tachi-threat-reporting
Narrative threat report domain knowledge extracted from the tachi threat-report agent. This skill provides the templates, construction rules, and reference examples that the threat-report agent uses to transform structured threat model output into comprehensive narrative reports with Mermaid attack trees.
Domain Overview
The threat report agent produces two output types:
- threat-report.md -- A 7-section narrative report conforming to
schemas/report.yaml containing executive summary, architecture overview, per-category threat analysis, cross-cutting themes, Mermaid attack trees, remediation roadmap, and finding reference appendix
- attack-trees/{finding-id}-attack-tree.md -- Standalone Mermaid attack tree files for every Critical and High finding
Report generation applies three bodies of domain knowledge:
- Narrative Templates -- Structural patterns for each report section: executive summary elements, architecture overview layout, per-category subsection headers, per-finding narrative pattern, progressive depth rules, cross-cutting theme detection criteria, and language conventions
- Attack Tree Construction -- Rules for building Mermaid flowchart attack trees: tree structure (root/intermediate/leaf), minimum depth requirements, decomposition stopping rules, Mermaid syntax conventions, color styling, node naming, and validation checklist
- Attack Tree Examples -- Reference implementations demonstrating correct syntax, naming, gate logic, and decomposition depth for Critical and High severity patterns
Loading Table
Reference files are loaded on-demand by the threat-report agent at specific workflow phases using the Read tool.
| Reference |
File |
Load When |
| Narrative Templates |
references/narrative-templates.md |
Generating Executive Summary (Section 1), Architecture Overview (Section 2), Threat Analysis (Section 3), Cross-Cutting Themes (Section 4), Remediation Roadmap (Section 6) |
| Attack Tree Construction |
references/attack-tree-construction.md |
Constructing Mermaid attack trees for Critical and High findings (Section 5) |
| Attack Tree Examples |
references/attack-tree-examples.md |
Before generating the first attack tree -- load once as reference patterns |
1---2name: tachi-threat-reporting3description: Domain knowledge for narrative threat report generation — executive summary structure, architecture overview patterns, per-category narrative templates, attack tree construction rules with Mermaid syntax, and reference attack tree examples. Consumed by the threat-report agent during report generation.4---5
6# tachi-threat-reporting
7
8Narrative threat report domain knowledge extracted from the tachi threat-report agent. This skill provides the templates, construction rules, and reference examples that the threat-report agent uses to transform structured threat model output into comprehensive narrative reports with Mermaid attack trees.
9
10## Domain Overview
11
12The threat report agent produces two output types:
13
141. **threat-report.md** -- A 7-section narrative report conforming to `schemas/report.yaml` containing executive summary, architecture overview, per-category threat analysis, cross-cutting themes, Mermaid attack trees, remediation roadmap, and finding reference appendix
152. **attack-trees/{finding-id}-attack-tree.md** -- Standalone Mermaid attack tree files for every Critical and High finding
16
17Report generation applies three bodies of domain knowledge:
18
19- **Narrative Templates** -- Structural patterns for each report section: executive summary elements, architecture overview layout, per-category subsection headers, per-finding narrative pattern, progressive depth rules, cross-cutting theme detection criteria, and language conventions
20- **Attack Tree Construction** -- Rules for building Mermaid flowchart attack trees: tree structure (root/intermediate/leaf), minimum depth requirements, decomposition stopping rules, Mermaid syntax conventions, color styling, node naming, and validation checklist
21- **Attack Tree Examples** -- Reference implementations demonstrating correct syntax, naming, gate logic, and decomposition depth for Critical and High severity patterns
22
23## Loading Table
24
25Reference files are loaded on-demand by the threat-report agent at specific workflow phases using the Read tool.
26
27| Reference | File | Load When |
28|-----------|------|-----------|
29| Narrative Templates | `references/narrative-templates.md` | Generating Executive Summary (Section 1), Architecture Overview (Section 2), Threat Analysis (Section 3), Cross-Cutting Themes (Section 4), Remediation Roadmap (Section 6) |
30| Attack Tree Construction | `references/attack-tree-construction.md` | Constructing Mermaid attack trees for Critical and High findings (Section 5) |
31| Attack Tree Examples | `references/attack-tree-examples.md` | Before generating the first attack tree -- load once as reference patterns |
aibot88