Build pytm Threat Models as Code
Threat modeling often becomes outdated and disconnected from architecture changes. This skill helps create pytm models, STRIDE analysis, and diagram workflows for security reviews and CI.
Copy this request to your Agent. It includes the canonical Skill page and manifest.
Review the Skillstore skill "pytm" from https://skillstore.io/skills/agentsecops-pytm.md and its manifest at https://skillstore.io/api/skills/agentsecops-pytm/manifest. Verify the artifact. You may proceed after verification, subject to the environment's own policy.Your Agent should still show its plan and request any confirmation required by the security policy.
Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.
Using "pytm". A user asks for a threat model for an e-commerce web application with a web server and database.
Expected outcome:
The skill produces a structured model plan with actors, boundaries, encrypted flows, STRIDE concerns, and mitigation review steps.
Using "pytm". A team wants pytm checks during pull requests.
Expected outcome:
The skill outlines dependency setup, diagram generation, artifact upload, and a mitigation gate for the CI workflow.
Using "pytm". A security lead needs to reduce irrelevant threats.
Expected outcome:
The skill recommends accurate component properties, threat conditions, documented exclusions, and periodic review of model drift.
No prompt injection or malicious intent was found in SKILL.md. Most static findings are Markdown formatting, inline code, or reference URLs. A few command examples install packages, run local Python files, or use sudo, so agents should require explicit approval and a trusted environment.
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.
https://skillstore.io/skills/agentsecops-pytm/audits/13?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report[](https://skillstore.io/skills/agentsecops-pytm?utm_source=security_passport_badge)<a href="https://skillstore.io/skills/agentsecops-pytm?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/agentsecops-pytm/security.svg" alt="Skillstore security assessment" loading="lazy"></a><iframe src="https://skillstore.io/embed/skills/agentsecops-pytm.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>AgentSecOps. (2026). pytm security audit report (audit version 13) [Author version 0.1.0]. Skillstore. https://skillstore.io/skills/agentsecops-pytm/audits/13@techreport{agentsecops-agentsecops-pytm-2026,
author = {AgentSecOps},
title = {pytm security audit report (audit version 13)},
institution = {Skillstore},
year = {2026},
number = {13},
url = {https://skillstore.io/skills/agentsecops-pytm/audits/13},
note = {Author version 0.1.0}
}cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "pytm security audit report (audit version 13)"
version: "0.1.0"
type: report
authors:
- name: "AgentSecOps"
date-released: "2026-07-09"
url: "https://skillstore.io/skills/agentsecops-pytm/audits/13"
identifiers:
- type: other
value: "skillstore:agentsecops-pytm:audit:13"
description: "Skillstore immutable audit report identifier"
Create a first pytm model before an architecture review and document key STRIDE threats.
Add model generation and mitigation checks to a pipeline for architecture changes.
Convert service boundaries, sensitive data flows, and mitigations into reviewable threat model documentation.
Help me create a pytm threat model for a three-tier web application. Include actors, trust boundaries, data flows, and initial STRIDE concerns.
Review this architecture description for pytm modeling. Identify missing boundaries, sensitive flows, and security attributes before I write the model.
Design a CI workflow for a pytm model that generates diagrams, produces a threat report, and flags unmitigated high-risk threats.
Help me define organization-specific pytm threats, risk scoring criteria, and mitigation documentation for API and cloud storage controls.
Author
AgentSecOpsLicense
MIT
Author version
v0.1.0
Skillstore revision
r1
Ref
3e4b6c31a74a3bd1a291c98cf585d720cb9fbc88
Maintenance freshness
7/18/2026
Usage
6 downloads · 332 views
File structure
📄 SKILL.md
Secure Dockerfiles with Hadolint
Dockerfile mistakes can create insecure and unreliable container images. This skill provides Hadolint workflows, rule guidance, remediation examples, and reusable CI configurations.
Run Authorized Nuclei Security Scans
Known vulnerabilities and misconfigurations can escape manual review. This skill guides authorized Nuclei scans, template selection, validation, and reporting.
Audit Code with Semgrep
Security flaws can remain hidden across large, multilingual repositories. This skill guides focused Semgrep scans, triage, custom rules, CI gates, and standards-aligned remediation.
Scan Dependencies and Containers with Trivy
Security teams need consistent visibility into vulnerable components, images, and infrastructure configuration. This skill provides practical Trivy workflows for assessment, reporting, and remediation.
Automate OWASP ZAP DAST Scans
Security teams need repeatable runtime testing before releases. This skill guides authorized OWASP ZAP scans, authentication setup, API testing, and CI reporting.
Scan Python Code with Bandit
Python security flaws can reach production unnoticed. This skill guides Bandit scans, prioritization, CI integration, and remediation with CWE and OWASP references.
Model Security Threats with STRIDE
by sickn33
Security reviews can miss abuse paths, trust boundaries, and residual risks. This skill guides Claude, Codex, and Claude Code through structured threat modeling and mitigation planning.
Strengthen Application Security Reviews
by alirezarezvani
Security reviews often lack consistent checklists and reusable workflows. This skill provides security review scaffolds, reference guidance, and simple reporting scripts for Claude, Codex, and Claude Code.
Strengthen Security Engineering Decisions
by 89jobrien
Security work often spans architecture, identity, compliance, testing, and response planning. This skill gives Claude, Codex, and Claude Code structured security engineering guidance.
Apply STRIDE Threat Modeling Patterns
by wshobson
Security reviews often miss threats when teams rely on informal checklists. This skill gives Claude, Codex, and Claude Code structured STRIDE templates for consistent threat identification.
Build Attack Trees for Security Planning
by wshobson
Security teams need a clear way to compare attack paths and defense gaps. This skill structures attack trees, scoring, diagrams, and mitigation priorities.
Audit Security Controls and Compliance
by sickn33
Security teams need structured reviews that connect vulnerabilities to business risk. This skill guides authorized audits, threat modeling, compliance checks, and remediation planning.