threat-hcl-new

You are creating a new Threatcl HCL threat model file. The argument string $ARGUMENTS is the model name (and optionally a short description after the first word group). If it's empty, ask the user for a name and stop.

1. Resolve the org slug

Run threatcl cloud whoami. Capture the org slug from the output — it goes into the backend block. If multiple orgs are listed, ask which one to scaffold for.

If whoami fails with an auth error, tell the user to run threatcl cloud login and stop. Don't try to write the file with a placeholder slug — threatcl cloud push will fail anyway.

2. Pick a filename

Slugify the model name to kebab-case and suffix with .tm.hcl (e.g. Payment Service → payment-service.tm.hcl). Write to the current working directory unless the user already has a threatmodels/ or models/ directory — in which case write there.

The .tm.hcl suffix is threatcl's convention and it matters for tooling: threatcl/drift-action discovers *.tm.hcl at the repo root (a bare root-level *.hcl is deliberately skipped so its own .threatcl-ci.hcl config is never mistaken for a model), and editors scope the threatcl lsp language server on the same suffix to avoid colliding with Terraform. The threatcl CLI itself accepts either.

If the chosen path already exists, stop and ask the user before overwriting.

3. Write the file

Use this template, filling in the org slug and model name:

spec_version = "0.8.0"

backend "threatcl-cloud" {
  organization = "<org-slug>"
  # threatmodel slug is added automatically on first `threatcl cloud push`
}

threatmodel "<Model Name>" {
  description = "<one-sentence description, from $ARGUMENTS or a sensible default>"
  author      = "<git config user.name, falling back to '@team'>"

  attributes {
    new_initiative  = "true"
    internet_facing = "false"
    initiative_size = "Medium"
  }

  # Add information_asset blocks for the data this system handles, e.g.
  # information_asset "user records" {
  #   description                = "Names, emails, hashed passwords"
  #   information_classification = "Confidential"
  # }

  # Add usecase blocks describing what the system is supposed to do.
  # usecase {
  #   description = "Customers sign in to view their account"
  # }

  # Sample threat — replace or expand. Reference library items with `ref`
  # when one applies (search with `threatcl cloud search -type threats`).
  threat "Example threat — replace me" {
    description = "Describe the threat in one or two sentences"
    impacts     = ["Confidentiality"]
    stride      = ["Info Disclosure"]

    control "Example control — replace me" {
      description    = "How this threat is mitigated"
      implemented    = false
      risk_reduction = 50
    }
  }
}