The Agent Skills Directory

Local Command Execution: The skill interacts with the Microsoft Threat Modeling Tool (TMT) by executing system commands through subprocess.run. This is used for the native harness and validation workflows on Windows systems to automate the generation and validation of threat models.
Dynamic Assembly Loading: The Deserialize-Tm7.ps1 script loads .NET assemblies from the local TMT installation using reflection to perform fidelity checks on generated models. This process is secured by a robust Authenticode signature verification step that ensures only binaries signed by the established publisher are loaded into the process.
Hardened XML Parsing: To protect against XML External Entity (XXE) vulnerabilities, the skill implements a fail-closed parsing policy using the defusedxml library and custom validation logic in tm7_threat_contract.py that rejects DTD or entity declarations.
Data Handling Considerations: The visual feedback loop captures screenshots and UI Automation traces of the threat modeling process. As identified in the skill's own SECURITY.md, these artifacts are stored locally and should be managed according to standard organizational data handling policies to prevent accidental disclosure of model details.

security-planning