OpenTide Threat Vector (TVM)

Why one skill handles both "intel" and "YAML"

Splitting "TI analysis" and "TVM authoring" into sibling skills creates ambiguous triggers. Threat Vector work is fundamentally intel -> structured hypothesis -> validated TVM YAML — keep upstream triage inside this skill under Phase A, then transition to Phase B. One deliverable lineage from signal intake to tvm:: artefacts.

Phase A — Intelligence structuring

Skip or shorten Phase A only when the user already has a definitive TVM brief or edits to an existing file.

Workflow