_state: pending, and no runtime path or flag auto-promotes it to approved or rewrites the canonical baseline.

Scoring keeps deterministic geometry gates separate from advisory screenshot heuristics. Screenshot heuristics are not a semantic approval signal.

A Windows-native example uses the skill's locked Windows dependency group:

uv run --project "<security-planning-skill-root>" --group windows \
  python "<security-planning-skill-root>/scripts/validate_tm7_with_tmt.py" model.tm7 \
  --evidence-dir ./artifacts/feedback \
  --feedback-loop \
  --spec ./specs/model.yaml \
  --overlay-output ./artifacts/feedback/overlay.json \
  --max-iterations 3 \
  --require-feedback-evidence

Resolve <security-planning-skill-root> from the loaded skill location before running the command.

The overlay contract is versioned and deterministic. It carries layout intent in named rule collections and is invalidated unless its full fingerprint block matches, so a stale overlay is rejected rather than replayed onto a changed model.

See references/tm7-generation.md for the full CLI surface, exit codes, stop reasons, geometry thresholds, the evidence-bundle layout, the overlay fingerprint contract, and the operator runbook covering prerequisites, abort, recovery, and rollback.

Agent-assisted visual review

Some layout defects never reach a metric. TM7 persists no connector label geometry and UI Automation exposes no label element, so label collisions, unreadable label text, and visual crowding are invisible to the deterministic gates. An agent that reads the rendered screenshots can see them and author corrections into the overlay the harness publishes.

This review is a default step of every feedback-loop run, not an opt-in extra. A run that captured at least one surface and either passed the automated gates or stopped for layout exhaustion emits agent-review-request.json at the evidence root, carrying per surface the screenshot and UI Automation paths, the node and zone rectangles, the connector handle points, and the predicted label rectangles in model coordinates, plus the coordinate-translation constants and the port convention. The agent reviews from that payload rather than hand-parsing UI Automation trees. automated-ready-pending-human means the automated gates passed and the result awaits review; it is not an approval. The remedy remains documented rather than proven: it has not yet been demonstrated end to end on a real defect.

On the success path the published overlay addresses every captured surface, so a correction can be authored for any of them. When the run found no automated correction, that overlay is the seed shape, carrying an overlay-seed- identifier and empty rule collections. A layout-exhaustion stop publishes the same seed shape; a correctness or environment stop publishes nothing at all.

See references/tm7-generation.md for the protocol, the request payload, the accepted rule fields, the coordinate translation, and the constraints that bound an agent-authored overlay.

[!CAUTION] Disclaimer: This agent is an assistive tool only. It does not provide legal, regulatory, or compliance advice and does not replace professional security review boards, penetration testing teams, compliance auditors, legal counsel, or other qualified human reviewers. The output consists of suggested actions and considerations to support a user's own internal security review and decision‑making. All security plans, threat models, security models, and mitigation recommendations generated by this tool must be independently reviewed and validated by appropriate security and compliance reviewers before use. Outputs from this tool do not constitute security approval, compliance certification, or regulatory sign‑off.

The human-in-the-loop contract governing authorship confirmation, native feedback-loop operator safety, and layout overlay promotion is owned by references/tm7-generation-workflow.md. This skill owns the mechanics only.

Skill layout

Load the reference file that matches the phase or topic you need.

Reference	Topic
references/00-index.md	Navigation catalog and consolidated attribution
references/operational-buckets.md	Operational bucket definitions, GS overlay, and classification guidance
references/stride-model.md	STRIDE methodology, AI extensions, risk matrix, and data-flow analysis
references/standards-cross-reference.md	Bucket-to-standards mapping table and component mapping output format
references/nist-control-families.md	NIST 800-53 priority tiers and NIST AI RMF subcategory mappings
references/backlog-formats.md	Security-specific prioritization and RAI work item categories
references/data-classification.md	Public-safe data-classification taxonomy, tiers/categories/retention, and schema mapping
references/threat-model-review.md	Threat-model completeness checklist, PASS/INCOMPLETE verdict, and gap list
references/drift-input-contracts.md	Security Planner baseline extraction, normalized current-finding forms, evidence scope, and drift handling
references/drift-comparison-model.md	Exclusions, evidence preconditions, five plan-drift categories, matching order, and recommendation-only handoffs
references/drift-report-contract.md	Canonical body and direct, Security Reviewer, Security Planner, and Code Review destination adaptations
references/drift-worked-examples.md	Synthetic complete, incomplete, malformed, diff-scoped, exclusion, and caller-regression behavior scenarios
references/tm7-generation-workflow.md	Human-in-the-loop contract for TM7 generation: authorship confirmation, native feedback-loop operator safety, and layout overlay promotion
references/tm7-generation.md	TM7 input schema, dual-output generation contract, profile mapping, emission contract, native feedback loop, overlay and fingerprint contract, and operator runbook

Bundled executable and data resources:

Resource	Use
`scripts/generate_tm7.py`	Run to build a `.tm7` from a threat-model spec
`scripts/generate_markdown.py`	Run to render the same spec as a markdown report
`scripts/generate_tb7.py`	Run to emit a template file
`scripts/validate_tm7_with_tmt.py`	Run for native Windows TMT validation and the opt-in feedback loop
`scripts/Deserialize-Tm7.ps1`	Run to check round-trip fidelity against the tool's own assemblies
`assets/schemas/tm7-layout-overlay.schema.json`	Read as the layout overlay schema
`assets/schemas/tm7-agent-review-request.schema.json`	Read as the agent visual-review request schema
`assets/schemas/tm7-visual-feedback-manifest.schema.json`	Read as the evidence manifest schema
`templates/threat-model-spec-example.yaml`	Copy as the starting point for a new spec

The skill ships public defaults for the taxonomy and the completeness checklist. Organization-specific internal details such as internal data-type taxonomies, internal auth service names, and internal review-gate steps are supplied through a private config overlay referenced by state.overlayConfigPath and are never embedded in the public skill.

Attribution

The durable reference content in this skill is organized by reference file and summarized in references/00-index.md. See that index for the consolidated attribution and delegation notes.

Files

ATTRIBUTION.mdAdded by AutoGineer847 B
LICENSELicence file added by AutoGineer1.1 KiB
README.md5.3 KiB
SECURITY.md24.9 KiB
SKILL.md16.9 KiB
assets/schemas/tm7-agent-review-request.schema.json4.6 KiB
assets/schemas/tm7-layout-overlay.schema.json6.8 KiB
assets/schemas/tm7-visual-feedback-manifest.schema.json8.3 KiB
assets/template-profiles/LICENSE-MIT-REFERENCE.txt366 B
assets/template-profiles/README.md795 B
assets/template-profiles/sdl_core_generic.yaml324 B
assets/templates/LICENSE1.1 KiB
assets/templates/default-kb.xml1.0 MiB
assets/templates/default.tb7375.2 KiB
pyproject.toml1.0 KiB
references/00-index.md6.7 KiB
references/backlog-formats.md2.0 KiB
references/data-classification.md5.3 KiB
references/drift-comparison-model.md8.0 KiB
references/drift-input-contracts.md7.0 KiB
references/drift-report-contract.md5.9 KiB
references/drift-worked-examples.md11.5 KiB
references/nist-control-families.md1.1 KiB
references/operational-buckets.md2.9 KiB
references/standards-cross-reference.md1.5 KiB
references/stride-model.md4.0 KiB
references/threat-model-review.md6.1 KiB
references/tm7-generation-workflow.md3.9 KiB
references/tm7-generation.md59.0 KiB
scripts/Deserialize-Tm7.ps1Script7.8 KiB
scripts/generate_markdown.pyScript8.0 KiB
scripts/generate_tb7.pyScript11.6 KiB
scripts/generate_tm7.pyScript256.5 KiB
scripts/populate_tm7_threats.pyScript24.9 KiB
scripts/tm7_threat_contract.pyScript38.3 KiB
scripts/tm7_visual_feedback.pyScript119.6 KiB
scripts/validate_gap_citations.pyScript2.5 KiB
scripts/validate_tm7_with_tmt.pyScript262.9 KiB
templates/threat-model-spec-example.yaml5.8 KiB
tests/corpus/minimal-spec.yaml111 B
tests/corpus/minimal-tm7.xml17 B
tests/fixtures/README.md3.2 KiB
tests/fixtures/comprehensive-spec.yaml78.5 KiB
tests/fixtures/expected.tm71.1 MiB
tests/fixtures/tmp-sample.tm71.1 MiB
tests/fixtures/tmt-reference-threats.tm71.3 MiB
tests/fixtures/tmt-reference.tm71.2 MiB
tests/fixtures/visual-feedback/valid-manifest.json921 B
tests/fixtures/visual-feedback/valid-overlay.yaml1.4 KiB
tests/fuzz_harness.pyScript3.0 KiB
tests/test_generate_tb7.pyScript11.9 KiB
tests/test_generate_tm7.pyScript189.8 KiB
tests/test_populate_tm7_threats.pyScript13.5 KiB
tests/test_tm7_threat_contract.pyScript36.4 KiB
tests/test_tm7_visual_feedback.pyScript59.5 KiB
tests/test_validate_tm7_with_tmt.pyScript208.7 KiB
uv.lock100.6 KiB

tests/fixtures/comprehensive-spec.yaml

# cspell:ignore azspeech customercards docproc exfiltrated fileperms ghapi ghmcp ghscan
# cspell:ignore interactor logsink misdrive mupdf noredirect pdfbounds reposcan retargets
# cspell:ignore securityplanning soffice tokencache videogif webscan
# HVE Core comprehensive threat-model spec
# Source of truth: docs/security/security-model.md (repo-wide STRIDE model)
# plus the per-skill SECURITY.md models (mural, jira, gitlab, tts-voiceover, and the
# skill security registry). This spec is consumed by the security-planning skill's
# generate_tm7.py / generate_markdown.py generators.
#
# DRAFT: Human review required before this or any generated .tm7 is treated as authored or final.

project_metadata:
  name: HVE Core (microsoft/hve-core)
  version: "1.0"
  summary: >-
    Enterprise prompt-engineering framework for GitHub Copilot (markdown artifacts,
    PowerShell/Python automation, GitHub Actions CI/CD, VS Code extension packaging)
    plus executable skill runtimes (Mural OAuth CLI + MCP server, Jira and GitLab REST
    CLIs, and the TTS voice-over Azure Speech CLI). Most of the repository has no runtime
    services and is targeted by supply-chain and developer-workflow threats; the skill
    runtimes add credential-handling and network-egress surfaces.
  scope: >-
    Repository contents and CI/CD pipeline, the developer workstation trust boundary,
    external dependency supply chain, the optional dev container, and the executable
    skill runtimes that hold credentials and egress to third-party SaaS.
  assumptions:
    - GitHub platform security is adequate (SOC 2 Type II certified).
    - GitHub Copilot provides baseline AI safety (Microsoft RAI compliance).
    - Contributors act in good faith; PR review provides verification.
    - Consumers implement their own code review of AI-assisted output.
  policy_values:
    cryptography_suites:
      - TLS 1.2+
      - TLS 1.3
    identity_providers:
      - GitHub OAuth / GitHub App tokens / PAT
      - Mural OAuth 2.0 Authorization Code + PKCE
      - Jira PAT (Bearer) / Jira Cloud Basic
      - GitLab PAT (PRIVATE-TOKEN)
      - Azure Entra (DefaultAzureCredential) / Azure Speech subscription key
    data_classification_labels:
      - public
      - internal
      - confidential

trust_zones:
  - id: tz-dev
    name: Developer Workstation
    description: Local IDE, scripts, skill runtimes, token caches, and optional dev container.
  - id: tz-repo
    name: Repository Contents
    description: Controlled artifacts (prompts, scripts, workflows, docs) under CODEOWNERS and branch protection.
  - id: tz-cicd
    name: CI/CD Pipeline
    description: GitHub Actions runners executing validation, scanning, and release automation.
  - id: tz-github
    name: GitHub Platform
    description: GitHub-hosted repository, LLM API service, and GitHub MCP server (network boundary).
  - id: tz-ext
    name: External Dependencies
    description: npm registry, GitHub Actions, PowerShell Gallery, and third-party MCP servers.
  - id: tz-saas
    name: External SaaS APIs
    description: Third-party authorization servers and APIs (Mural, Jira, GitLab, Azure Speech).

assets:
  - id: asset-artifacts
    name: Prompt engineering artifacts
    kind: data
    description: Instructions, prompts, agents, and skills consumed by Copilot.
    sensitivity: public
    category: Source
  - id: asset-cicd
    name: CI/CD pipeline integrity
    kind: process
    description: Workflow definitions, security scripts, and runner tokens.
    sensitivity: internal
    category: Pipeline
  - id: asset-secrets
    name: Repository secrets and workflow tokens
    kind: credential
    description: GITHUB_TOKEN, scan tokens, and any configured secrets.
    sensitivity: confidential
    category: Credential
  - id: asset-oauth-tokens
    name: Mural OAuth tokens and client secret
    kind: credential
    description: access_token, refresh_token, client_secret, code, and code_verifier.
    sensitivity: confidential
    category: Credential
  - id: asset-pats
    name: Jira and GitLab personal access tokens
    kind: credential
    description: Bearer / Basic / PRIVATE-TOKEN credentials read from the environment.
    sensitivity: confidential
    category: Credential
  - id: asset-speaker-notes
    name: Speaker-notes narration content
    kind: data
    description: content.yaml narration text egressed to Azure Speech for synthesis.
    sensitivity: confidential
    category: Content
  - id: asset-docproc
    name: Document-processing content and render outputs
    kind: data
    description: PowerPoint YAML, PPTX/PDF/SVG/PNG outputs, and local media conversion artifacts.
    sensitivity: internal
    category: Content
  - id: asset-code-scan
    name: GitHub code-scanning alerts and OpenVEX records
    kind: data
    description: Alert payloads, GitHub issue bodies, and local OpenVEX documents processed by the runtime skills.
    sensitivity: internal
    category: Content
  - id: asset-webscan
    name: Accessibility scan targets and normalized findings
    kind: data
    description: Operator-supplied URLs or files and the normalized accessibility findings emitted to the caller.
    sensitivity: internal
    category: Content
  - id: asset-planning
    name: Security planning artifacts and generated reports
    kind: data
    description: Threat-model specifications, TM7 payloads, markdown reports, and validation outputs.
    sensitivity: internal
    category: Source

components:
  # External interactors and platform services
  - id: ext-dev
    name: Developer
    kind: external_interactor
    trust_zone_id: tz-dev
  - id: ext-copilot
    name: GitHub Copilot
    kind: external_interactor
    trust_zone_id: tz-dev
  - id: ext-llm
    name: LLM API Service
    kind: external_interactor
    trust_zone_id: tz-github
  - id: ext-ghmcp
    name: GitHub MCP Server
    kind: external_interactor
    trust_zone_id: tz-github
  - id: ext-npm
    name: Package and Action Registries
    kind: external_interactor
    trust_zone_id: tz-ext
  - id: ext-mural-as
    name: Mural Authorization Server
    kind: external_interactor
    trust_zone_id: tz-saas
  - id: ext-mural-api
    name: Mural REST API
    kind: external_interactor
    trust_zone_id: tz-saas
  - id: ext-jira
    name: Jira Instance
    kind: external_interactor
    trust_zone_id: tz-saas
  - id: ext-gitlab
    name: GitLab Instance
    kind: external_interactor
    trust_zone_id: tz-saas
  - id: ext-azspeech
    name: Azure Speech Service
    kind: external_interactor
    trust_zone_id: tz-saas
  - id: ext-ghapi
    name: GitHub REST API
    kind: external_interactor
    trust_zone_id: tz-github
  - id: ext-ffmpeg
    name: FFmpeg / ffprobe
    kind: external_interactor
    trust_zone_id: tz-dev
  - id: ext-soffice
    name: LibreOffice / soffice
    kind: external_interactor
    trust_zone_id: tz-dev
  - id: ext-mupdf
    name: MuPDF / PyMuPDF
    kind: external_interactor
    trust_zone_id: tz-dev
  - id: ext-axe
    name: axe-core / Headless Browser
    kind: external_interactor
    trust_zone_id: tz-dev
  - id: ext-browser
    name: User Browser
    kind: external_interactor
    trust_zone_id: tz-dev
  - id: ext-scan-target
    name: Scan Target
    kind: external_interactor
    trust_zone_id: tz-ext
  # In-scope processes and stores
  - id: comp-artifacts
    name: HVE Core Artifacts
    kind: data_store
    asset_ids: [asset-artifacts]
    trust_zone_id: tz-repo
  - id: comp-scripts
    name: Local Automation Scripts
    kind: process
    trust_zone_id: tz-dev
  - id: comp-workflows
    name: GitHub Actions Workflows
    kind: process
    asset_ids: [asset-cicd]
    trust_zone_id: tz-cicd
  - id: comp-repo
    name: Repository
    kind: data_store
    asset_ids: [asset-artifacts]
    trust_zone_id: tz-github
  - id: comp-scanning
    name: Security Scanning (CodeQL, Dep Review, gitleaks)
    kind: process
    trust_zone_id: tz-cicd
  - id: comp-extension
    name: VS Code Extension
    kind: process
    trust_zone_id: tz-dev
  - id: comp-devcon
    name: Dev Container
    kind: process
    trust_zone_id: tz-dev
  - id: comp-mural
    name: Mural Skill Runtime (CLI + MCP + OAuth client)
    kind: process
    asset_ids: [asset-oauth-tokens]
    trust_zone_id: tz-dev
  - id: comp-loopback
    name: OAuth Loopback Handler
    kind: process
    trust_zone_id: tz-dev
  - id: comp-tokencache
    name: OAuth Token Cache File (mode 0600)
    kind: data_store
    asset_ids: [asset-oauth-tokens]
    trust_zone_id: tz-dev
  - id: comp-jira
    name: Jira Skill CLI
    kind: process
    asset_ids: [asset-pats]
    trust_zone_id: tz-dev
  - id: comp-gitlab
    name: GitLab Skill CLI
    kind: process
    asset_ids: [asset-pats]
    trust_zone_id: tz-dev
  - id: comp-tts
    name: TTS Voice-Over Skill CLI
    kind: process
    asset_ids: [asset-speaker-notes]
    trust_zone_id: tz-dev
  - id: comp-powerpoint
    name: PowerPoint Skill Runtime
    kind: process
    asset_ids: [asset-docproc]
    trust_zone_id: tz-dev
  - id: comp-videogif
    name: Video-to-GIF Skill Runtime
    kind: process
    asset_ids: [asset-docproc]
    trust_zone_id: tz-dev
  - id: comp-customercards
    name: Customer Card Render Skill Runtime
    kind: process
    asset_ids: [asset-docproc]
    trust_zone_id: tz-dev
  - id: comp-ghscan
    name: GitHub Code Scanning Skill CLI
    kind: process
    asset_ids: [asset-code-scan]
    trust_zone_id: tz-dev
  - id: comp-vex
    name: VEX Gate Skill Runtime
    kind: process
    asset_ids: [asset-code-scan]
    trust_zone_id: tz-dev
  - id: comp-accessibility
    name: Accessibility Skill Scanner
    kind: process
    asset_ids: [asset-webscan]
    trust_zone_id: tz-dev
  - id: comp-securityplanning
    name: Security Planning Skill Generator
    kind: process
    asset_ids: [asset-planning]
    trust_zone_id: tz-dev
  - id: comp-logsink
    name: Operator Diagnostics / Log Sinks
    kind: data_store
    trust_zone_id: tz-dev

# The repaired generator shares one contiguous z:Id sequence with the bundled
# KnowledgeBase (no fixed ~35-object ceiling), so the full multi-surface diagram is
# restored below. ThreatInstances do not consume z:Id allocations.
representations:
  context_diagrams:
    - id: ctx-01
      name: System context and trust boundaries
      description: >-
        End-to-end context spanning the developer workstation, repository, CI/CD
        pipeline, GitHub platform, external dependencies, and third-party SaaS APIs.
      trust_zone_ids: [tz-dev, tz-repo, tz-cicd, tz-github, tz-ext, tz-saas]
      flows: [flow-01, flow-02, flow-03, flow-04, flow-25, flow-26]
      elements:
        - { id: ext-dev }
        - { id: ext-copilot }
        - { id: ext-llm }
        - { id: ext-ghmcp }
        - { id: comp-artifacts }
        - { id: comp-scripts }
        - { id: comp-repo }
        - { id: comp-extension }
  functional_scenarios:
    - id: func-oauth
      name: Mural OAuth Authorization Code + PKCE loopback flow
      description: >-
        The Mural skill authenticates a per-user OAuth app through a loopback redirect,
        persists tokens to an on-disk cache, and egresses bearer-authenticated calls to
        the Mural API.
      trust_zone_ids: [tz-dev, tz-saas]
      flows: [flow-07, flow-08, flow-09, flow-10, flow-14, flow-40, flow-41, flow-42, flow-43, flow-44]
      elements:
        - { id: ext-dev }
        - { id: ext-browser }
        - { id: comp-mural }
        - { id: comp-loopback }
        - { id: comp-tokencache }
        - { id: comp-logsink }
        - { id: ext-mural-as }
        - { id: ext-mural-api }
    - id: func-cred
      name: Credential-bearing REST and synthesis egress (Jira / GitLab / TTS)
      description: >-
        Single-file CLIs authenticate with environment credentials and egress to
        third-party APIs over TLS; the TTS skill additionally egresses narration content
        to an Azure Speech region.
      trust_zone_ids: [tz-dev, tz-saas]
      flows: [flow-11, flow-12, flow-13, flow-28, flow-29, flow-30]
      elements:
        - { id: ext-dev }
        - { id: comp-jira }
        - { id: comp-gitlab }
        - { id: comp-tts }
        - { id: ext-jira }
        - { id: ext-gitlab }
        - { id: ext-azspeech }
  operational_views:
    - id: op-cicd
      name: CI/CD and dev-container operations
      description: >-
        Git push triggers GitHub Actions runners that execute validation and security
        scanning; the optional dev container provisions local tooling with checksum
        verification.
      trust_zone_ids: [tz-github, tz-cicd, tz-dev, tz-ext]
      flows: [flow-05, flow-06, flow-23, flow-24]
      components:
        - { id: comp-repo, kind: data_store, trust_zone_id: tz-github }
        - { id: comp-workflows, kind: process, trust_zone_id: tz-cicd }
        - { id: comp-scanning, kind: process, trust_zone_id: tz-cicd }
        - { id: comp-devcon, kind: process, trust_zone_id: tz-dev }
        - { id: ext-npm, kind: external_interactor, trust_zone_id: tz-ext }
    - id: dom-docproc
      name: Document processing and deck rendering
      description: >-
        The PowerPoint, customer-card-render, and video-to-gif skills process local
        content and hand off render work to local parser and converter binaries.
      trust_zone_ids: [tz-dev]
      flows: [flow-15, flow-16, flow-17, flow-18, flow-31, flow-32, flow-33]
      elements:
        - { id: ext-dev }
        - { id: comp-customercards }
        - { id: comp-powerpoint }
        - { id: comp-videogif }
        - { id: ext-soffice }
        - { id: ext-mupdf }
        - { id: ext-ffmpeg }
    - id: dom-reposcan
      name: Repository scanning and VEX gate evaluation
      description: >-
        The code-scanning and vex skills read repository and workflow-owned content and
        decide whether to proceed with downstream drafting or triage.
      trust_zone_ids: [tz-dev, tz-github, tz-cicd]
      flows: [flow-19, flow-27, flow-34, flow-35]
      elements:
        - { id: ext-dev }
        - { id: comp-ghscan }
        - { id: comp-vex }
        - { id: comp-workflows }
        - { id: ext-ghapi }
    - id: dom-webscan
      name: Accessibility scan target egress and normalization
      description: >-
        The accessibility skill launches an external scanner against operator-supplied
        content and emits normalized findings to the caller.
      trust_zone_ids: [tz-dev, tz-ext]
      flows: [flow-20, flow-21, flow-36, flow-37]
      elements:
        - { id: ext-dev }
        - { id: comp-accessibility }
        - { id: ext-scan-target }
        - { id: ext-axe }
    - id: dom-planning
      name: Security-planning artifact generation
      description: >-
        The security-planning skill reads repo artifacts and writes TM7 and markdown
        reports for the broader risk model.
      trust_zone_ids: [tz-dev, tz-repo, tz-cicd]
      flows: [flow-22, flow-38, flow-39]
      elements:
        - { id: ext-dev }
        - { id: comp-securityplanning }
        - { id: comp-artifacts }

data_flows:
  - id: flow-01
    source_ref: comp-artifacts
    target_ref: ext-copilot
    ordinal: 1
    label: read artifacts
    transport: local read
    encryption: n/a (local)
    authentication: local file access
    authorization: workstation user
    data_sensitivity: public
    retention: none
    notes: Artifacts read into Copilot context.
  - id: flow-02
    source_ref: ext-copilot
    target_ref: ext-llm
    ordinal: 2
    label: send prompts
    transport: HTTPS
    encryption: TLS 1.3
    authentication: Copilot session token
    authorization: GitHub Copilot entitlement
    data_sensitivity: internal
    retention: per GitHub Copilot policy
    notes: Prompts and context sent to the LLM API service.
  - id: flow-03
    source_ref: ext-copilot
    target_ref: ext-ghmcp
    ordinal: 3
    label: invoke MCP
    transport: HTTPS
    encryption: TLS 1.3
    authentication: OAuth / GitHub App token / PAT
    authorization: GitHub permission model
    data_sensitivity: internal
    retention: GitHub audit log
    notes: Tool calls to the GitHub MCP server.
  - id: flow-04
    source_ref: ext-dev
    target_ref: comp-repo
    ordinal: 4
    label: push changes
    transport: HTTPS / SSH (git push)
    encryption: TLS 1.3
    authentication: git credentials
    authorization: branch protection + CODEOWNERS
    data_sensitivity: public
    retention: repository history
    notes: Developer pushes changes to the repository.
  - id: flow-05
    source_ref: comp-repo
    target_ref: comp-workflows
    ordinal: 5
    label: trigger workflow
    transport: internal trigger
    encryption: n/a (platform-internal)
    authentication: GitHub Actions trigger
    authorization: workflow permissions (least privilege)
    data_sensitivity: internal
    retention: Actions run logs
    notes: Repository events trigger CI/CD workflows.
  - id: flow-06
    source_ref: comp-workflows
    target_ref: comp-scanning
    ordinal: 6
    label: run scans
    transport: internal
    encryption: n/a (platform-internal)
    authentication: GITHUB_TOKEN
    authorization: security-events scope (SARIF upload only)
    data_sensitivity: internal
    retention: code scanning alerts
    notes: Workflows invoke CodeQL, dependency review, and gitleaks.
  - id: flow-07
    source_ref: ext-browser
    target_ref: comp-loopback
    ordinal: 7
    label: deliver callback
    transport: HTTP (loopback 127.0.0.1)
    encryption: n/a (loopback)
    authentication: PKCE-bound authorization code
    authorization: per-request state validation
    data_sensitivity: confidential
    retention: none (immediate exchange)
    notes: Authorization code delivered to the loopback callback.
  - id: flow-08
    source_ref: comp-mural
    target_ref: ext-mural-as
    ordinal: 8
    label: request token
    transport: HTTPS
    encryption: TLS 1.3
    authentication: client_secret + PKCE code_verifier
    authorization: OAuth token exchange
    data_sensitivity: confidential
    retention: none
    notes: Authorization-code-to-token exchange with the Mural authorization server.
  - id: flow-09
    source_ref: comp-mural
    target_ref: ext-mural-api
    ordinal: 9
    label: call API
    transport: HTTPS
    encryption: TLS 1.3
    authentication: Bearer access_token
    authorization: granted Mural scope set
    data_sensitivity: internal
    retention: Mural API audit trail
    notes: Bearer-authenticated Mural REST API calls; responses treated as untrusted text.
  - id: flow-10
    source_ref: comp-mural
    target_ref: comp-tokencache
    ordinal: 10
    label: persist tokens
    transport: local file I/O
    encryption: OS keyring or 0600 file
    authentication: workstation user
    authorization: file mode 0600
    data_sensitivity: confidential
    retention: until revocation
    notes: Tokens and client_secret persisted to the per-user token cache.
  - id: flow-11
    source_ref: comp-jira
    target_ref: ext-jira
    ordinal: 11
    label: call Jira API
    transport: HTTPS
    encryption: TLS 1.2+
    authentication: Bearer PAT / Basic (base64 email:token)
    authorization: operator Jira scope
    data_sensitivity: internal
    retention: none
    notes: Jira REST calls; origin-only base URL, no-redirect opener.
  - id: flow-12
    source_ref: comp-gitlab
    target_ref: ext-gitlab
    ordinal: 12
    label: call GitLab API
    transport: HTTPS
    encryption: TLS 1.2+
    authentication: PRIVATE-TOKEN PAT
    authorization: operator GitLab scope
    data_sensitivity: internal
    retention: none
    notes: GitLab REST calls and CI job-trace retrieval; origin-only base URL.
  - id: flow-13
    source_ref: comp-tts
    target_ref: ext-azspeech
    ordinal: 13
    label: synthesize speech
    transport: HTTPS
    encryption: TLS 1.2+
    authentication: SPEECH_KEY or Entra token
    authorization: cognitiveservices.azure.com/.default
    data_sensitivity: confidential
    retention: per Azure region policy
    notes: Speaker-notes narration egressed to the configured Azure Speech region.
  - id: flow-14
    source_ref: comp-mural
    target_ref: comp-logsink
    ordinal: 14
    label: emit logs
    transport: local logging
    encryption: n/a (local)
    authentication: n/a
    authorization: operator
    data_sensitivity: confidential
    retention: operator-managed
    notes: Redacted operational logs (_redact / _REDACT_KEYS pipeline).
  - id: flow-15
    source_ref: comp-customercards
    target_ref: comp-powerpoint
    ordinal: 15
    label: handoff content
    transport: local file handoff
    encryption: n/a (local)
    authentication: workstation user
    authorization: operator-controlled output directory
    data_sensitivity: internal
    retention: operator-managed
    notes: Customer-card content.yaml is handed off to the PowerPoint builder.
  - id: flow-16
    source_ref: comp-powerpoint
    target_ref: ext-soffice
    ordinal: 16
    label: render PPTX
    transport: local process invocation
    encryption: n/a (local)
    authentication: workstation user
    authorization: operator-controlled input path
    data_sensitivity: internal
    retention: none
    notes: PPTX is converted via LibreOffice in headless mode.
  - id: flow-17
    source_ref: comp-powerpoint
    target_ref: ext-mupdf
    ordinal: 17
    label: render PDF
    transport: local process invocation
    encryption: n/a (local)
    authentication: workstation user
    authorization: operator-controlled input path
    data_sensitivity: internal
    retention: none
    notes: PDF inputs are parsed by MuPDF after safety checks.
  - id: flow-18
    source_ref: comp-videogif
    target_ref: ext-ffmpeg
    ordinal: 18
    label: transcode media
    transport: local process invocation
    encryption: n/a (local)
    authentication: workstation user
    authorization: operator-controlled input path
    data_sensitivity: internal
    retention: none
    notes: ffprobe and ffmpeg decode untrusted media on the local host.
  - id: flow-19
    source_ref: comp-ghscan
    target_ref: ext-ghapi
    ordinal: 19
    label: fetch alerts
    transport: HTTPS
    encryption: TLS 1.2+
    authentication: gh CLI token / GitHub auth
    authorization: read-only code-scanning scope
    data_sensitivity: internal
    retention: GitHub API policy
    notes: Code-scanning alert data is fetched from the GitHub REST API.
  - id: flow-20
    source_ref: comp-accessibility
    target_ref: ext-axe
    ordinal: 20
    label: launch scanner
    transport: local process invocation
    encryption: n/a (local)
    authentication: workstation user
    authorization: operator-controlled target argument
    data_sensitivity: internal
    retention: none
    notes: The scanner wrapper launches axe-core and its headless browser.
  - id: flow-21
    source_ref: ext-axe
    target_ref: ext-scan-target
    ordinal: 21
    label: fetch target
    transport: HTTPS / file fetch
    encryption: TLS 1.2+
    authentication: none
    authorization: target-operator-controlled network egress
    data_sensitivity: internal
    retention: none
    notes: axe-core fetches the operator-supplied target from the network or local file system.
  - id: flow-22
    source_ref: comp-securityplanning
    target_ref: comp-artifacts
    ordinal: 22
    label: write outputs
    transport: local file read/write
    encryption: n/a (local)
    authentication: workstation user
    authorization: repository-scoped artifact access
    data_sensitivity: internal
    retention: generated reports
    notes: The planning generator reads repo artifacts and writes TM7 and markdown outputs.
  - id: flow-23
    source_ref: comp-repo
    target_ref: comp-devcon
    ordinal: 23
    label: mount repo
    transport: local workspace mount and lifecycle configuration
    encryption: n/a (local)
    authentication: workstation user
    authorization: repository and workspace permissions
    data_sensitivity: internal
    retention: dev-container lifecycle
    notes: Repository-owned dev-container configuration and lifecycle scripts are loaded by the local dev container.
  - id: flow-24
    source_ref: comp-devcon
    target_ref: ext-npm
    ordinal: 24
    label: download toolchain
    transport: HTTPS
    encryption: TLS 1.2+
    authentication: registry-specific or anonymous download
    authorization: package and feature publication policy
    data_sensitivity: public
    retention: local tool cache
    notes: The dev container downloads features, packages, and external tool binaries from registries and release sources.
  - id: flow-25
    source_ref: comp-extension
    target_ref: ext-copilot
    ordinal: 25
    label: mediate Copilot
    transport: VS Code extension host and Copilot service API
    encryption: platform-managed TLS for service calls
    authentication: Copilot session and extension-host identity
    authorization: declared extension and Copilot permissions
    data_sensitivity: internal
    retention: per GitHub Copilot policy
    notes: The VS Code extension mediates local Copilot interactions and exposed capabilities.
  - id: flow-26
    source_ref: comp-artifacts
    target_ref: comp-scripts
    ordinal: 26
    label: read scripts
    transport: local file read/write
    encryption: n/a (local)
    authentication: workstation user
    authorization: repository-scoped filesystem permissions
    data_sensitivity: confidential
    retention: tracking-artifact lifecycle
    notes: Local automation reads source artifacts and materializes derived meeting and analysis content under tracking storage.
  - id: flow-27
    source_ref: comp-workflows
    target_ref: comp-vex
    ordinal: 27
    label: draft VEX
    transport: workflow subprocess stdin and local file argument
    encryption: n/a (runner-local)
    authentication: workflow execution identity
    authorization: workflow contents-read and issues-read permissions
    data_sensitivity: internal
    retention: workflow job lifetime
    notes: The VEX drafting workflow pipes the detection-issue body and supplies the OpenVEX document to the local VEX gate.
  - id: flow-28
    source_ref: ext-dev
    target_ref: comp-jira
    ordinal: 28
    label: invoke Jira CLI
    transport: local process invocation
    encryption: n/a (local)
    authentication: workstation user
    authorization: operator-authorized CLI execution
    data_sensitivity: internal
    retention: none
    notes: Operator invokes the Jira skill CLI from the local workstation.
  - id: flow-29
    source_ref: ext-dev
    target_ref: comp-gitlab
    ordinal: 29
    label: invoke GitLab CLI
    transport: local process invocation
    encryption: n/a (local)
    authentication: workstation user
    authorization: operator-authorized CLI execution
    data_sensitivity: internal
    retention: none
    notes: Operator invokes the GitLab skill CLI from the local workstation.
  - id: flow-30
    source_ref: ext-dev
    target_ref: comp-tts
    ordinal: 30
    label: invoke TTS CLI
    transport: local process invocation
    encryption: n/a (local)
    authentication: workstation user
    authorization: operator-authorized CLI execution
    data_sensitivity: confidential
    retention: none
    notes: Operator invokes the TTS skill CLI from the local workstation.
  - id: flow-31
    source_ref: ext-dev
    target_ref: comp-customercards
    ordinal: 31
    label: invoke renderer
    transport: local process invocation
    encryption: n/a (local)
    authentication: workstation user
    authorization: operator-authorized CLI execution
    data_sensitivity: internal
    retention: operator-managed
    notes: Operator invokes the customer-card render skill from the local workstation.
  - id: flow-32
    source_ref: ext-dev
    target_ref: comp-powerpoint
    ordinal: 32
    label: invoke PowerPoint
    transport: local process invocation
    encryption: n/a (local)
    authentication: workstation user
    authorization: operator-authorized CLI execution
    data_sensitivity: internal
    retention: operator-managed
    notes: Operator invokes the PowerPoint skill from the local workstation.
  - id: flow-33
    source_ref: ext-dev
    target_ref: comp-videogif
    ordinal: 33
    label: invoke converter
    transport: local process invocation
    encryption: n/a (local)
    authentication: workstation user
    authorization: operator-authorized CLI execution
    data_sensitivity: internal
    retention: operator-managed
    notes: Operator invokes the video-to-GIF skill from the local workstation.
  - id: flow-34
    source_ref: ext-dev
    target_ref: comp-ghscan
    ordinal: 34
    label: invoke scanner
    transport: local process invocation
    encryption: n/a (local)
    authentication: workstation user
    authorization: operator-authorized CLI execution
    data_sensitivity: internal
    retention: none
    notes: Operator invokes the code-scanning skill from the local workstation.
  - id: flow-35
    source_ref: comp-workflows
    target_ref: ext-ghapi
    ordinal: 35
    label: read alerts
    transport: HTTPS
    encryption: TLS 1.2+
    authentication: workflow execution identity
    authorization: workflow contents-read and issues-read permissions
    data_sensitivity: internal
    retention: workflow job lifetime
    notes: Workflow-owned GitHub API access reads code-scanning content and issue data.
  - id: flow-36
    source_ref: ext-dev
    target_ref: comp-accessibility
    ordinal: 36
    label: invoke scanner
    transport: local process invocation
    encryption: n/a (local)
    authentication: workstation user
    authorization: operator-authorized CLI execution
    data_sensitivity: internal
    retention: none
    notes: Operator invokes the accessibility scanner from the local workstation.
  - id: flow-37
    source_ref: comp-accessibility
    target_ref: ext-dev
    ordinal: 37
    label: return findings
    transport: local result return
    encryption: n/a (local)
    authentication: workstation user
    authorization: caller-selected output path
    data_sensitivity: internal
    retention: caller-selected
    notes: The scanner returns normalized findings to the calling workstation process.
  - id: flow-38
    source_ref: ext-dev
    target_ref: comp-securityplanning
    ordinal: 38
    label: invoke generator
    transport: local process invocation
    encryption: n/a (local)
    authentication: workstation user
    authorization: operator-authorized CLI execution
    data_sensitivity: internal
    retention: generated reports
    notes: Operator invokes the security-planning generator with source paths and output destinations.
  - id: flow-39
    source_ref: comp-artifacts
    target_ref: comp-securityplanning
    ordinal: 39
    label: read spec
    transport: local file read
    encryption: n/a (local)
    authentication: workstation user
    authorization: repository-scoped artifact access
    data_sensitivity: internal
    retention: generated reports
    notes: The generator reads threat-model artifacts and templates from the repository tree.
  - id: flow-40
    source_ref: ext-dev
    target_ref: comp-mural
    ordinal: 40
    label: launch OAuth client
    transport: local process invocation
    encryption: n/a (local)
    authentication: workstation user
    authorization: operator-authorized CLI execution
    data_sensitivity: confidential
    retention: none
    notes: Operator launches the Mural OAuth client from the local workstation.
  - id: flow-41
    source_ref: comp-mural
    target_ref: ext-browser
    ordinal: 41
    label: launch browser
    transport: local browser launch
    encryption: n/a (local)
    authentication: workstation user
    authorization: operator consent
    data_sensitivity: confidential
    retention: authorization-session retention only
    notes: The OAuth client launches the default browser for the authorization request.
  - id: flow-42
    source_ref: ext-browser
    target_ref: ext-mural-as
    ordinal: 42
    label: request authorization
    transport: HTTPS
    encryption: TLS 1.3
    authentication: PKCE-bound request context
    authorization: Mural authorization request
    data_sensitivity: confidential
    retention: authorization-session retention only
    notes: The browser submits the authorization request to the Mural authorization server.
  - id: flow-43
    source_ref: ext-mural-as
    target_ref: ext-browser
    ordinal: 43
    label: return redirect
    transport: HTTPS redirect
    encryption: TLS 1.3
    authentication: authorization code and state
    authorization: Mural authorization response
    data_sensitivity: confidential
    retention: authorization-session retention only
    notes: The authorization server redirects the browser back to the local callback endpoint.
  - id: flow-44
    source_ref: comp-loopback
    target_ref: comp-mural
    ordinal: 44
    label: handoff callback
    transport: local process handoff
    encryption: n/a (local)
    authentication: workstation user
    authorization: state-validated callback exchange
    data_sensitivity: confidential
    retention: none
    notes: The loopback handler hands the authorization code back to the Mural OAuth client.

threats:
  # ---- Repo-wide STRIDE ----
  - id: S-1
    target_ref: comp-workflows
    interaction_ref: flow-05
    category: spoofing
    title: Compromised GitHub Action via tag substitution
    description: Attacker compromises an upstream Action repo and replaces a tag with malicious code.
    state: Mitigated
    citations: { stride: [S], nist: [IA-9, SA-12], mitre: [] }
    mitigation_ids: [SC-1, SC-2, SC-3, SC-5]
  - id: S-2
    target_ref: comp-workflows
    interaction_ref: flow-05
    category: spoofing
    title: npm package substitution / typosquatting
    description: Malicious package published under the same name or a typosquatted name.
    state: Mitigated
    citations: { stride: [S], nist: [SA-12], mitre: [] }
    mitigation_ids: [SC-3, SC-4, SC-5]
  - id: T-1
    target_ref: comp-workflows
    interaction_ref: flow-05
    category: tampering
    title: Unauthorized modification of security controls
    description: Attacker with write access disables security checks.
    state: Mitigated
    citations: { stride: [T], nist: [AC-3, CM-3], mitre: [] }
    mitigation_ids: [AC-1, AC-2, CQ-1]
  - id: T-2
    target_ref: comp-artifacts
    interaction_ref: flow-01
    category: tampering
    title: Malicious prompt injection via PR
    description: Contributor submits a prompt with hidden malicious instructions.
    state: Partially Mitigated
    citations: { stride: [T], nist: [SA-11], mitre: [] }
    mitigation_ids: [AC-2, AC-3, CQ-2, CQ-3]
  - id: R-1
    target_ref: comp-repo
    interaction_ref: flow-04
    category: repudiation
    title: Untraceable configuration changes
    description: Admin makes security-impacting changes without an audit trail.
    state: Mitigated
    citations: { stride: [R], nist: [AU-2, AU-12], mitre: [] }
    mitigation_ids: [AC-1]
  - id: I-1
    target_ref: comp-workflows
    interaction_ref: flow-06
    category: information-disclosure
    title: Secret exposure in logs or artifacts
    description: Secrets accidentally logged or included in build artifacts.
    state: Mitigated
    citations: { stride: [I], nist: [SC-28, AU-9], mitre: [] }
    mitigation_ids: [VM-2, VM-3]
  - id: I-2
    target_ref: comp-artifacts
    interaction_ref: flow-01
    category: information-disclosure
    title: Sensitive information in prompt artifacts
    description: Internal URLs, API keys, or proprietary patterns exposed in prompts.
    state: Mitigated
    citations: { stride: [I], nist: [SC-28], mitre: [] }
    mitigation_ids: [AC-3, VM-2]
  - id: D-1
    target_ref: comp-workflows
    interaction_ref: flow-05
    category: denial-of-service
    title: CI/CD resource exhaustion
    description: Malicious PR triggers expensive workflows repeatedly.
    state: Mitigated
    citations: { stride: [D], nist: [SC-5], mitre: [] }
    mitigation_ids: [AC-4]
  - id: D-2
    target_ref: comp-workflows
    interaction_ref: flow-05
    category: denial-of-service
    title: Dependency confusion blocking builds
    description: Attacker publishes a conflicting package preventing clean builds.
    state: Mitigated
    citations: { stride: [D], nist: [SC-5, SA-12], mitre: [] }
    mitigation_ids: [SC-4, SC-5]
  - id: E-1
    target_ref: comp-workflows
    interaction_ref: flow-05
    category: elevation-of-privilege
    title: Workflow token abuse
    description: Compromised workflow step uses GITHUB_TOKEN beyond intended scope.
    state: Mitigated
    citations: { stride: [E], nist: [AC-6], mitre: [] }
    mitigation_ids: [AC-4, VM-3]
  - id: E-2
    target_ref: comp-repo
    interaction_ref: flow-04
    category: elevation-of-privilege
    title: Branch protection bypass
    description: Admin bypasses branch protection to merge unauthorized changes.
    state: Mitigated
    citations: { stride: [E], nist: [AC-3, AC-6], mitre: [] }
    mitigation_ids: [AC-1]
  # ---- Dev Container ----
  - id: DC-1
    target_ref: comp-devcon
    interaction_ref: flow-24
    category: spoofing
    title: Dev container feature tag substitution
    description: Malicious update to a feature version tag introduces compromised tooling.
    state: Mitigated
    citations: { stride: [S], nist: [SA-12], mitre: [] }
    mitigation_ids: [SC-6]
  - id: DC-2
    target_ref: comp-devcon
    interaction_ref: flow-23
    category: tampering
    title: Lifecycle script tampering
    description: Attacker modifies on-create.sh / post-create.sh to inject code.
    state: Mitigated
    citations: { stride: [T], nist: [CM-3], mitre: [] }
    mitigation_ids: [AC-2, AC-3]
  - id: DC-3
    target_ref: comp-devcon
    interaction_ref: flow-24
    category: spoofing
    title: External binary download compromise
    description: Compromised download source serves a malicious binary.
    state: Mitigated
    citations: { stride: [S], nist: [SI-7], mitre: [] }
    mitigation_ids: [SC-6]
  # ---- AI-specific (OWASP LLM / MITRE ATLAS) ----
  - id: AI-1
    target_ref: ext-copilot
    interaction_ref: flow-01
    category: tampering
    title: "LLM01 Prompt injection via artifact content"
    description: Malicious instructions embedded in prompt artifacts manipulate Copilot.
    state: Partially Mitigated
    citations: { stride: [T], nist: [SA-11], mitre: [] }
    mitigation_ids: [AC-2, AC-3, CQ-2]
  - id: AI-2
    target_ref: ext-copilot
    interaction_ref: flow-01
    category: tampering
    title: "LLM02 Insecure output handling"
    description: Copilot generates insecure code patterns based on prompt guidance.
    state: Accepted with Documentation
    citations: { stride: [T], nist: [SA-11], mitre: [] }
  - id: AI-3
    target_ref: ext-llm
    interaction_ref: flow-02
    category: tampering
    title: "LLM03 Training data poisoning (indirect)"
    description: Malicious patterns in HVE Core influence Copilot training (GitHub-controlled).
    state: Accepted (Outside Control)
    citations: { stride: [T], nist: [], mitre: [] }
  - id: AI-4
    target_ref: ext-llm
    interaction_ref: flow-02
    category: denial-of-service
    title: "LLM04 Model denial of service"
    description: Crafted prompts cause excessive resource consumption in Copilot.
    state: Accepted (Outside Control)
    citations: { stride: [D], nist: [SC-5], mitre: [] }
  - id: AI-5
    target_ref: ext-ghmcp
    interaction_ref: flow-03
    category: spoofing
    title: "LLM05 Supply-chain vulnerabilities (MCP servers)"
    description: Compromised MCP server provides malicious context to Copilot.
    state: Mitigated with Documentation
    citations: { stride: [S], nist: [SA-12], mitre: [] }
    mitigation_ids: [SC-3]
  - id: AI-6
    target_ref: ext-copilot
    interaction_ref: flow-01
    category: information-disclosure
    title: "LLM06 Sensitive information disclosure"
    description: Prompt artifacts cause Copilot to expose sensitive patterns.
    state: Mitigated with Documentation
    citations: { stride: [I], nist: [SC-28], mitre: [] }
  - id: AI-7
    target_ref: comp-extension
    interaction_ref: flow-25
    category: elevation-of-privilege
    title: "LLM07 Insecure plugin design"
    description: Extension or MCP server allows unauthorized operations.
    state: Mitigated
    citations: { stride: [E], nist: [AC-6], mitre: [] }
  - id: AI-8
    target_ref: ext-copilot
    interaction_ref: flow-03
    category: elevation-of-privilege
    title: "LLM08 Excessive agency"
    description: Prompts grant Copilot excessive autonomous capabilities.
    state: Mitigated (Copilot Controls)
    citations: { stride: [E], nist: [AC-6], mitre: [] }
  - id: AI-9
    target_ref: ext-dev
    interaction_ref: flow-04
    category: repudiation
    title: "LLM09 Overreliance"
    description: Developers accept Copilot output without verification.
    state: Accepted with Documentation
    citations: { stride: [R], nist: [SA-11], mitre: [] }
  - id: AI-11
    target_ref: comp-artifacts
    interaction_ref: flow-01
    category: tampering
    title: "MITRE ATLAS AML.T0043 Craft adversarial data"
    description: Adversary crafts prompt content to cause model misbehavior.
    state: Partially Mitigated
    citations: { stride: [T], nist: [SA-11], mitre: [AML.T0043] }
    mitigation_ids: [AC-2, AC-3]
  - id: AI-12
    target_ref: comp-artifacts
    interaction_ref: flow-01
    category: tampering
    title: "MITRE ATLAS AML.T0048 Evade ML model"
    description: Prompts designed to cause Copilot to bypass security guidance.
    state: Mitigated
    citations: { stride: [T], nist: [SA-11], mitre: [AML.T0048] }
  # ---- Responsible AI (representative) ----
  - id: RAI-1
    target_ref: ext-copilot
    interaction_ref: flow-02
    category: information-disclosure
    title: "Fairness - biased code generation patterns"
    description: Prompts inadvertently favor certain coding styles or exclude accessibility.
    state: Partially Mitigated
    citations: { stride: [I], nist: [], mitre: [] }
    mitigation_ids: [CQ-2]
  - id: RAI-3
    target_ref: ext-copilot
    interaction_ref: flow-02
    category: information-disclosure
    title: "Privacy - context leakage via prompts"
    description: Prompts cause Copilot to surface or infer private information.
    state: Mitigated with Documentation
    citations: { stride: [I], nist: [SC-28], mitre: [] }
  - id: RAI-3a
    target_ref: comp-scripts
    interaction_ref: flow-26
    category: information-disclosure
    title: "Privacy - M365 transcript data materialization"
    description: Meeting-analyst agent writes sensitive M365 transcripts to local .copilot-tracking files.
    state: Partially Mitigated with Documentation
    citations: { stride: [I], nist: [SC-28, MP-6], mitre: [] }
  - id: RAI-4
    target_ref: comp-artifacts
    interaction_ref: flow-01
    category: repudiation
    title: "Inclusiveness - exclusionary language in artifacts"
    description: Language in prompts excludes or marginalizes user groups.
    state: Mitigated
    citations: { stride: [R], nist: [], mitre: [] }
    mitigation_ids: [CQ-2]
  - id: RAI-13
    target_ref: ext-copilot
    interaction_ref: flow-02
    category: tampering
    title: "Misinformation - prompts generating incorrect information"
    description: Prompts cause Copilot to generate plausible but incorrect content.
    state: Partially Mitigated
    citations: { stride: [T], nist: [], mitre: [] }
  # ---- Mural OAuth (OA-1..OA-17) ----
  - id: OA-1
    target_ref: ext-mural-as
    interaction_ref: flow-08
    category: spoofing
    title: Authorization server phishing / spoofed consent page
    description: Attacker directs the user to a look-alike Mural consent page to harvest credentials or coerce a grant.
    state: Mitigated with Documentation
    citations: { stride: [S], nist: [IA-2], mitre: [T1539] }
    mitigation_ids: [M-OAUTH-URL]
    properties:
      source_skill: mural
      bucket: B1
      gap_ids: [G-TLS-1]
  - id: OA-2
    target_ref: comp-mural
    interaction_ref: flow-08
    category: spoofing
    title: Authorization server mix-up via missing iss parameter
    description: Cross-AS code confusion if the skill ever supports more than one authorization server.
    state: Mitigated by Design
    citations: { stride: [S], nist: [IA-9], mitre: [] }
    mitigation_ids: [M-STATE, M-PKCE]
  - id: OA-3
    target_ref: comp-loopback
    interaction_ref: flow-07
    category: spoofing
    title: Loopback redirect URI hijack
    description: Co-resident process races the loopback bind to intercept the authorization code.
    state: Mitigated
    citations: { stride: [S], nist: [SC-8], mitre: [CAPEC-21] }
    mitigation_ids: [M-PKCE, M-REDIRECT-ALLOWLIST]
  - id: OA-4
    target_ref: comp-tokencache
    interaction_ref: flow-10
    category: spoofing
    title: Client impersonation via leaked client_secret
    description: Leaked client_secret allows an attacker to impersonate the registered OAuth client.
    state: Mitigated
    citations: { stride: [S], nist: [IA-5, SC-28], mitre: [] }
    mitigation_ids: [M-FILEPERMS, M-REDACT]
  - id: OA-5
    target_ref: comp-loopback
    interaction_ref: flow-07
    category: tampering
    title: Authorization request tampering / CSRF (missing state)
    description: Forged callback binds the user session to an attacker's Mural account.
    state: Mitigated
    citations: { stride: [T], nist: [SC-8], mitre: [] }
    mitigation_ids: [M-STATE, M-REDIRECT-ALLOWLIST, M-PKCE]
  - id: OA-6
    target_ref: ext-mural-as
    interaction_ref: flow-08
    category: tampering
    title: Authorization code replay
    description: Observed authorization code replayed at the token endpoint.
    state: Mitigated
    citations: { stride: [T], nist: [SC-8], mitre: [] }
    mitigation_ids: [M-PKCE, M-REDACT]
  - id: OA-7
    target_ref: comp-logsink
    interaction_ref: flow-14
    category: repudiation
    title: OAuth audit trail gaps
    description: No structured client-side audit record for OAuth lifecycle transitions.
    state: Partially Mitigated
    citations: { stride: [R], nist: [AU-2, AU-12], mitre: [] }
    mitigation_ids: [M-AUDIT-EVENTS]
    properties:
      source_skill: mural
      bucket: B3
      gap_ids: [G-REP-1, G-REP-2]
  - id: OA-8
    target_ref: comp-logsink
    interaction_ref: flow-14
    category: information-disclosure
    title: Token / secret leakage via application logs
    description: A log line emits a request/response body, headers, or URL containing sensitive fields.
    state: Partially Mitigated
    citations: { stride: [I], nist: [AU-9, SC-28], mitre: [T1552.001] }
    mitigation_ids: [M-REDACT, VM-2]
    properties:
      source_skill: mural
      bucket: B3
      gap_ids: [G-INF-1, G-INF-4]
  - id: OA-9
    target_ref: ext-browser
    interaction_ref: flow-07
    category: information-disclosure
    title: Token leakage via browser referer / history
    description: Authorization code in the redirect URL leaks via Referer header, history, or extensions.
    state: Mitigated
    citations: { stride: [I], nist: [SC-8], mitre: [] }
    mitigation_ids: [M-PKCE]
  - id: OA-10
    target_ref: comp-tokencache
    interaction_ref: flow-10
    category: information-disclosure
    title: Token cache file disclosure
    description: Another local user or process reads the credential cache file.
    state: Mitigated
    citations: { stride: [I], nist: [SC-28, AC-6], mitre: [T1555.003] }
    mitigation_ids: [M-FILEPERMS]
    properties:
      source_skill: mural
      bucket: B3
      gap_ids: [G-INF-2, G-INF-3]
  - id: OA-11
    target_ref: comp-tokencache
    interaction_ref: flow-10
    category: information-disclosure
    title: Refresh token theft (long-lived, non-rotated)
    description: Exfiltrated non-rotated refresh token yields access tokens until manual revocation.
    state: Partially Mitigated
    citations: { stride: [I], nist: [SC-28], mitre: [] }
    mitigation_ids: [M-REDACT, M-FILEPERMS, M-REVOKE-RUNBOOK]
  - id: OA-12
    target_ref: comp-mural
    interaction_ref: flow-08
    category: information-disclosure
    title: PKCE verifier leakage or weak entropy
    description: Verifier leaks or has weak entropy, enabling code exchange by an interceptor.
    state: Mitigated
    citations: { stride: [I], nist: [SC-12, SC-13], mitre: [] }
    mitigation_ids: [M-PKCE]
  - id: OA-13
    target_ref: ext-mural-as
    interaction_ref: flow-08
    category: denial-of-service
    title: Authorization endpoint denial of service
    description: Repeated authorization requests consume the Mural rate-limit budget and lock out the user.
    state: Mitigated
    citations: { stride: [D], nist: [SC-5], mitre: [] }
    mitigation_ids: [M-CACHE-LOCK, M-BACKOFF]
  - id: OA-14
    target_ref: ext-mural-as
    interaction_ref: flow-08
    category: denial-of-service
    title: Token endpoint refresh storm
    description: Concurrent skill processes race to refresh, hammering the token endpoint.
    state: Mitigated
    citations: { stride: [D], nist: [SC-5], mitre: [] }
    mitigation_ids: [M-CACHE-LOCK]
  - id: OA-15
    target_ref: ext-mural-as
    interaction_ref: flow-08
    category: elevation-of-privilege
    title: Scope upgrade / consent phishing
    description: Skill requests broader scopes than required or an attacker tampers with the scope parameter.
    state: Mitigated
    citations: { stride: [E], nist: [AC-6], mitre: [T1528, CAPEC-593] }
    mitigation_ids: [M-SCOPE-HARDCODE]
  - id: OA-16
    target_ref: ext-mural-api
    interaction_ref: flow-09
    category: elevation-of-privilege
    title: Bearer token theft enabling cross-resource replay
    description: Stolen bearer token replayed against any Mural API endpoint (no proof-of-possession).
    state: Partially Mitigated
    citations: { stride: [E], nist: [AC-6, SC-8], mitre: [T1550.001, CAPEC-593] }
    mitigation_ids: [M-REDACT, M-FILEPERMS]
    properties:
      source_skill: mural
      bucket: B1
      gap_ids: [G-EOP-1, G-EOP-2]
  - id: OA-17
    target_ref: ext-mural-api
    interaction_ref: flow-09
    category: elevation-of-privilege
    title: Stolen-token abuse window via missing rotation + long refresh TTL
    description: Non-rotated refresh token plus long TTL means recovery requires manual revocation.
    state: Partially Mitigated
    citations: { stride: [E], nist: [AC-6], mitre: [] }
    mitigation_ids: [M-REVOKE-RUNBOOK]
    properties:
      source_skill: mural
      bucket: B1
      gap_ids: [G-EOP-2]
  - id: OA-18
    target_ref: comp-mural
    interaction_ref: flow-09
    category: tampering
    title: Supply-chain or dependency tampering compromises the Mural runtime
    description: A compromised or unpinned dependency could alter the runtime behavior of the Mural CLI or its OAuth helpers.
    state: Partially Mitigated
    citations: { stride: [T], nist: [SA-12], mitre: [CWE-494] }
    properties:
      source_skill: mural
      bucket: B2
      gap_ids: [G-SUP-1]
  # ---- Jira (JR-1..7) ----
  - id: JR-1
    target_ref: comp-jira
    interaction_ref: flow-11
    category: information-disclosure
    title: PAT exfiltration via traceback or error message
    description: A raw exception embedding URL/headers/upstream body could surface the bearer token.
    state: Partially Mitigated
    citations: { stride: [I], nist: [AU-9], mitre: [CWE-532] }
    mitigation_ids: [M-REDACT-JIRA]
    properties:
      source_skill: jira
      bucket: B1
      gap_ids: [G-REP-1, G-INF-1, G-EOP-1]
  - id: JR-2
    target_ref: comp-jira
    interaction_ref: flow-11
    category: information-disclosure
    title: Basic-auth credential decoded from logs
    description: Reversible base64 Basic credential recovered if it reaches a log or error string.
    state: Partially Mitigated
    citations: { stride: [I], nist: [AU-9], mitre: [CWE-522] }
    mitigation_ids: [M-REDACT-JIRA]
  - id: JR-3
    target_ref: comp-jira
    interaction_ref: flow-11
    category: spoofing
    title: JIRA_BASE_URL substitution / SSRF
    description: A crafted base URL retargets authenticated requests to an attacker origin.
    state: Mitigated
    citations: { stride: [S], nist: [SC-7], mitre: [CWE-918] }
    mitigation_ids: [M-URL-CANON, M-NOREDIRECT]
    properties:
      source_skill: jira
      bucket: B1
      gap_ids: [G-TLS-1]
  - id: JR-4
    target_ref: comp-jira
    interaction_ref: flow-11
    category: information-disclosure
    title: Upstream error body echoed verbatim
    description: A hostile Jira response could embed secrets that leak if echoed verbatim.
    state: Mitigated
    citations: { stride: [I], nist: [SI-11], mitre: [CWE-209] }
    mitigation_ids: [M-REDACT-JIRA, M-BODY-CAP]
    properties:
      source_skill: jira
      bucket: B1
      gap_ids: [G-SUP-1]
  - id: JR-5
    target_ref: comp-jira
    interaction_ref: flow-11
    category: information-disclosure
    title: JIRA_PAT environment leak via os.environ dump
    description: A future debug path dumping os.environ could expose the PAT.
    state: Partially Mitigated
    citations: { stride: [I], nist: [AU-9], mitre: [CWE-526] }
    mitigation_ids: [M-NO-ENV-DUMP]
  - id: JR-6
    target_ref: comp-jira
    interaction_ref: flow-11
    category: information-disclosure
    title: JiraClient repr() leaking auth_header
    description: Auto-generated repr() of the frozen dataclass would expose the raw credential.
    state: Open
    citations: { stride: [I], nist: [AU-9], mitre: [CWE-215] }
  - id: JR-7
    target_ref: comp-jira
    interaction_ref: flow-11
    category: information-disclosure
    title: handle_comment stdin payload echoed in traceback
    description: Sensitive stdin comment body could leak if embedded in an error or traceback.
    state: Mitigated
    citations: { stride: [I], nist: [SI-11], mitre: [CWE-209] }
    mitigation_ids: [M-BODY-CAP, M-REDACT-JIRA]
  # ---- GitLab (GL-1..7) ----
  - id: GL-1
    target_ref: comp-gitlab
    interaction_ref: flow-12
    category: information-disclosure
    title: PRIVATE-TOKEN exfiltration via traceback or error message
    description: A raw exception or die() message embedding URL/headers/body could surface the token.
    state: Partially Mitigated
    citations: { stride: [I], nist: [AU-9], mitre: [CWE-532] }
    mitigation_ids: [M-REDACT-GITLAB]
    properties:
      source_skill: gitlab
      bucket: B1
      gap_ids: [G-REP-1, G-INF-1, G-EOP-1]
  - id: GL-2
    target_ref: comp-gitlab
    interaction_ref: flow-12
    category: information-disclosure
    title: gitlab_token module-global accidental dump
    description: A globals() dump, repr, or debugger frame could expose the module-global PAT.
    state: Open
    citations: { stride: [I], nist: [AU-9], mitre: [CWE-526] }
  - id: GL-3
    target_ref: comp-gitlab
    interaction_ref: flow-12
    category: information-disclosure
    title: cmd_job_log second urlopen bypassing redaction
    description: A second HTTP request outside the central helper historically bypassed hardening.
    state: Partially Mitigated
    citations: { stride: [I], nist: [AU-9, SC-7], mitre: [CWE-200] }
    mitigation_ids: [M-REDACT-GITLAB, M-NOREDIRECT]
    properties:
      source_skill: gitlab
      bucket: B1
      gap_ids: [G-SUP-1]
  - id: GL-4
    target_ref: comp-gitlab
    interaction_ref: flow-12
    category: information-disclosure
    title: die() helper printing raw upstream body
    description: die() prints an error string; a raw upstream body could leak secrets.
    state: Partially Mitigated
    citations: { stride: [I], nist: [SI-11], mitre: [CWE-209] }
    mitigation_ids: [M-REDACT-GITLAB]
  - id: GL-5
    target_ref: comp-gitlab
    interaction_ref: flow-12
    category: spoofing
    title: GITLAB_URL substitution / SSRF
    description: A crafted GITLAB_URL retargets authenticated requests to an attacker origin.
    state: Mitigated
    citations: { stride: [S], nist: [SC-7], mitre: [CWE-918] }
    mitigation_ids: [M-URL-CANON, M-NOREDIRECT]
    properties:
      source_skill: gitlab
      bucket: B1
      gap_ids: [G-TLS-1]
  - id: GL-6
    target_ref: comp-gitlab
    interaction_ref: flow-12
    category: information-disclosure
    title: Upstream error body or CI trace echoed verbatim
    description: A hostile GitLab response or CI trace could embed secrets that leak if echoed.
    state: Mitigated
    citations: { stride: [I], nist: [SI-11], mitre: [CWE-209] }
    mitigation_ids: [M-REDACT-GITLAB, M-BODY-CAP]
  - id: GL-7
    target_ref: comp-gitlab
    interaction_ref: flow-12
    category: information-disclosure
    title: GITLAB_TOKEN environment leak via os.environ dump
    description: A future debug path dumping os.environ could expose the token.
    state: Partially Mitigated
    citations: { stride: [I], nist: [AU-9], mitre: [CWE-526] }
    mitigation_ids: [M-NO-ENV-DUMP]
  # ---- TTS Voice-Over (TT-1..7) ----
  - id: TT-1
    target_ref: comp-tts
    interaction_ref: flow-13
    category: information-disclosure
    title: SPEECH_KEY exfiltration via traceback, error, or logs
    description: An exception embedding the key or SDK context could surface it in stderr or a log.
    state: Mitigated
    citations: { stride: [I], nist: [AU-9], mitre: [CWE-532] }
  - id: TT-2
    target_ref: comp-tts
    interaction_ref: flow-13
    category: information-disclosure
    title: Entra token leakage via debug output
    description: The composed aad# authorization value could leak via debug print or traceback.
    state: Mitigated
    citations: { stride: [I], nist: [AU-9], mitre: [CWE-522] }
  - id: TT-3
    target_ref: ext-azspeech
    interaction_ref: flow-13
    category: information-disclosure
    title: Speaker-notes content egress without data-classification gate
    description: All narration text egresses to the Azure Speech region with no classification gate.
    state: Partially Mitigated
    citations: { stride: [I], nist: [SC-7, AC-4], mitre: [CWE-200] }
    properties:
      source_skill: tts-voiceover
      bucket: B2
      gap_ids: [G-INF-1]
  - id: TT-4
    target_ref: comp-tts
    interaction_ref: flow-13
    category: tampering
    title: SSML injection via unescaped speaker notes
    description: Speaker-notes text interpolated into SSML could inject markup or control elements.
    state: Mitigated
    citations: { stride: [T], nist: [SI-10], mitre: [CWE-91] }
    mitigation_ids: [M-SSML-ESCAPE]
  - id: TT-5
    target_ref: comp-tts
    interaction_ref: flow-13
    category: elevation-of-privilege
    title: Untrusted PPTX / YAML parsing (XXE / unsafe deserialization)
    description: Malicious content.yaml or PPTX could exploit unsafe YAML or XML external-entity parsing.
    state: Partially Mitigated
    citations: { stride: [E], nist: [SI-10], mitre: [CWE-611, CWE-502] }
    mitigation_ids: [M-SAFE-PARSE]
    properties:
      source_skill: tts-voiceover
      bucket: B2
      gap_ids: [G-TAM-1]
  - id: TT-6
    target_ref: comp-tts
    interaction_ref: flow-13
    category: elevation-of-privilege
    title: DefaultAzureCredential ambient-credential breadth
    description: The broad credential chain could resolve to an unintended, more-privileged identity.
    state: Partially Mitigated
    citations: { stride: [E], nist: [AC-6, IA-2], mitre: [CWE-269] }
    properties:
      source_skill: tts-voiceover
      bucket: B3
      gap_ids: [G-EOP-1]
  - id: TT-7
    target_ref: ext-azspeech
    interaction_ref: flow-13
    category: spoofing
    title: Azure Speech region / endpoint substitution
    description: A tampered region/endpoint could direct content and credential to an attacker endpoint.
    state: Mitigated
    citations: { stride: [S], nist: [SC-7, SC-8], mitre: [CWE-918] }
    mitigation_ids: [M-NOREDIRECT]
    properties:
      source_skill: tts-voiceover
      bucket: B1
      gap_ids: [G-TLS-1, G-SUP-1]
  - id: PP-1
    target_ref: comp-powerpoint
    interaction_ref: flow-16
    category: tampering
    title: Author-supplied content-extra execution escapes the denylist confinement
    description: A hostile content-extra script could attempt to bypass the documented denylist and reach host capabilities.
    state: Partially Mitigated
    citations: { stride: [T], nist: [SA-11, AC-6], mitre: [CWE-94] }
    mitigation_ids: [M-PP-DENYLIST]
    notes: "Traceability: G-EOP-1; G-TAM-1"
    properties:
      source_skill: powerpoint
      bucket: B1
      gap_ids: [G-EOP-1, G-TAM-1]
  - id: PP-2
    target_ref: comp-powerpoint
    interaction_ref: flow-17
    category: elevation-of-privilege
    title: LibreOffice / MuPDF parser exploitation on untrusted deck or PDF
    description: A hostile PPTX or PDF can stress or exploit the external parser chain used during export.
    state: Partially Mitigated
    citations: { stride: [E], nist: [SI-10, SC-7], mitre: [CWE-20] }
    mitigation_ids: [M-PP-PDFBOUNDS, M-PP-ARGS]
    notes: "Traceability: G-TAM-1; G-TAM-2"
    properties:
      source_skill: powerpoint
      bucket: B2
      gap_ids: [G-TAM-1, G-TAM-2, G-SUP-1]
  - id: VG-1
    target_ref: comp-videogif
    interaction_ref: flow-18
    category: tampering
    title: Hostile media triggers FFmpeg decoder CVE exposure
    description: A crafted video stream could exercise a decoder defect within FFmpeg or ffprobe.
    state: Partially Mitigated
    citations: { stride: [T], nist: [SI-10], mitre: [CWE-20] }
    mitigation_ids: [M-VG-TIMEOUT]
    notes: "Traceability: G-SUP-1"
    properties:
      source_skill: video-to-gif
      bucket: B1
      gap_ids: [G-SUP-1]
  - id: VG-2
    target_ref: comp-videogif
    interaction_ref: flow-18
    category: denial-of-service
    title: Unbounded media conversion exhausts CPU and disk
    description: A pathological input or large media file could consume resources before conversion completes.
    state: Mitigated
    citations: { stride: [D], nist: [SC-5], mitre: [CWE-400] }
    mitigation_ids: [M-VG-TIMEOUT]
    properties:
      source_skill: video-to-gif
      bucket: B2
      gap_ids: [G-INF-1]
  - id: CC-1
    target_ref: comp-customercards
    interaction_ref: flow-15
    category: information-disclosure
    title: Confidential DT prose reaches downstream YAML without a classification gate
    description: Customer or product prose emitted into content.yaml can be exposed in downstream decks.
    state: Partially Mitigated
    citations: { stride: [I], nist: [SC-28], mitre: [CWE-200] }
    mitigation_ids: [M-CC-ESCAPE]
    notes: "Traceability: G-INF-1"
    properties:
      source_skill: customer-card-render
      bucket: B2
      gap_ids: [G-INF-1, G-SUP-1]
  - id: GS-1
    target_ref: comp-ghscan
    interaction_ref: flow-19
    category: spoofing
    title: GitHub CLI / API path substitution or host trust drift
    description: A tampered PATH or host environment could cause the wrapper to invoke an unexpected gh binary or endpoint.
    state: Partially Mitigated
    citations: { stride: [S], nist: [SA-12], mitre: [CWE-347] }
    mitigation_ids: [M-GS-CLI]
    notes: "Traceability: G-SUP-1"
    properties:
      source_skill: gh-code-scanning
      bucket: B1
      gap_ids: [G-SUP-1, G-TLS-1]
  - id: GS-2
    target_ref: comp-ghscan
    interaction_ref: flow-19
    category: tampering
    title: Branch allow-list permits traversal-like values in the ref query segment
    description: A crafted branch argument could alter the requested ref context even though the endpoint path remains constrained.
    state: Partially Mitigated
    citations: { stride: [T], nist: [SC-7], mitre: [CWE-20] }
    mitigation_ids: [M-GS-ARGS]
    notes: "Traceability: G-TAM-1"
    properties:
      source_skill: gh-code-scanning
      bucket: B1
      gap_ids: [G-TAM-1]
  - id: VX-1
    target_ref: comp-vex
    interaction_ref: flow-27
    category: tampering
    title: Crafted detection-issue content suppresses or forces drafting decisions
    description: A hostile issue body can misdrive the gate into skip or proceed outcomes that change AI-credit usage.
    state: Partially Mitigated
    citations: { stride: [T], nist: [SC-7, SC-5], mitre: [CWE-20] }
    mitigation_ids: [M-VX-REGEX]
    notes: "Traceability: G-TAM-1; G-DOS-1"
    properties:
      source_skill: vex
      bucket: B1
      gap_ids: [G-TAM-1, G-DOS-1]
  - id: AX-1
    target_ref: ext-scan-target
    interaction_ref: flow-21
    category: information-disclosure
    title: Scanner fetch reaches internal or metadata endpoints without an allow-list
    description: The headless scanner can reach operator-controlled targets that point to internal services.
    state: Partially Mitigated
    citations: { stride: [I], nist: [SC-7, SC-28], mitre: [CWE-918] }
    mitigation_ids: [M-AX-ALLOWLIST]
    notes: "Traceability: G-INF-1"
    properties:
      source_skill: accessibility
      bucket: B1
      gap_ids: [G-INF-1, G-INF-2]
  - id: AX-2
    target_ref: comp-accessibility
    interaction_ref: flow-20
    category: denial-of-service
    title: Hostile target causes headless-browser resource exhaustion
    description: A slow or malicious target can consume CPU and memory while the scanner renders it.
    state: Partially Mitigated
    citations: { stride: [D], nist: [SC-5], mitre: [CWE-400] }
    mitigation_ids: [M-AX-TIMEOUT]
    properties:
      source_skill: accessibility
      bucket: B2
      gap_ids: [G-TAM-1, G-SUP-1]
  - id: SP-1
    target_ref: comp-securityplanning
    interaction_ref: flow-22
    category: tampering
    title: Threat-model spec edits or generator drift change the curated analysis surface
    description: A modified spec or altered generator could shift the generated model away from the intended multi-skill security posture.
    state: Partially Mitigated
    citations: { stride: [T], nist: [SA-11], mitre: [CWE-20] }
    mitigation_ids: [M-SP-REVIEW]
    notes: "Traceability: G-TAM-1; G-INF-1; G-TAM-2; G-DOS-1; G-DOS-2"
    properties:
      source_skill: security-planning
      bucket: B1
      gap_ids: [G-TAM-1, G-INF-1, G-TAM-2, G-DOS-1, G-DOS-2]

mitigations:
  # Repository-level control catalog
  - id: SC-1
    name: Dependency pinning validation
    description: Test-DependencyPinning.ps1 enforces SHA-pinned Actions and dependencies.
    target_refs: [comp-workflows]
    citations: { nist: [SA-12] }
  - id: SC-2
    name: SHA staleness monitoring
    description: Test-SHAStaleness.ps1 flags pinned SHAs older than the threshold.
    target_refs: [comp-workflows]
    citations: { nist: [SA-12] }
  - id: SC-3
    name: Dependency review
    description: dependency-review.yml scans PR dependency changes.
    target_refs: [comp-workflows]
    citations: { nist: [SA-12, RA-5] }
  - id: SC-4
    name: npm security audit
    description: npm audit gate in pr-validation.yml.
    target_refs: [comp-workflows]
    citations: { nist: [RA-5] }
  - id: SC-5
    name: Dependabot updates
    description: dependabot.yml automates dependency patching.
    target_refs: [comp-workflows]
    citations: { nist: [SA-12, SI-2] }
  - id: SC-6
    name: Tool checksum verification
    description: SHA256 verification of external binaries in on-create.sh and tool-checksums.json.
    target_refs: [comp-devcon]
    citations: { nist: [SI-7] }
  - id: CQ-1
    name: CodeQL analysis
    description: codeql-analysis.yml static analysis of code paths.
    target_refs: [comp-scanning]
    citations: { nist: [SA-11, RA-5] }
  - id: CQ-2
    name: Markdown / inclusive-language linting
    description: lint:md and spell-check enforce artifact and language quality.
    target_refs: [comp-artifacts]
    citations: { nist: [SA-11] }
  - id: CQ-3
    name: Frontmatter validation
    description: Validate-MarkdownFrontmatter.ps1 enforces artifact schema.
    target_refs: [comp-artifacts]
    citations: { nist: [SA-11] }
  - id: AC-1
    name: Branch protection
    description: Repository branch protection with no bypass and required reviewers.
    target_refs: [comp-repo]
    citations: { nist: [AC-3, CM-3] }
  - id: AC-2
    name: CODEOWNERS enforcement
    description: .github/CODEOWNERS requires owner review of protected paths.
    target_refs: [comp-repo]
    citations: { nist: [AC-3] }
  - id: AC-3
    name: PR review requirements
    description: Branch-protection-required PR review of all changes.
    target_refs: [comp-repo]
    citations: { nist: [AC-3, SA-11] }
  - id: AC-4
    name: Minimal workflow permissions
    description: Job-level least-privilege permissions and persist-credentials false.
    target_refs: [comp-workflows]
    citations: { nist: [AC-6] }
  - id: VM-2
    name: Secret scanning
    description: GitHub native secret scanning plus gitleaks PR gate.
    target_refs: [comp-repo]
    citations: { nist: [SC-28, RA-5] }
  - id: VM-3
    name: Credential persistence disabled
    description: persist-credentials false on checkout steps.
    target_refs: [comp-workflows]
    citations: { nist: [AC-6, SC-28] }
  # Skill-runtime mitigations
  - id: M-OAUTH-URL
    name: Hardcoded authorization URL over HTTPS
    description: Authorization URL built from a hardcoded constant; user instructed to verify the URL bar.
    target_refs: [comp-mural]
    citations: { nist: [IA-2] }
  - id: M-STATE
    name: Enforced per-request state
    description: state generated and verified to bind the callback to the issuing request.
    target_refs: [comp-mural, comp-loopback]
    citations: { nist: [SC-8] }
  - id: M-PKCE
    name: PKCE code-verifier binding (S256)
    description: secrets.token_urlsafe(64) verifier; S256; never logged; in-process only.
    target_refs: [comp-mural]
    citations: { nist: [SC-12, SC-13] }
  - id: M-REDIRECT-ALLOWLIST
    name: Redirect-URI allow-list
    description: Loopback redirect URI validated against an allow-list before use.
    target_refs: [comp-loopback]
    citations: { nist: [SC-7] }
  - id: M-FILEPERMS
    name: 0600 credential-file mode enforcement
    description: _check_credential_file_perms enforces 0600 and refuses to load on widening.
    target_refs: [comp-tokencache]
    citations: { nist: [AC-6, SC-28] }
  - id: M-REDACT
    name: Centralized log redaction (_redact / _REDACT_KEYS)
    description: All loggable structures piped through _REDACT_KEYS; direct LOGGER on bodies forbidden.
    target_refs: [comp-logsink]
    citations: { nist: [AU-9] }
  - id: M-AUDIT-EVENTS
    name: Structured OAuth lifecycle audit events
    description: login_completed / token_refreshed / token_revoked emitted; correlate with Mural audit trail.
    target_refs: [comp-logsink]
    citations: { nist: [AU-2, AU-12] }
  - id: M-REVOKE-RUNBOOK
    name: Documented revocation runbook
    description: Skill SECURITY.md G-EOP-1 documents the Mural account-side revocation path.
    target_refs: [comp-mural]
    citations: { nist: [IR-4] }
  - id: M-CACHE-LOCK
    name: Cache-lock serialization + backoff
    description: _acquire_cache_lock serializes login/refresh; exponential backoff on retryable errors.
    target_refs: [comp-mural]
    citations: { nist: [SC-5] }
  - id: M-BACKOFF
    name: User-initiated login with backoff
    description: No automatic re-login per API call; documented login cadence.
    target_refs: [comp-mural]
    citations: { nist: [SC-5] }
  - id: M-SCOPE-HARDCODE
    name: Hardcoded least-privilege scope set
    description: Scope constructed from a hardcoded constant; destructive tools re-check granted scopes.
    target_refs: [comp-mural]
    citations: { nist: [AC-6] }
  - id: M-REDACT-JIRA
    name: Jira error-text redaction
    description: _redact_sensitive_text masks Bearer/Basic/Authorization and query-string secrets.
    target_refs: [comp-jira]
    citations: { nist: [AU-9] }
  - id: M-REDACT-GITLAB
    name: GitLab error-text redaction
    description: _redact masks PRIVATE-TOKEN/Authorization/cookies/query-string secrets.
    target_refs: [comp-gitlab]
    citations: { nist: [AU-9] }
  - id: M-URL-CANON
    name: Origin-only base-URL canonicalization
    description: Base URL reduced to origin; rejects userinfo, query, fragment, non-root paths, control chars.
    target_refs: [comp-jira, comp-gitlab]
    citations: { nist: [SC-7] }
  - id: M-NOREDIRECT
    name: No-redirect opener + HTTPS enforcement
    description: _NoRedirect opener refuses 30x; HTTPS enforced for non-loopback hosts.
    target_refs: [comp-jira, comp-gitlab, comp-tts]
    citations: { nist: [SC-7, SC-8] }
  - id: M-BODY-CAP
    name: Size-capped, fail-closed body reader
    description: MAX_BODY_BYTES-capped reads with JSON content-type fail-closed.
    target_refs: [comp-jira, comp-gitlab]
    citations: { nist: [SI-10] }
  - id: M-NO-ENV-DUMP
    name: No environment dump paths
    description: No code path prints os.environ; credentials read once into immutable/module state.
    target_refs: [comp-jira, comp-gitlab]
    citations: { nist: [AU-9] }
  - id: M-SSML-ESCAPE
    name: SSML XML-escaping
    description: Speaker notes XML-escaped / quoteattr-quoted before insertion into SSML.
    target_refs: [comp-tts]
    citations: { nist: [SI-10] }
  - id: M-SAFE-PARSE
    name: Safe YAML/OOXML parsing
    description: yaml.safe_load; python-pptx with external-entity resolution disabled.
    target_refs: [comp-tts]
    citations: { nist: [SI-10] }
  - id: M-PP-DENYLIST
    name: Denylist-constrained author Python execution
    description: content-extra.py is validated against a blocked-module and blocked-builtin denylist before execution.
    target_refs: [comp-powerpoint]
    citations: { nist: [AC-6, SI-10] }
  - id: M-PP-PDFBOUNDS
    name: PDF safety bounds before MuPDF parse
    description: File size, magic-byte prefix, and page-count checks reject obvious malformed PDFs before parsing.
    target_refs: [comp-powerpoint]
    citations: { nist: [SI-10] }
  - id: M-PP-ARGS
    name: Argument-list subprocess execution for converter invocations
    description: LibreOffice and export helpers are invoked with argument lists rather than shell strings.
    target_refs: [comp-powerpoint]
    citations: { nist: [SC-7] }
  - id: M-VG-TIMEOUT
    name: Wall-clock timeout around ffprobe / ffmpeg execution
    description: Each conversion invocation is bounded by a timeout so pathological media cannot run indefinitely.
    target_refs: [comp-videogif]
    citations: { nist: [SC-5] }
  - id: M-CC-ESCAPE
    name: YAML scalar escaping for downstream content
    description: dynamic card text is escaped and wrapped in quoted YAML scalars before emission.
    target_refs: [comp-customercards]
    citations: { nist: [SC-7] }
  - id: M-GS-CLI
    name: Strict gh CLI / GitHub API argument validation
    description: Owner, repo, branch, severity, and output format are validated before interpolation into gh calls.
    target_refs: [comp-ghscan]
    citations: { nist: [SA-11, SC-7] }
  - id: M-GS-ARGS
    name: Canonicalized branch and query handling
    description: The branch value is scoped to the ref query segment and treated as a constrained input.
    target_refs: [comp-ghscan]
    citations: { nist: [SC-7] }
  - id: M-VX-REGEX
    name: Anchored vulnerability-ID parsing for issue bodies
    description: Only first-cell vulnerability identifiers matching a strict regex are read from the issue body.
    target_refs: [comp-vex]
    citations: { nist: [SC-7] }
  - id: M-AX-ALLOWLIST
    name: Explicit target allow-list and operator-controlled egress policy
    description: The scanner operates against operator-chosen targets and should be constrained by an allow-list for sensitive environments.
    target_refs: [comp-accessibility]
    citations: { nist: [SC-7, SC-28] }
  - id: M-AX-TIMEOUT
    name: Browser run-time and resource bounds
    description: The scanner wrapper should enforce timeouts and process bounds for long-running targets.
    target_refs: [comp-accessibility]
    citations: { nist: [SC-5] }
  - id: M-SP-REVIEW
    name: Review-gated planning artifact generation
    description: Threat-model specs and generated outputs are reviewed before being treated as authoritative.
    target_refs: [comp-securityplanning]
    citations: { nist: [SA-11] }

abuse_cases:
  - id: abuse-01
    title: Malicious contributor smuggles hidden prompt instructions
    description: A contributor embeds adversarial instructions in a prompt artifact to steer Copilot for downstream consumers.
    actor: Malicious contributor
    objective: Manipulate Copilot behavior in consumer repositories.
    evil_user_story: As a contributor with PR access, I want to hide malicious instructions in a prompt artifact so that Copilot generates insecure code for everyone who consumes it.
    flow_ids: [flow-01]
    mitigation_ids: [AC-2, AC-3, CQ-2]
  - id: abuse-02
    title: Local attacker exfiltrates the Mural token cache
    description: A co-tenant reads the on-disk credential cache to obtain a long-lived non-rotated refresh token.
    actor: Local co-tenant / dotfile syncer
    objective: Obtain persistent delegated access to the victim's Mural workspace.
    evil_user_story: As a co-resident user on a shared dev host, I want to read the Mural token cache so that I can mint access tokens indefinitely until the victim manually revokes.
    flow_ids: [flow-10]
    mitigation_ids: [M-FILEPERMS, M-REVOKE-RUNBOOK]
  - id: abuse-03
    title: Attacker retargets a credential-bearing CLI via SSRF
    description: A crafted base URL retargets an authenticated Jira/GitLab request to an attacker origin to capture the token.
    actor: Environment-variable attacker
    objective: Capture the PAT by redirecting egress.
    evil_user_story: As an attacker who can set environment variables, I want to point the base URL at my server so that the CLI sends the PAT to me.
    flow_ids: [flow-11, flow-12]
    mitigation_ids: [M-URL-CANON, M-NOREDIRECT]
  - id: abuse-04
    title: Confidential narration egresses to an unexpected region
    description: An operator synthesizes confidential speaker notes without a classification gate, egressing content off-box.
    actor: Unwitting operator
    objective: (Unintended) disclosure of confidential content to a third-party region.
    evil_user_story: As an operator unaware of content sensitivity, I want to synthesize narration so that confidential text is sent to Azure Speech without a classification checkpoint.
    flow_ids: [flow-13]
    mitigation_ids: [M-NOREDIRECT]

security_test_cases:
  - id: test-01
    title: Dependency-pinning gate rejects unpinned Action
    description: A workflow referencing a tag instead of a SHA is rejected by Test-DependencyPinning.ps1.
    target_refs: [comp-workflows]
    test_type: negative-input
    expected_result: CI fails with an unpinned-dependency finding.
  - id: test-02
    title: Log redaction masks tokens and secrets
    description: Loggable structures containing access_token/refresh_token/client_secret are redacted.
    target_refs: [comp-logsink]
    test_type: negative-input
    expected_result: No sensitive value appears in emitted logs.
  - id: test-03
    title: OAuth state mismatch is rejected
    description: A callback with a mismatched state is refused and logged as a security event.
    target_refs: [comp-loopback]
    test_type: negative-input
    expected_result: Login aborts; state value is not logged.
  - id: test-04
    title: Base-URL canonicalization blocks SSRF
    description: A base URL with embedded userinfo, alternate host, or non-root path is rejected.
    target_refs: [comp-jira, comp-gitlab]
    test_type: negative-input
    expected_result: Request is refused before any credential is sent.
  - id: test-05
    title: Credential file refuses widened permissions
    description: A token cache file with permissions broader than 0600 is not loaded.
    target_refs: [comp-tokencache]
    test_type: negative-input
    expected_result: Load aborts with a permission error.
  - id: test-06
    title: SSML escaping neutralizes injected markup
    description: Speaker notes containing XML control characters are escaped before synthesis.
    target_refs: [comp-tts]
    test_type: negative-input
    expected_result: Synthesis request contains no injected SSML elements.

Requirements and compatibility

Written for: GitHub Copilot, Claude Code

Works with: Claude Code, Claude apps, OpenAI Codex, GitHub Copilot, Cursor, Gemini CLI, Kiro, OpenCode, Goose, Amp, Roo Code, JetBrains Junie, Factory Droid, Devin (ex-Windsurf), Mistral Vibe, OpenHands, Letta

“Works with” means the tool reads the open Agent Skills format; a skill written for one tool may use features others lack.

Needs: Claude Code frontmatter, Needs Python, Needs Node.js

The author says: Generation requires Python 3.11+ and uv. The native TM7 feedback loop additionally requires Windows with an interactive desktop session and the pinned Microsoft Threat Modeling Tool 7.3.51110.1.

Security

What our scanner noticed· Medium risk

Large base64-encoded blobs
Scripts that your agent may run

This skill includes scripts that your agent may run. Read them before you use it.

A static scan is not a guarantee. Skills are third-party content: review a skill before you let an agent use it.

Attribution and licence

Published by

Microsoft

Publisher

Microsoft (Official)

Source

microsoft/hve-core · .github/skills/project-planning/security-planning · commit f425e94

Licence

MIT License (redistribution allowed)

LICENSE (added by AutoGineer from LICENSE)
ATTRIBUTION.md (written by AutoGineer)

Synced

2026-11-09

AutoGineer is not affiliated with or endorsed by Microsoft or Microsoft.

Download ZIP

The ZIP holds the skill’s files, its licence files and an ATTRIBUTION.md. Download security-planning.zip

From the author

AutoGineer summary

What it does

When to use it

Advantages

Usage examples

Install

Documentation by Microsoft

Security Planning

When to use

Security plan drift analysis

TM7 generation workflow

Native TM7 visual feedback workflow

Agent-assisted visual review

Skill layout

Attribution

Files

tests/fixtures/comprehensive-spec.yaml

Requirements and compatibility

Security

Attribution and licence

Related skills

Security Audit

Sast Configuration

Firmware Analyst

Policy Enforcer

Backend Development Security Auditor

Memory Forensics

Download ZIP