Conversation
… UAV template Integrates the AI-assisted threat modeling workflow proposed in discussion #31. All contributed scripts audited — no malware, no network calls, safe ast.literal_eval only. New modules: - threat_analysis/core/dsl_constants.py: single source of truth for all DSL enum values (42 keys), PROTOCOL_STYLE_ATTRS, SEVERITY_MULTIPLIER bounds - threat_analysis/validate.py: ThreatModelValidator — DSL enums, server types (including custom via asset_types_community.yaml), reference integrity, BOM files, YAML validity, submodel paths, severity multiplier range, English-only content - tests/test_dsl_constants.py: 7 tests - tests/test_validate_module.py: 10 tests (BOM multi-word names, custom types, etc.) CLI: - threat_analysis/__main__.py: early sys.argv dispatch for `secopstm validate` before argparse, zero risk of breaking existing flat-flag invocations Claude Code skill (.claude/skills/secopstm-threat-modeling/): - SKILL.md + 9 reference docs (bom-format, context-format, custom-asset-types, dsl-syntax, modeling-strategy, naming-conventions, output-structure, staging, workflow) - scripts/validate_model.py: thin wrapper delegating to threat_analysis.validate - scripts/generate_bom.py: BOM YAML generator from model.md - scripts/generate_context.py: GDAF context YAML generator Template: - threatModel_Template/UAV_Drone_System/: DJI Power Inspection drone model (15 servers, 8 boundaries, 10 BOM assets, GDAF context, custom asset types: uav_aircraft, ground_controller, gimbal_payload, cloud_fleet_management) validates with 0 failures Docs: - docs/dsl-syntax.md: complete DSL reference (598 lines) Co-Authored-By: zhangtianqi-james <zhangtianqi-james@users.noreply.github.com>
add documentation
…L, appsec-platform model threat_analysis/validate.py - _check_unused_boundaries() — détecte les frontières définies dans ## Boundaries mais non référencées par aucun serveur ni acteur (comble le gap entre le validateur CLI et model_validator.py runtime) - _run_check() helper — compteur de résultats précis (affiche 14/14 au lieu de 2/2) - _check_name_uniqueness() — détecte les noms dupliqués dans une même section DSL threat_analysis/__main__.py - Import de run_server déplacé à l'intérieur de main() — évite l'exécution de generate_config_files() lors de secopstm validate threat_analysis/generation/report_generator.py - generate_global_project_report() : propagation de context_config du modèle principal vers dummy_model — supprime le warning "no AI context keys" sur le rapport global projet .claude/skills/secopstm-threat-modeling/ - skill.md Step 6 : 8 clés AI context rendues obligatoires (system_description, sector, deployment_environment, data_sensitivity, internet_facing, user_base, compliance_requirements, integrations) - references/dsl-syntax.md : template ## Context mis à jour avec les 8 clés + exemple, authentication=client-certificate pour les flux SSH - scripts/generate_bom.py : types modernes ajoutés via DSL_ENUMS fallback, header Apache 2.0 - scripts/generate_context.py, scripts/validate_model.py : headers Apache 2.0 - scripts/requirements.txt : commentaire anglais docs/ - claude-code-skill.md : créé (prérequis, workflow 10 étapes, exemple prompt appsec-platform, structure de sortie, référence) - index.md : lien vers le skill ajouté
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Claude Code skill (
.claude/skills/secopstm-threat-modeling/) — 10-step workflowguiding an AI agent from information gathering to validation:
.tm-raw/staging,DSL generation, BOM/context YAML via scripts, custom types,
secopstm validate.Includes 10 reference files (DSL syntax, BOM format, context format, modeling strategy, …)
and 3 Python scripts (
generate_bom.py,generate_context.py,validate_model.py).secopstm validatesubcommand (threat_analysis/validate.py) — full CLI validator:DSL reference integrity (boundary/actor/from/to/data), enum values via
DSL_ENUMS,name uniqueness, submodel paths, BOM file presence, custom types/protocols config,
English output check. Adds unused-boundary detection (
_check_unused_boundaries) —closes the gap between the CLI validator and the runtime
model_validator.py.threat_analysis/core/dsl_constants.py— single source of truth forDSL_ENUMS(31 server types, protocols, authentication values, classification, machine…) and
DSL_SECTIONS. Consumed by the validator and skill scripts.report_generator.py— propagatecontext_configfrom the main model todummy_modelin
generate_global_project_report(), removing the "no AI context keys" warning onglobal project reports.
threatModel_Template/UAV_Drone_System/— complete reference model generated withthe skill: 15 servers, 8 boundaries, custom DJI types (
uav_aircraft,ground_controller,gimbal_payload,cloud_fleet_management), custom protocols (OcuSync 3, DJI O3 Enterprise),10 BOM files, GDAF context, 0 validation failures.
Docs (
docs/claude-code-skill.md,docs/dsl-syntax.md,docs/index.md) — userdocumentation for the skill with an appsec-platform example prompt
(18 servers, 69 GDAF scenarios, 0 failures).
Tests (
tests/test_dsl_constants.py,tests/test_validate_module.py) —62 + 189 assertions covering DSL_ENUMS and the CLI validator.
Test plan
secopstm validate --model-dir threatModel_Template/UAV_Drone_System→ 0 failurespython -m pytest tests/test_dsl_constants.py tests/test_validate_module.py -q→ greenpython -m threat_analysis --project appsec-platform/→ no "no AI context keys"warning on the global report