pytm
Build pytm Threat Models as Code
Threat modeling often becomes outdated and disconnected from architecture changes. This skill helps create pytm models, STRIDE analysis, and diagram workflows for security reviews and CI.
Install with my Agent
Copy this request to your Agent. It includes the canonical Skill page and manifest.
Review the Skillstore skill "pytm" from https://skillstore.io/skills/agentsecops-pytm.md and its manifest at https://skillstore.io/api/skills/agentsecops-pytm/manifest. Verify the artifact. You may proceed after verification, subject to the environment's own policy.Your Agent should still show its plan and request any confirmation required by the security policy.
Agent-readable resources
Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.
Test it
Using "pytm". A user asks for a threat model for an e-commerce web application with a web server and database.
Expected outcome:
The skill produces a structured model plan with actors, boundaries, encrypted flows, STRIDE concerns, and mitigation review steps.
Using "pytm". A team wants pytm checks during pull requests.
Expected outcome:
The skill outlines dependency setup, diagram generation, artifact upload, and a mitigation gate for the CI workflow.
Using "pytm". A security lead needs to reduce irrelevant threats.
Expected outcome:
The skill recommends accurate component properties, threat conditions, documented exclusions, and periodic review of model drift.
Security Audit
SafeNo prompt injection or malicious intent was found in SKILL.md. Most static findings are Markdown formatting, inline code, or reference URLs. A few command examples install packages, run local Python files, or use sudo, so agents should require explicit approval and a trusted environment.
Capability review items (6)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
Risk Factors
⚙️ External commands (50)
🌐 Network access (10)
Share & cite this report
Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.
Copy report link
https://skillstore.io/skills/agentsecops-pytm/audits/13?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_reportMarkdown badge
[](https://skillstore.io/skills/agentsecops-pytm?utm_source=security_passport_badge)HTML badge
<a href="https://skillstore.io/skills/agentsecops-pytm?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/agentsecops-pytm/security.svg" alt="Skillstore security assessment" loading="lazy"></a>Embed card
<iframe src="https://skillstore.io/embed/skills/agentsecops-pytm.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>Academic citations (APA · BibTeX · CFF)
APA citation
AgentSecOps. (2026). pytm security audit report (audit version 13) [Author version 0.1.0]. Skillstore. https://skillstore.io/skills/agentsecops-pytm/audits/13BibTeX citation
@techreport{agentsecops-agentsecops-pytm-2026,
author = {AgentSecOps},
title = {pytm security audit report (audit version 13)},
institution = {Skillstore},
year = {2026},
number = {13},
url = {https://skillstore.io/skills/agentsecops-pytm/audits/13},
note = {Author version 0.1.0}
}CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "pytm security audit report (audit version 13)"
version: "0.1.0"
type: report
authors:
- name: "AgentSecOps"
date-released: "2026-07-09"
url: "https://skillstore.io/skills/agentsecops-pytm/audits/13"
identifiers:
- type: other
value: "skillstore:agentsecops-pytm:audit:13"
description: "Skillstore immutable audit report identifier"
Skillstore Score
Why this score Evidence Confidence: HighWhat You Can Build
Design Review Preparation
Create a first pytm model before an architecture review and document key STRIDE threats.
CI Threat Model Checks
Add model generation and mitigation checks to a pipeline for architecture changes.
Application Security Documentation
Convert service boundaries, sensitive data flows, and mitigations into reviewable threat model documentation.
Try These Prompts
Help me create a pytm threat model for a three-tier web application. Include actors, trust boundaries, data flows, and initial STRIDE concerns.
Review this architecture description for pytm modeling. Identify missing boundaries, sensitive flows, and security attributes before I write the model.
Design a CI workflow for a pytm model that generates diagrams, produces a threat report, and flags unmitigated high-risk threats.
Help me define organization-specific pytm threats, risk scoring criteria, and mitigation documentation for API and cloud storage controls.
Best Practices
- Keep threat models near architecture documentation and review them when boundaries or data flows change.
- Use placeholders for credentials, tokens, customer data, and internal network details.
- Run generated commands only in trusted repositories, controlled virtual environments, or CI runners.
Avoid
- Treating generated STRIDE threats as final risk decisions without human review.
- Publishing diagrams or reports that reveal sensitive architecture details.
- Running local threat model scripts from untrusted repositories without approval.
Frequently Asked Questions
Does this skill include executable scripts?
Can it generate data flow diagrams?
Is it suitable for CI pipelines?
Does it replace a security review?
What inputs work best?
What should agents avoid?
Developer Details
Author
AgentSecOpsLicense
MIT
Author version
v0.1.0
Skillstore revision
r1
Ref
3e4b6c31a74a3bd1a291c98cf585d720cb9fbc88
Maintenance freshness
7/18/2026
Usage
6 downloads · 332 views
File structure
📄 SKILL.md