tachi: Skill for Claude Code

tachi-threat-reporting

Narrative threat report domain knowledge extracted from the tachi threat-report agent. This skill provides the templates, construction rules, and reference examples that the threat-report agent uses to transform structured threat model output into comprehensive narrative reports with Mermaid attack trees.

Domain Overview

The threat report agent produces two output types:

1. threat-report.md -- A 7-section narrative report conforming to schemas/report.yaml containing executive summary, architecture overview, per-category threat analysis, cross-cutting themes, Mermaid attack trees, remediation roadmap, and finding reference appendix
2. attack-trees/{finding-id}-attack-tree.md -- Standalone Mermaid attack tree files for every Critical and High finding

Report generation applies three bodies of domain knowledge:

• Narrative Templates -- Structural patterns for each report section: executive summary elements, architecture overview layout, per-category subsection headers, per-finding narrative pattern, progressive depth rules, cross-cutting theme detection criteria, and language conventions
• Attack Tree Construction -- Rules for building Mermaid flowchart attack trees: tree structure (root/intermediate/leaf), minimum depth requirements, decomposition stopping rules, Mermaid syntax conventions, color styling, node naming, and validation checklist
• Attack Tree Examples -- Reference implementations demonstrating correct syntax, naming, gate logic, and decomposition depth for Critical and High severity patterns

Loading Table

Reference files are loaded on-demand by the threat-report agent at specific workflow phases using the Read tool.