[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6AE9QFEE4NPQB6K835FEFRA":3,"skill-same:01M6AE9QFEE4NPQB6K835FEFRA":84},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":23,"publishedAt":43,"linkOnly":44,"markdownContent":45,"markdownBody":46,"frontMatter":47,"refName":48,"commitSha":49,"skillDirectory":50,"forksCount":51,"repositoryHtmlUrl":52,"repositoryHomepageUrl":53,"ownerHtmlUrl":54,"ownerBlogUrl":55,"ownerDescription":56,"updatedAt":57,"install":58,"resources":71},"01M6AE9QFEE4NPQB6K835FEFRA","tm7-threat-model",null,"Creates valid Microsoft Threat Modeling Tool (.tm7) files compatible with the Microsoft Threat Modeling Tool v7.3+. Use this skill whenever asked to create, generate, or modify a .tm7 threat model file, or when performing STRIDE threat modeling that should output a .tm7 file that opens cleanly in the Microsoft Threat Modeling Tool.","github\u002Fawesome-copilot","github","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F9919?v=4","01M6AC83DS133TPXFSP1DHNCC6","GitHub","01M6AD3PBDYPK7NVFJNJ66Y8RS",41046,"MIT","https:\u002F\u002Fgithub.com\u002Fgithub\u002Fawesome-copilot\u002Fblob\u002Fmain\u002Fskills\u002Ftm7-threat-model\u002FSKILL.md",[18],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发","SCENARIO","使用场景",[24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42],"threat model","tm7 threat model","threat","model","tool","when","performing","with","output","modeling","files","use","threat modeling","stride","file","generate","create","microsoft","valid","2026-11-10 10:12:30",false,"---\nname: tm7-threat-model\ndescription: 'Creates valid Microsoft Threat Modeling Tool (.tm7) files compatible with the Microsoft Threat Modeling Tool v7.3+. Use this skill whenever asked to create, generate, or modify a .tm7 threat model file, or when performing STRIDE threat modeling that should output a .tm7 file that opens cleanly in the Microsoft Threat Modeling Tool.'\n---\n\n# Microsoft Threat Modeling Tool (.tm7) Generator\n\nYou generate **valid `.tm7` files** for the Microsoft Threat Modeling Tool (v7.3+). A `.tm7`\nfile is **not** generic XML — it is a **WCF `DataContractSerializer`** document with an exact\nnamespace and element structure. If the structure is wrong, the tool refuses to open the file\nwith:\n\n> \"File is not an actual threat model or the threat model may be corrupted.\"\n\nYour job is to translate a described system (components, data stores, external actors, data\nflows, trust boundaries) into a diagram plus STRIDE threats, serialized in the exact `.tm7`\nformat described below.\n\n## Workflow\n\nWhen asked to produce a `.tm7` file:\n\n1. **Model the system.** Identify the elements:\n   - **Processes** (web apps, services, functions) → `StencilEllipse`, `GE.P`\n   - **Data stores** (databases, caches, queues, blobs) → `StencilParallelLines`, `GE.DS`\n   - **External interactors** (users, browsers, third-party systems) → `StencilRectangle`, `GE.EI`\n   - **Trust boundaries** → `BorderBoundary`, `GE.TB`\n   - **Data flows** connecting the above → `Connector`, `GE.DF`\n2. **Assign a unique lowercase UUID** (e.g. `148ade68-5c80-40f3-8e1f-4e2cabdb5991`) to every\n   stencil and every flow. Never use human-readable ids like `users-browser`.\n3. **Lay out coordinates** (`Left`\u002F`Top`\u002F`Width`\u002F`Height`) so stencils don't overlap.\n4. **Generate STRIDE threats** per interaction and place them in `\u003CThreatInstances>`.\n5. **Serialize** using the structure in this guide, mirroring `assets\u002Fexample-minimal.tm7`.\n6. **Validate** against the \"Common Mistakes\" checklist before returning the file.\n7. **Write the file with no XML declaration and no pretty-print indentation** (a single\n   continuous XML stream is what the serializer emits).\n\nAlways open [`assets\u002Fexample-minimal.tm7`](.\u002Fassets\u002Fexample-minimal.tm7) first and adapt it — reuse its exact\nserialization skeleton and only change stencil types, names, coordinates, flows, and threats.\n\n## CRITICAL: Serialization format\n\nTM7 files use **WCF `DataContractSerializer` XML**, not standard XML.\n\nThe file MUST start with this exact root element — **no `\u003C?xml?>` declaration**:\n\n```xml\n\u003CThreatModel xmlns=\"http:\u002F\u002Fschemas.datacontract.org\u002F2004\u002F07\u002FThreatModeling.Model\" xmlns:i=\"http:\u002F\u002Fwww.w3.org\u002F2001\u002FXMLSchema-instance\">\n```\n\n**NEVER use:**\n- `\u003C?xml version=\"1.0\" encoding=\"utf-8\"?>` — causes deserialization failure.\n- `xmlns:xsi` \u002F `xmlns:xsd` — these are standard XML namespaces, not DataContract namespaces.\n- Invented elements such as `\u003CSecurityGaps>` or `\u003CMitigations>` — they do not exist in the\n  TM7 schema.\n\n> **Note:** `\u003CMetaInformation>` (with children like `\u003COwner>`, `\u003CContributors>`,\n> `\u003CReviewer>`, `\u003CAssumptions>`, `\u003CExternalDependencies>`, `\u003CHighLevelSystemDescription>`,\n> `\u003CThreatModelName>`), `\u003CNotes>`, and `\u003CKnowledgeBase>` **are** part of the real schema and\n> are emitted by the tool — keep them (see the structure below and `assets\u002Fexample-minimal.tm7`).\n> Just don't invent elements that the tool never produces.\n\n## Required namespace prefixes\n\n| Prefix | URI | Used for |\n|--------|-----|----------|\n| (default) | `http:\u002F\u002Fschemas.datacontract.org\u002F2004\u002F07\u002FThreatModeling.Model` | Root `ThreatModel` |\n| `xmlns:i` | `http:\u002F\u002Fwww.w3.org\u002F2001\u002FXMLSchema-instance` | Type attributes |\n| `xmlns:z` | `http:\u002F\u002Fschemas.microsoft.com\u002F2003\u002F10\u002FSerialization\u002F` | Reference ids (`z:Id`) |\n| `xmlns:a` | `http:\u002F\u002Fschemas.microsoft.com\u002F2003\u002F10\u002FSerialization\u002FArrays` | Arrays \u002F collections |\n| `xmlns:b` | `http:\u002F\u002Fschemas.datacontract.org\u002F2004\u002F07\u002FThreatModeling.KnowledgeBase` | Stencil properties |\n| `xmlns:c` | `http:\u002F\u002Fwww.w3.org\u002F2001\u002FXMLSchema` | Primitive type values |\n\n## File structure (correct order)\n\nA full tool export contains, in this order: `DrawingSurfaceList`, `MetaInformation`, `Notes`,\n`ThreatInstances`, `ThreatMetaData` (often empty\u002Fself-closing), then the large generic\n`KnowledgeBase` as a **top-level sibling** (not nested inside `ThreatMetaData`), and finally\n`Profile`.\n\n```xml\n\u003CThreatModel xmlns=\"...\" xmlns:i=\"...\">\n  \u003CDrawingSurfaceList>\n    \u003CDrawingSurfaceModel z:Id=\"i1\" xmlns:z=\"...\">\n      \u003CGenericTypeId xmlns=\"...Abstracts\">DRAWINGSURFACE\u003C\u002FGenericTypeId>\n      \u003CGuid xmlns=\"...Abstracts\">{guid}\u003C\u002FGuid>\n      \u003CProperties xmlns=\"...Abstracts\" xmlns:a=\"...Arrays\">...\u003C\u002FProperties>\n      \u003CTypeId xmlns=\"...Abstracts\">DRAWINGSURFACE\u003C\u002FTypeId>\n      \u003CBorders xmlns:a=\"...Arrays\">\n        \u003C!-- Stencil elements: processes, data stores, external entities, boundaries -->\n      \u003C\u002FBorders>\n      \u003CLines xmlns:a=\"...Arrays\">\n        \u003C!-- Data flow lines connecting stencils -->\n      \u003C\u002FLines>\n      \u003CNotes xmlns:a=\"...Arrays\"\u002F>\n    \u003C\u002FDrawingSurfaceModel>\n  \u003C\u002FDrawingSurfaceList>\n  \u003CMetaInformation>\n    \u003C!-- Owner, Contributors, Reviewer, Assumptions, ThreatModelName, etc. -->\n  \u003C\u002FMetaInformation>\n  \u003CNotes xmlns:a=\"...Arrays\"\u002F>\n  \u003CThreatInstances>\n    \u003C!-- Threat entries -->\n  \u003C\u002FThreatInstances>\n  \u003CThreatMetaData\u002F>\n  \u003CKnowledgeBase z:Id=\"i21\" xmlns:a=\"...ThreatModeling.KnowledgeBase\" xmlns:z=\"...\">\n    \u003C!-- Generic SDL stencil\u002Fthreat catalog — top-level sibling of ThreatMetaData -->\n  \u003C\u002FKnowledgeBase>\n  \u003CProfile>\n    \u003CPromptedKb xmlns=\"\"\u002F>\n  \u003C\u002FProfile>\n\u003C\u002FThreatModel>\n```\n\n> The `\u003CKnowledgeBase>` (the generic SDL stencil\u002Fthreat catalog) is large but **required** —\n> the tool uses it to resolve every stencil `TypeId`. It is a **top-level sibling** placed after\n> `ThreatMetaData` and before `Profile`, **not** nested inside `ThreatMetaData`. Reuse it verbatim\n> from `assets\u002Fexample-minimal.tm7`; only add stencils whose `TypeId` already appears in that\n> KnowledgeBase.\n\n## Stencil elements\n\nEach stencil in `\u003CBorders>` is wrapped in `\u003Ca:KeyValueOfguidanyType>`:\n\n```xml\n\u003Ca:KeyValueOfguidanyType>\n  \u003Ca:Key>{guid}\u003C\u002Fa:Key>\n  \u003Ca:Value z:Id=\"i2\" i:type=\"StencilEllipse\">\n    \u003CGenericTypeId xmlns=\"...Abstracts\">GE.P\u003C\u002FGenericTypeId>\n    \u003CGuid xmlns=\"...Abstracts\">{guid}\u003C\u002FGuid>\n    \u003CProperties xmlns=\"...Abstracts\">\n      \u003Ca:anyType i:type=\"b:HeaderDisplayAttribute\" xmlns:b=\"...KnowledgeBase\">\n        \u003Cb:DisplayName>Web Application\u003C\u002Fb:DisplayName>\n        \u003Cb:Name\u002F>\n        \u003Cb:Value i:nil=\"true\"\u002F>\n      \u003C\u002Fa:anyType>\n      \u003Ca:anyType i:type=\"b:StringDisplayAttribute\" xmlns:b=\"...KnowledgeBase\">\n        \u003Cb:DisplayName>Name\u003C\u002Fb:DisplayName>\n        \u003Cb:Name\u002F>\n        \u003Cb:Value i:type=\"c:string\" xmlns:c=\"http:\u002F\u002Fwww.w3.org\u002F2001\u002FXMLSchema\">My Component\u003C\u002Fb:Value>\n      \u003C\u002Fa:anyType>\n      \u003C!-- Out Of Scope, Reason, configurable attributes -->\n    \u003C\u002FProperties>\n    \u003CTypeId xmlns=\"...Abstracts\">SE.P.TMCore.WebApp\u003C\u002FTypeId>\n    \u003CHeight xmlns=\"...Abstracts\">100\u003C\u002FHeight>\n    \u003CLeft xmlns=\"...Abstracts\">400\u003C\u002FLeft>\n    \u003CStrokeDashArray i:nil=\"true\" xmlns=\"...Abstracts\"\u002F>\n    \u003CStrokeThickness xmlns=\"...Abstracts\">1\u003C\u002FStrokeThickness>\n    \u003CTop xmlns=\"...Abstracts\">200\u003C\u002FTop>\n    \u003CWidth xmlns=\"...Abstracts\">100\u003C\u002FWidth>\n  \u003C\u002Fa:Value>\n\u003C\u002Fa:KeyValueOfguidanyType>\n```\n\n### Stencil shape types\n\n| Shape | `i:type` | `GenericTypeId` | Description |\n|-------|----------|-----------------|-------------|\n| Process (circle) | `StencilEllipse` | `GE.P` | Processes, web apps, services |\n| Data store (parallel lines) | `StencilParallelLines` | `GE.DS` | Databases, storage, caches |\n| External interactor (rectangle) | `StencilRectangle` | `GE.EI` | Users, external systems |\n| Trust boundary | `BorderBoundary` | `GE.TB` | Trust boundaries |\n\n### Common `TypeId` values (SDL TM knowledge base)\n\n| `TypeId` | Component |\n|----------|-----------|\n| `SE.P.TMCore.WebApp` | Web Application |\n| `SE.P.TMCore.AzureAppServiceWebApp` | Azure App Service Web App |\n| `SE.P.TMCore.AzureEventHub` | Azure Event Hub |\n| `SE.P.TMCore.DynamicsCRM` | Dynamics CRM |\n| `SE.DS.TMCore.SQL` | SQL Database |\n| `SE.DS.TMCore.AzureSQLDB` | Azure SQL Database |\n| `SE.EI.TMCore.Browser` | Browser |\n| `SE.EI.TMCore.Mobile` | Mobile Client |\n\n## Data flow lines\n\nLines in `\u003CLines>` also use `\u003Ca:KeyValueOfguidanyType>`, with `i:type=\"Connector\"`:\n\n```xml\n\u003Ca:KeyValueOfguidanyType>\n  \u003Ca:Key>{line-guid}\u003C\u002Fa:Key>\n  \u003Ca:Value z:Id=\"i10\" i:type=\"Connector\">\n    \u003CGenericTypeId xmlns=\"...Abstracts\">GE.DF\u003C\u002FGenericTypeId>\n    \u003CGuid xmlns=\"...Abstracts\">{line-guid}\u003C\u002FGuid>\n    \u003CProperties xmlns=\"...Abstracts\">...\u003C\u002FProperties>\n    \u003CTypeId xmlns=\"...Abstracts\">SE.DF.TMCore.Request\u003C\u002FTypeId>\n    \u003CHandleX xmlns=\"...Abstracts\">0\u003C\u002FHandleX>\n    \u003CHandleY xmlns=\"...Abstracts\">0\u003C\u002FHandleY>\n    \u003CSourceGuid xmlns=\"...Abstracts\">{source-stencil-guid}\u003C\u002FSourceGuid>\n    \u003CSourceX xmlns=\"...Abstracts\">0\u003C\u002FSourceX>\n    \u003CSourceY xmlns=\"...Abstracts\">0\u003C\u002FSourceY>\n    \u003CTargetGuid xmlns=\"...Abstracts\">{target-stencil-guid}\u003C\u002FTargetGuid>\n    \u003CTargetX xmlns=\"...Abstracts\">0\u003C\u002FTargetX>\n    \u003CTargetY xmlns=\"...Abstracts\">0\u003C\u002FTargetY>\n  \u003C\u002Fa:Value>\n\u003C\u002Fa:KeyValueOfguidanyType>\n```\n\n## Property attribute types\n\nProperties use typed `\u003Ca:anyType>` elements:\n\n| `i:type` | Purpose | Value |\n|----------|---------|-------|\n| `b:HeaderDisplayAttribute` | Section header | `i:nil=\"true\"` |\n| `b:StringDisplayAttribute` | Text value (Name, Reason) | `i:type=\"c:string\"` |\n| `b:BooleanDisplayAttribute` | Boolean (Out Of Scope) | `i:type=\"c:boolean\"` |\n| `b:ListDisplayAttribute` | Dropdown list | Has `\u003Cb:SelectedIndex>` |\n\n## Threat instances\n\nThreats go in `\u003CThreatInstances>` using `\u003Ca:KeyValueOfstringThreatpc_P0_PhOB>` (note the exact\n`PhOB` suffix). Unlike stencils, the threat `\u003Ca:Value>` fields are **`b:`-prefixed** (the\n`ThreatModeling.KnowledgeBase` namespace), and the `\u003Ca:Key>` is the literal concatenation\n`TH\u003Cid> + \u003CSourceGuid> + \u003CFlowGuid> + \u003CTargetGuid>`:\n\n```xml\n\u003CThreatInstances xmlns:a=\"...Arrays\">\n  \u003Ca:KeyValueOfstringThreatpc_P0_PhOB>\n    \u003Ca:Key>TH117{source-guid}{flow-guid}{target-guid}\u003C\u002Fa:Key>\n    \u003Ca:Value xmlns:b=\"...KnowledgeBase\">\n      \u003Cb:ChangedBy\u002F>\n      \u003Cb:DrawingSurfaceGuid>{drawing-surface-guid}\u003C\u002Fb:DrawingSurfaceGuid>\n      \u003Cb:FlowGuid>{flow-guid}\u003C\u002Fb:FlowGuid>\n      \u003Cb:Id>32\u003C\u002Fb:Id>\n      \u003Cb:InteractionKey>{source-guid}:{flow-guid}:{target-guid}\u003C\u002Fb:InteractionKey>\n      \u003Cb:InteractionString i:nil=\"true\"\u002F>\n      \u003Cb:ModifiedAt>2025-01-01T00:00:00\u003C\u002Fb:ModifiedAt>\n      \u003Cb:Priority>High\u003C\u002Fb:Priority>\n      \u003Cb:Properties>\n        \u003Ca:KeyValueOfstringstring>\n          \u003Ca:Key>Title\u003C\u002Fa:Key>\n          \u003Ca:Value>An adversary may spoof the user and gain access\u003C\u002Fa:Value>\n        \u003C\u002Fa:KeyValueOfstringstring>\n        \u003Ca:KeyValueOfstringstring>\n          \u003Ca:Key>UserThreatCategory\u003C\u002Fa:Key>\n          \u003Ca:Value>Spoofing\u003C\u002Fa:Value>\n        \u003C\u002Fa:KeyValueOfstringstring>\n        \u003Ca:KeyValueOfstringstring>\n          \u003Ca:Key>UserThreatShortDescription\u003C\u002Fa:Key>\n          \u003Ca:Value>Spoofing is when a process or entity is something other than its claimed identity.\u003C\u002Fa:Value>\n        \u003C\u002Fa:KeyValueOfstringstring>\n        \u003Ca:KeyValueOfstringstring>\n          \u003Ca:Key>PossibleMitigations\u003C\u002Fa:Key>\n          \u003Ca:Value>Enable multi-factor authentication and least-privilege access control.\u003C\u002Fa:Value>\n        \u003C\u002Fa:KeyValueOfstringstring>\n        \u003Ca:KeyValueOfstringstring>\n          \u003Ca:Key>Priority\u003C\u002Fa:Key>\n          \u003Ca:Value>High\u003C\u002Fa:Value>\n        \u003C\u002Fa:KeyValueOfstringstring>\n        \u003Ca:KeyValueOfstringstring>\n          \u003Ca:Key>SDLPhase\u003C\u002Fa:Key>\n          \u003Ca:Value>Design\u003C\u002Fa:Value>\n        \u003C\u002Fa:KeyValueOfstringstring>\n      \u003C\u002Fb:Properties>\n      \u003Cb:SourceGuid>{source-stencil-guid}\u003C\u002Fb:SourceGuid>\n      \u003Cb:State>Mitigated\u003C\u002Fb:State>\n      \u003Cb:StateInformation i:nil=\"true\"\u002F>\n      \u003Cb:TargetGuid>{target-stencil-guid}\u003C\u002Fb:TargetGuid>\n      \u003Cb:Title i:nil=\"true\"\u002F>\n      \u003Cb:TypeId>TH117\u003C\u002Fb:TypeId>\n      \u003Cb:Upgraded>false\u003C\u002Fb:Upgraded>\n      \u003Cb:Wide>false\u003C\u002Fb:Wide>\n    \u003C\u002Fa:Value>\n  \u003C\u002Fa:KeyValueOfstringThreatpc_P0_PhOB>\n\u003C\u002FThreatInstances>\n```\n\n**Every GUID must resolve:** `SourceGuid` and `TargetGuid` must equal `\u003Ca:Key>` values of real\nstencils in `\u003CBorders>`, and `FlowGuid` must equal the `\u003Ca:Key>` of a real connector in\n`\u003CLines>`. Dangling references produce a model that opens with missing diagram elements.\n\nUse the standard STRIDE categories for `UserThreatCategory`: **S**poofing, **T**ampering,\n**R**epudiation, **I**nformation Disclosure, **D**enial of Service, **E**levation of Privilege.\n\n## Common mistakes that break TM7 files\n\n1. **Adding an `\u003C?xml version=\"1.0\"?>` declaration** — `DataContractSerializer` does not emit one.\n2. **Using `xmlns:xsi` \u002F `xmlns:xsd`** instead of DataContract namespaces.\n3. **Using simple element names** like `\u003CBorder>`, `\u003CLine>`, `\u003CStencil>` — you must use the\n   DataContract wrapper types such as `\u003Ca:KeyValueOfguidanyType>`.\n4. **Inventing elements the tool never emits** like `\u003CSecurityGaps>` or `\u003CMitigations>` — these\n   are not in the schema. (`\u003CMetaInformation>`, `\u003CNotes>`, and `\u003CKnowledgeBase>` **are** valid\n   and must be preserved.)\n5. **Using human-readable GUIDs** like `users-browser` instead of real UUIDs\n   (e.g. `148ade68-5c80-40f3-8e1f-4e2cabdb5991`).\n6. **Dangling references** — a `Line`, threat `SourceGuid`\u002F`TargetGuid`, or threat `FlowGuid`\n   that points to a stencil\u002Fflow GUID that isn't actually defined in `\u003CBorders>`\u002F`\u003CLines>`.\n   Every reference must resolve to an included element.\n7. **Missing or duplicated `z:Id` reference attributes** — every serialized object needs a\n   `z:Id`, and each `z:Id` (e.g. `i1`, `i2`, `i10`) must be **unique** across the whole file.\n   When you duplicate a template block to add an element, always renumber its `z:Id` (and any\n   nested ones) to values not used elsewhere; reusing an id creates duplicate DataContract\n   object ids and makes deserialization fail.\n8. **Missing the `xmlns` on child elements** — each `GenericTypeId`, `Guid`, `Properties`,\n   `TypeId`, etc. must carry its own\n   `xmlns=\"http:\u002F\u002Fschemas.datacontract.org\u002F2004\u002F07\u002FThreatModeling.Model.Abstracts\"`.\n9. **Pretty-printing with indentation** — the correct output is a single continuous XML stream\n   with no added newlines or indentation inside the content.\n\n## Reference asset\n\nAlways use [`assets\u002Fexample-minimal.tm7`](.\u002Fassets\u002Fexample-minimal.tm7) in this skill's\ndirectory as the structural reference. It is a fully synthetic, sanitized export (no personal or\nproject data) that opens cleanly in the tool: two stencils connected by one data flow, with one\nSTRIDE threat whose every reference resolves. Adapt the stencil types, names, properties,\ncoordinates, data flows, and threats to the user's architecture, but **never** change the\nserialization format or namespace structure, and only use stencil `TypeId` values that already\nappear in its bundled `KnowledgeBase`. After generating, mentally diff your output's skeleton\nagainst the example to confirm every namespace, wrapper element, and GUID reference matches.\n","# Microsoft Threat Modeling Tool (.tm7) Generator\n\nYou generate **valid `.tm7` files** for the Microsoft Threat Modeling Tool (v7.3+). A `.tm7`\nfile is **not** generic XML — it is a **WCF `DataContractSerializer`** document with an exact\nnamespace and element structure. If the structure is wrong, the tool refuses to open the file\nwith:\n\n> \"File is not an actual threat model or the threat model may be corrupted.\"\n\nYour job is to translate a described system (components, data stores, external actors, data\nflows, trust boundaries) into a diagram plus STRIDE threats, serialized in the exact `.tm7`\nformat described below.\n\n## Workflow\n\nWhen asked to produce a `.tm7` file:\n\n1. **Model the system.** Identify the elements:\n   - **Processes** (web apps, services, functions) → `StencilEllipse`, `GE.P`\n   - **Data stores** (databases, caches, queues, blobs) → `StencilParallelLines`, `GE.DS`\n   - **External interactors** (users, browsers, third-party systems) → `StencilRectangle`, `GE.EI`\n   - **Trust boundaries** → `BorderBoundary`, `GE.TB`\n   - **Data flows** connecting the above → `Connector`, `GE.DF`\n2. **Assign a unique lowercase UUID** (e.g. `148ade68-5c80-40f3-8e1f-4e2cabdb5991`) to every\n   stencil and every flow. Never use human-readable ids like `users-browser`.\n3. **Lay out coordinates** (`Left`\u002F`Top`\u002F`Width`\u002F`Height`) so stencils don't overlap.\n4. **Generate STRIDE threats** per interaction and place them in `\u003CThreatInstances>`.\n5. **Serialize** using the structure in this guide, mirroring `assets\u002Fexample-minimal.tm7`.\n6. **Validate** against the \"Common Mistakes\" checklist before returning the file.\n7. **Write the file with no XML declaration and no pretty-print indentation** (a single\n   continuous XML stream is what the serializer emits).\n\nAlways open [`assets\u002Fexample-minimal.tm7`](.\u002Fassets\u002Fexample-minimal.tm7) first and adapt it — reuse its exact\nserialization skeleton and only change stencil types, names, coordinates, flows, and threats.\n\n## CRITICAL: Serialization format\n\nTM7 files use **WCF `DataContractSerializer` XML**, not standard XML.\n\nThe file MUST start with this exact root element — **no `\u003C?xml?>` declaration**:\n\n```xml\n\u003CThreatModel xmlns=\"http:\u002F\u002Fschemas.datacontract.org\u002F2004\u002F07\u002FThreatModeling.Model\" xmlns:i=\"http:\u002F\u002Fwww.w3.org\u002F2001\u002FXMLSchema-instance\">\n```\n\n**NEVER use:**\n- `\u003C?xml version=\"1.0\" encoding=\"utf-8\"?>` — causes deserialization failure.\n- `xmlns:xsi` \u002F `xmlns:xsd` — these are standard XML namespaces, not DataContract namespaces.\n- Invented elements such as `\u003CSecurityGaps>` or `\u003CMitigations>` — they do not exist in the\n  TM7 schema.\n\n> **Note:** `\u003CMetaInformation>` (with children like `\u003COwner>`, `\u003CContributors>`,\n> `\u003CReviewer>`, `\u003CAssumptions>`, `\u003CExternalDependencies>`, `\u003CHighLevelSystemDescription>`,\n> `\u003CThreatModelName>`), `\u003CNotes>`, and `\u003CKnowledgeBase>` **are** part of the real schema and\n> are emitted by the tool — keep them (see the structure below and `assets\u002Fexample-minimal.tm7`).\n> Just don't invent elements that the tool never produces.\n\n## Required namespace prefixes\n\n| Prefix | URI | Used for |\n|--------|-----|----------|\n| (default) | `http:\u002F\u002Fschemas.datacontract.org\u002F2004\u002F07\u002FThreatModeling.Model` | Root `ThreatModel` |\n| `xmlns:i` | `http:\u002F\u002Fwww.w3.org\u002F2001\u002FXMLSchema-instance` | Type attributes |\n| `xmlns:z` | `http:\u002F\u002Fschemas.microsoft.com\u002F2003\u002F10\u002FSerialization\u002F` | Reference ids (`z:Id`) |\n| `xmlns:a` | `http:\u002F\u002Fschemas.microsoft.com\u002F2003\u002F10\u002FSerialization\u002FArrays` | Arrays \u002F collections |\n| `xmlns:b` | `http:\u002F\u002Fschemas.datacontract.org\u002F2004\u002F07\u002FThreatModeling.KnowledgeBase` | Stencil properties |\n| `xmlns:c` | `http:\u002F\u002Fwww.w3.org\u002F2001\u002FXMLSchema` | Primitive type values |\n\n## File structure (correct order)\n\nA full tool export contains, in this order: `DrawingSurfaceList`, `MetaInformation`, `Notes`,\n`ThreatInstances`, `ThreatMetaData` (often empty\u002Fself-closing), then the large generic\n`KnowledgeBase` as a **top-level sibling** (not nested inside `ThreatMetaData`), and finally\n`Profile`.\n\n```xml\n\u003CThreatModel xmlns=\"...\" xmlns:i=\"...\">\n  \u003CDrawingSurfaceList>\n    \u003CDrawingSurfaceModel z:Id=\"i1\" xmlns:z=\"...\">\n      \u003CGenericTypeId xmlns=\"...Abstracts\">DRAWINGSURFACE\u003C\u002FGenericTypeId>\n      \u003CGuid xmlns=\"...Abstracts\">{guid}\u003C\u002FGuid>\n      \u003CProperties xmlns=\"...Abstracts\" xmlns:a=\"...Arrays\">...\u003C\u002FProperties>\n      \u003CTypeId xmlns=\"...Abstracts\">DRAWINGSURFACE\u003C\u002FTypeId>\n      \u003CBorders xmlns:a=\"...Arrays\">\n        \u003C!-- Stencil elements: processes, data stores, external entities, boundaries -->\n      \u003C\u002FBorders>\n      \u003CLines xmlns:a=\"...Arrays\">\n        \u003C!-- Data flow lines connecting stencils -->\n      \u003C\u002FLines>\n      \u003CNotes xmlns:a=\"...Arrays\"\u002F>\n    \u003C\u002FDrawingSurfaceModel>\n  \u003C\u002FDrawingSurfaceList>\n  \u003CMetaInformation>\n    \u003C!-- Owner, Contributors, Reviewer, Assumptions, ThreatModelName, etc. -->\n  \u003C\u002FMetaInformation>\n  \u003CNotes xmlns:a=\"...Arrays\"\u002F>\n  \u003CThreatInstances>\n    \u003C!-- Threat entries -->\n  \u003C\u002FThreatInstances>\n  \u003CThreatMetaData\u002F>\n  \u003CKnowledgeBase z:Id=\"i21\" xmlns:a=\"...ThreatModeling.KnowledgeBase\" xmlns:z=\"...\">\n    \u003C!-- Generic SDL stencil\u002Fthreat catalog — top-level sibling of ThreatMetaData -->\n  \u003C\u002FKnowledgeBase>\n  \u003CProfile>\n    \u003CPromptedKb xmlns=\"\"\u002F>\n  \u003C\u002FProfile>\n\u003C\u002FThreatModel>\n```\n\n> The `\u003CKnowledgeBase>` (the generic SDL stencil\u002Fthreat catalog) is large but **required** —\n> the tool uses it to resolve every stencil `TypeId`. It is a **top-level sibling** placed after\n> `ThreatMetaData` and before `Profile`, **not** nested inside `ThreatMetaData`. Reuse it verbatim\n> from `assets\u002Fexample-minimal.tm7`; only add stencils whose `TypeId` already appears in that\n> KnowledgeBase.\n\n## Stencil elements\n\nEach stencil in `\u003CBorders>` is wrapped in `\u003Ca:KeyValueOfguidanyType>`:\n\n```xml\n\u003Ca:KeyValueOfguidanyType>\n  \u003Ca:Key>{guid}\u003C\u002Fa:Key>\n  \u003Ca:Value z:Id=\"i2\" i:type=\"StencilEllipse\">\n    \u003CGenericTypeId xmlns=\"...Abstracts\">GE.P\u003C\u002FGenericTypeId>\n    \u003CGuid xmlns=\"...Abstracts\">{guid}\u003C\u002FGuid>\n    \u003CProperties xmlns=\"...Abstracts\">\n      \u003Ca:anyType i:type=\"b:HeaderDisplayAttribute\" xmlns:b=\"...KnowledgeBase\">\n        \u003Cb:DisplayName>Web Application\u003C\u002Fb:DisplayName>\n        \u003Cb:Name\u002F>\n        \u003Cb:Value i:nil=\"true\"\u002F>\n      \u003C\u002Fa:anyType>\n      \u003Ca:anyType i:type=\"b:StringDisplayAttribute\" xmlns:b=\"...KnowledgeBase\">\n        \u003Cb:DisplayName>Name\u003C\u002Fb:DisplayName>\n        \u003Cb:Name\u002F>\n        \u003Cb:Value i:type=\"c:string\" xmlns:c=\"http:\u002F\u002Fwww.w3.org\u002F2001\u002FXMLSchema\">My Component\u003C\u002Fb:Value>\n      \u003C\u002Fa:anyType>\n      \u003C!-- Out Of Scope, Reason, configurable attributes -->\n    \u003C\u002FProperties>\n    \u003CTypeId xmlns=\"...Abstracts\">SE.P.TMCore.WebApp\u003C\u002FTypeId>\n    \u003CHeight xmlns=\"...Abstracts\">100\u003C\u002FHeight>\n    \u003CLeft xmlns=\"...Abstracts\">400\u003C\u002FLeft>\n    \u003CStrokeDashArray i:nil=\"true\" xmlns=\"...Abstracts\"\u002F>\n    \u003CStrokeThickness xmlns=\"...Abstracts\">1\u003C\u002FStrokeThickness>\n    \u003CTop xmlns=\"...Abstracts\">200\u003C\u002FTop>\n    \u003CWidth xmlns=\"...Abstracts\">100\u003C\u002FWidth>\n  \u003C\u002Fa:Value>\n\u003C\u002Fa:KeyValueOfguidanyType>\n```\n\n### Stencil shape types\n\n| Shape | `i:type` | `GenericTypeId` | Description |\n|-------|----------|-----------------|-------------|\n| Process (circle) | `StencilEllipse` | `GE.P` | Processes, web apps, services |\n| Data store (parallel lines) | `StencilParallelLines` | `GE.DS` | Databases, storage, caches |\n| External interactor (rectangle) | `StencilRectangle` | `GE.EI` | Users, external systems |\n| Trust boundary | `BorderBoundary` | `GE.TB` | Trust boundaries |\n\n### Common `TypeId` values (SDL TM knowledge base)\n\n| `TypeId` | Component |\n|----------|-----------|\n| `SE.P.TMCore.WebApp` | Web Application |\n| `SE.P.TMCore.AzureAppServiceWebApp` | Azure App Service Web App |\n| `SE.P.TMCore.AzureEventHub` | Azure Event Hub |\n| `SE.P.TMCore.DynamicsCRM` | Dynamics CRM |\n| `SE.DS.TMCore.SQL` | SQL Database |\n| `SE.DS.TMCore.AzureSQLDB` | Azure SQL Database |\n| `SE.EI.TMCore.Browser` | Browser |\n| `SE.EI.TMCore.Mobile` | Mobile Client |\n\n## Data flow lines\n\nLines in `\u003CLines>` also use `\u003Ca:KeyValueOfguidanyType>`, with `i:type=\"Connector\"`:\n\n```xml\n\u003Ca:KeyValueOfguidanyType>\n  \u003Ca:Key>{line-guid}\u003C\u002Fa:Key>\n  \u003Ca:Value z:Id=\"i10\" i:type=\"Connector\">\n    \u003CGenericTypeId xmlns=\"...Abstracts\">GE.DF\u003C\u002FGenericTypeId>\n    \u003CGuid xmlns=\"...Abstracts\">{line-guid}\u003C\u002FGuid>\n    \u003CProperties xmlns=\"...Abstracts\">...\u003C\u002FProperties>\n    \u003CTypeId xmlns=\"...Abstracts\">SE.DF.TMCore.Request\u003C\u002FTypeId>\n    \u003CHandleX xmlns=\"...Abstracts\">0\u003C\u002FHandleX>\n    \u003CHandleY xmlns=\"...Abstracts\">0\u003C\u002FHandleY>\n    \u003CSourceGuid xmlns=\"...Abstracts\">{source-stencil-guid}\u003C\u002FSourceGuid>\n    \u003CSourceX xmlns=\"...Abstracts\">0\u003C\u002FSourceX>\n    \u003CSourceY xmlns=\"...Abstracts\">0\u003C\u002FSourceY>\n    \u003CTargetGuid xmlns=\"...Abstracts\">{target-stencil-guid}\u003C\u002FTargetGuid>\n    \u003CTargetX xmlns=\"...Abstracts\">0\u003C\u002FTargetX>\n    \u003CTargetY xmlns=\"...Abstracts\">0\u003C\u002FTargetY>\n  \u003C\u002Fa:Value>\n\u003C\u002Fa:KeyValueOfguidanyType>\n```\n\n## Property attribute types\n\nProperties use typed `\u003Ca:anyType>` elements:\n\n| `i:type` | Purpose | Value |\n|----------|---------|-------|\n| `b:HeaderDisplayAttribute` | Section header | `i:nil=\"true\"` |\n| `b:StringDisplayAttribute` | Text value (Name, Reason) | `i:type=\"c:string\"` |\n| `b:BooleanDisplayAttribute` | Boolean (Out Of Scope) | `i:type=\"c:boolean\"` |\n| `b:ListDisplayAttribute` | Dropdown list | Has `\u003Cb:SelectedIndex>` |\n\n## Threat instances\n\nThreats go in `\u003CThreatInstances>` using `\u003Ca:KeyValueOfstringThreatpc_P0_PhOB>` (note the exact\n`PhOB` suffix). Unlike stencils, the threat `\u003Ca:Value>` fields are **`b:`-prefixed** (the\n`ThreatModeling.KnowledgeBase` namespace), and the `\u003Ca:Key>` is the literal concatenation\n`TH\u003Cid> + \u003CSourceGuid> + \u003CFlowGuid> + \u003CTargetGuid>`:\n\n```xml\n\u003CThreatInstances xmlns:a=\"...Arrays\">\n  \u003Ca:KeyValueOfstringThreatpc_P0_PhOB>\n    \u003Ca:Key>TH117{source-guid}{flow-guid}{target-guid}\u003C\u002Fa:Key>\n    \u003Ca:Value xmlns:b=\"...KnowledgeBase\">\n      \u003Cb:ChangedBy\u002F>\n      \u003Cb:DrawingSurfaceGuid>{drawing-surface-guid}\u003C\u002Fb:DrawingSurfaceGuid>\n      \u003Cb:FlowGuid>{flow-guid}\u003C\u002Fb:FlowGuid>\n      \u003Cb:Id>32\u003C\u002Fb:Id>\n      \u003Cb:InteractionKey>{source-guid}:{flow-guid}:{target-guid}\u003C\u002Fb:InteractionKey>\n      \u003Cb:InteractionString i:nil=\"true\"\u002F>\n      \u003Cb:ModifiedAt>2025-01-01T00:00:00\u003C\u002Fb:ModifiedAt>\n      \u003Cb:Priority>High\u003C\u002Fb:Priority>\n      \u003Cb:Properties>\n        \u003Ca:KeyValueOfstringstring>\n          \u003Ca:Key>Title\u003C\u002Fa:Key>\n          \u003Ca:Value>An adversary may spoof the user and gain access\u003C\u002Fa:Value>\n        \u003C\u002Fa:KeyValueOfstringstring>\n        \u003Ca:KeyValueOfstringstring>\n          \u003Ca:Key>UserThreatCategory\u003C\u002Fa:Key>\n          \u003Ca:Value>Spoofing\u003C\u002Fa:Value>\n        \u003C\u002Fa:KeyValueOfstringstring>\n        \u003Ca:KeyValueOfstringstring>\n          \u003Ca:Key>UserThreatShortDescription\u003C\u002Fa:Key>\n          \u003Ca:Value>Spoofing is when a process or entity is something other than its claimed identity.\u003C\u002Fa:Value>\n        \u003C\u002Fa:KeyValueOfstringstring>\n        \u003Ca:KeyValueOfstringstring>\n          \u003Ca:Key>PossibleMitigations\u003C\u002Fa:Key>\n          \u003Ca:Value>Enable multi-factor authentication and least-privilege access control.\u003C\u002Fa:Value>\n        \u003C\u002Fa:KeyValueOfstringstring>\n        \u003Ca:KeyValueOfstringstring>\n          \u003Ca:Key>Priority\u003C\u002Fa:Key>\n          \u003Ca:Value>High\u003C\u002Fa:Value>\n        \u003C\u002Fa:KeyValueOfstringstring>\n        \u003Ca:KeyValueOfstringstring>\n          \u003Ca:Key>SDLPhase\u003C\u002Fa:Key>\n          \u003Ca:Value>Design\u003C\u002Fa:Value>\n        \u003C\u002Fa:KeyValueOfstringstring>\n      \u003C\u002Fb:Properties>\n      \u003Cb:SourceGuid>{source-stencil-guid}\u003C\u002Fb:SourceGuid>\n      \u003Cb:State>Mitigated\u003C\u002Fb:State>\n      \u003Cb:StateInformation i:nil=\"true\"\u002F>\n      \u003Cb:TargetGuid>{target-stencil-guid}\u003C\u002Fb:TargetGuid>\n      \u003Cb:Title i:nil=\"true\"\u002F>\n      \u003Cb:TypeId>TH117\u003C\u002Fb:TypeId>\n      \u003Cb:Upgraded>false\u003C\u002Fb:Upgraded>\n      \u003Cb:Wide>false\u003C\u002Fb:Wide>\n    \u003C\u002Fa:Value>\n  \u003C\u002Fa:KeyValueOfstringThreatpc_P0_PhOB>\n\u003C\u002FThreatInstances>\n```\n\n**Every GUID must resolve:** `SourceGuid` and `TargetGuid` must equal `\u003Ca:Key>` values of real\nstencils in `\u003CBorders>`, and `FlowGuid` must equal the `\u003Ca:Key>` of a real connector in\n`\u003CLines>`. Dangling references produce a model that opens with missing diagram elements.\n\nUse the standard STRIDE categories for `UserThreatCategory`: **S**poofing, **T**ampering,\n**R**epudiation, **I**nformation Disclosure, **D**enial of Service, **E**levation of Privilege.\n\n## Common mistakes that break TM7 files\n\n1. **Adding an `\u003C?xml version=\"1.0\"?>` declaration** — `DataContractSerializer` does not emit one.\n2. **Using `xmlns:xsi` \u002F `xmlns:xsd`** instead of DataContract namespaces.\n3. **Using simple element names** like `\u003CBorder>`, `\u003CLine>`, `\u003CStencil>` — you must use the\n   DataContract wrapper types such as `\u003Ca:KeyValueOfguidanyType>`.\n4. **Inventing elements the tool never emits** like `\u003CSecurityGaps>` or `\u003CMitigations>` — these\n   are not in the schema. (`\u003CMetaInformation>`, `\u003CNotes>`, and `\u003CKnowledgeBase>` **are** valid\n   and must be preserved.)\n5. **Using human-readable GUIDs** like `users-browser` instead of real UUIDs\n   (e.g. `148ade68-5c80-40f3-8e1f-4e2cabdb5991`).\n6. **Dangling references** — a `Line`, threat `SourceGuid`\u002F`TargetGuid`, or threat `FlowGuid`\n   that points to a stencil\u002Fflow GUID that isn't actually defined in `\u003CBorders>`\u002F`\u003CLines>`.\n   Every reference must resolve to an included element.\n7. **Missing or duplicated `z:Id` reference attributes** — every serialized object needs a\n   `z:Id`, and each `z:Id` (e.g. `i1`, `i2`, `i10`) must be **unique** across the whole file.\n   When you duplicate a template block to add an element, always renumber its `z:Id` (and any\n   nested ones) to values not used elsewhere; reusing an id creates duplicate DataContract\n   object ids and makes deserialization fail.\n8. **Missing the `xmlns` on child elements** — each `GenericTypeId`, `Guid`, `Properties`,\n   `TypeId`, etc. must carry its own\n   `xmlns=\"http:\u002F\u002Fschemas.datacontract.org\u002F2004\u002F07\u002FThreatModeling.Model.Abstracts\"`.\n9. **Pretty-printing with indentation** — the correct output is a single continuous XML stream\n   with no added newlines or indentation inside the content.\n\n## Reference asset\n\nAlways use [`assets\u002Fexample-minimal.tm7`](.\u002Fassets\u002Fexample-minimal.tm7) in this skill's\ndirectory as the structural reference. It is a fully synthetic, sanitized export (no personal or\nproject data) that opens cleanly in the tool: two stencils connected by one data flow, with one\nSTRIDE threat whose every reference resolves. Adapt the stencil types, names, properties,\ncoordinates, data flows, and threats to the user's architecture, but **never** change the\nserialization format or namespace structure, and only use stencil `TypeId` values that already\nappear in its bundled `KnowledgeBase`. After generating, mentally diff your output's skeleton\nagainst the example to confirm every namespace, wrapper element, and GUID reference matches.\n",{"name":5,"description":7},"main","5269f7ea2d6c3a9bfda5ed878b6726cf509121fd","skills\u002Ftm7-threat-model",5340,"https:\u002F\u002Fgithub.com\u002Fgithub\u002Fawesome-copilot","https:\u002F\u002Fawesome-copilot.github.com\u002F","https:\u002F\u002Fgithub.com\u002Fgithub","https:\u002F\u002Fgithub.com\u002Fabout","How people build software.","2026-11-11 13:41:32",{"source":8,"skillName":5,"commands":59,"prompt":69,"zipAvailable":70},[60,63,66],{"tool":61,"command":62},"npx","npx skills add github\u002Fawesome-copilot --skill tm7-threat-model",{"tool":64,"command":65},"bunx","bunx skills add github\u002Fawesome-copilot --skill tm7-threat-model",{"tool":67,"command":68},"pnpm","pnpm dlx skills add github\u002Fawesome-copilot --skill tm7-threat-model","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fgithub\u002Fawesome-copilot\u002Fblob\u002Fmain\u002Fskills\u002Ftm7-threat-model\u002FSKILL.md",true,[72,78],{"path":73,"resourceType":74,"resourceTypeDesc":75,"sizeBytes":76,"sourceHtmlUrl":77},"agents\u002Fopenai.yaml","REFERENCE","参考文档",144,"https:\u002F\u002Fgithub.com\u002Fhareki\u002Fdotfiles\u002Fblob\u002Fmain\u002Fagents\u002F.agents\u002Fskills\u002Fwayfinder\u002Fagents\u002Fopenai.yaml",{"path":79,"resourceType":80,"resourceTypeDesc":81,"sizeBytes":82,"sourceHtmlUrl":83},"assets\u002Fexample-minimal.tm7","ASSET","资产文件",1111365,"https:\u002F\u002Fgithub.com\u002Fgithub\u002Fawesome-copilot\u002Fblob\u002Fmain\u002Fskills\u002Ftm7-threat-model\u002Fassets\u002Fexample-minimal.tm7",[85,113,140,170,203,220],{"skillNo":86,"name":87,"nameZh":6,"description":88,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":89,"categories":90,"keywords":95,"publishedAt":43},"01M70KXZNX9ES38N2A8M58ZZMZ","supabase-rls-policies","Write, review, and test Supabase Row Level Security (RLS) policies so that one user cannot read or change another user's rows. Use when creating or changing tables, policies, views, or security definer functions in a Supabase project, when reviewing a migration that touches RLS, or when asked to prove user isolation with pgTAP tests that sign in as two users.","https:\u002F\u002Fgithub.com\u002Fgithub\u002Fawesome-copilot\u002Fblob\u002Fmain\u002Fskills\u002Fsupabase-rls-policies\u002FSKILL.md",[91,94],{"categoryNo":92,"categoryName":93,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000008","测试与质量",{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[96,97,98,99,100,29,101,102,103,104,105,106,107,108,109,110,35,111,112,31],"supabase","rls","supabase rls","supabase rls policies","project","review","change","read","write","security","isolation","tables","as","tests","prove","users","functions",{"skillNo":114,"name":115,"nameZh":6,"description":116,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":117,"categories":118,"keywords":120,"publishedAt":43},"01M70KWA5YWXDV6V8DZ19E3T2Y","skill-distribution-audit","Audit a skill collection before release or investigate installer omissions, archived\u002Ftemplate leakage, duplicate identities, and manifest drift. Reconcile the intended public source set, distribution manifest, and actual discovery output for a specified consumer version. Includes a deterministic set-comparison helper.","https:\u002F\u002Fgithub.com\u002Fgithub\u002Fawesome-copilot\u002Fblob\u002Fmain\u002Fskills\u002Fskill-distribution-audit\u002FSKILL.md",[119],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[121,122,123,124,125,126,127,128,129,130,131,132,133,134,32,135,136,137,138,139],"distribution","skill distribution audit","audit","SET","deterministic","installer","for","discovery","comparison","helper","manifest","version","collection","drift","investigate","duplicate","template","release","reconcile",{"skillNo":141,"name":142,"nameZh":6,"description":143,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":144,"sourceHtmlUrl":145,"categories":146,"keywords":152,"publishedAt":43},"01M70KCJPFVW7PPQ49CC5R8JGK","logicapps-custom-code-net10-migration","Migrate Azure Logic Apps Standard local-function custom-code projects from .NET 8 to .NET 10. Use for legacy Logic Apps custom-code workspace upgrades, project\u002Fpackage configuration, custom-worker settings, publication, and integrated VS Code debugging. Not for ordinary .NET applications, standalone Azure Functions, Consumption workflows, or cloud deployment.","https:\u002F\u002Fgithub.com\u002Fgithub\u002Fawesome-copilot\u002Fblob\u002Fmain\u002Fskills\u002Flogicapps-custom-code-net10-migration\u002FLICENSE","https:\u002F\u002Fgithub.com\u002Fgithub\u002Fawesome-copilot\u002Fblob\u002Fmain\u002Fskills\u002Flogicapps-custom-code-net10-migration\u002FSKILL.md",[147],{"categoryNo":148,"categoryName":149,"taxonomyType":150,"taxonomyTypeDesc":151},"01JBSEEDCAT000000000000030","开发工程师","PROFESSION","适用职业",[153,154,155,156,157,158,127,100,159,160,161,162,163,164,165,35,166,167,168,169],"custom","code","logicapps custom code net10 migration","migration","projects","standalone","deployment","applications","local","azure","worker","upgrades","package","apps","Legacy","debugging","workflows",{"skillNo":171,"name":172,"nameZh":6,"description":173,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":174,"sourceHtmlUrl":175,"categories":176,"keywords":181,"publishedAt":43},"01M6AEBN37RQMXJ3298PEY7PG1","winmd-api-search","Find and explore Windows desktop APIs. Use when building features that need platform capabilities — camera, file access, notifications, UI controls, AI\u002FML, sensors, networking, etc. Discovers the right API for a task and retrieves full type details (methods, properties, events, enumeration values).","https:\u002F\u002Fgithub.com\u002Fgithub\u002Fawesome-copilot\u002Fblob\u002Fmain\u002Fskills\u002Fwinmd-api-search\u002FLICENSE.txt","https:\u002F\u002Fgithub.com\u002Fgithub\u002Fawesome-copilot\u002Fblob\u002Fmain\u002Fskills\u002Fwinmd-api-search\u002FSKILL.md",[177,180],{"categoryNo":178,"categoryName":179,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000010","后端与接口",{"categoryNo":148,"categoryName":149,"taxonomyType":150,"taxonomyTypeDesc":151},[182,183,184,185,186,187,188,189,190,38,191,192,193,194,195,29,196,197,198,199,200,127,201,202],"winmd api search","search","api","windows","desktop","file access","enumeration","ui","ml","networking","capabilities","notifications","explore","access","features","full","camera","events","platform","methods","controls",{"skillNo":204,"name":205,"nameZh":6,"description":206,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":207,"licenseFileUrl":208,"sourceHtmlUrl":209,"categories":210,"keywords":216,"publishedAt":43},"01M6AE571R3SC1ZGE202B3NB5S","resemble-detect","Deepfake detection and media safety — detect AI-generated audio, images, video, and text, trace synthesis sources, apply watermarks, verify speaker identity, and analyze media intelligence using Resemble AI","Apache-2.0","https:\u002F\u002Fgithub.com\u002Fgithub\u002Fawesome-copilot\u002Fblob\u002Fmain\u002Fskills\u002Fresemble-detect\u002FLICENSE","https:\u002F\u002Fgithub.com\u002Fgithub\u002Fawesome-copilot\u002Fblob\u002Fmain\u002Fskills\u002Fresemble-detect\u002FSKILL.md",[211,212,215],{"categoryNo":178,"categoryName":179,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":213,"categoryName":214,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000016","图像与多媒体",{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[217,124,38,218,219],"resemble detect","https","identity",{"skillNo":221,"name":222,"nameZh":6,"description":223,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":207,"licenseFileUrl":224,"sourceHtmlUrl":225,"categories":226,"keywords":231,"publishedAt":43},"01M6AE30BSK2HCY4TQQ22Z8JRD","quality-playbook","Run a complete quality engineering audit on any codebase. Derives behavioral requirements from the code, generates spec-traced functional tests, runs a three-pass code review with regression tests, executes a multi-model spec audit (Council of Three), and produces a consolidated bug report with TDD-verified patches. Finds the 35% of real defects that structural code review alone cannot catch. Works with any language. Trigger on 'quality playbook', 'spec audit', 'Council of Three', 'fitness-to-purpose', or 'coverage theater'.","https:\u002F\u002Fgithub.com\u002Fgithub\u002Fawesome-copilot\u002Fblob\u002Fmain\u002Fskills\u002Fquality-playbook\u002FLICENSE.txt","https:\u002F\u002Fgithub.com\u002Fgithub\u002Fawesome-copilot\u002Fblob\u002Fmain\u002Fskills\u002Fquality-playbook\u002FSKILL.md",[227,230],{"categoryNo":228,"categoryName":229,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000007","代码审查",{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[232,233,234,235,154,101,9,123,236,237,218,238,239,240,241,242,243,244,245,246,247,248,109,249,27,250,251],"playbook","quality playbook","quality","code review","tdd","run","report","spec","bug report","council","engineering","functional","spec audit","bug","verified","multi-model","three","coverage","regression","structural"]