[External Plugin]: tmforge

[Hacks4Snacks]

Plugin name

tmforge

Short description

The Strider agent that comes with the tmforge plugin adds evidence-backed STRIDE threat modeling to GitHub Copilot, with structured risk assessment, deterministic validation, and Markdown reports. Optional tmforge integration supports creating, updating, and verifying Microsoft Threat Modeling Tool (.tm7) models.

GitHub repository

Hacks4Snacks/tmforge

Plugin path inside the repository

plugins/tmforge

Ref to review

v0.11.0

Commit SHA to review

8c22d85c4cb65f416c228bb2a73ae9f364aa549b

Version

0.11.0

License identifier

MIT

Author name

Mark Dalton Gray

Author URL

https://github.com/Hacks4Snacks

Homepage URL

https://github.com/Hacks4Snacks/tmforge/tree/main/plugins/tmforge

Keywords

data-flow-diagrams, risk-assessment, security-review, stride, strider, threat-modeling, threat-modeling-as-code, tm7, tmforge, trust-boundaries

Additional notes for reviewers

Agent Plugins 0.11.0 package with Strider and two skills. The workflow adds an evidence ledger, stable identities, complete STRIDE coverage checks, deterministic report rendering, and candidate validation for tmforge models. Python scripts use the standard library only. No hooks, bundled MCP servers, or embedded CLI binaries. A launcher downloads a version-pinned, checksum-verified CLI only after explicit user approval; normal use never downloads or changes global PATH. Markdown-only analysis requires no CLI download. The reviewed source is the nested plugin directory.

Submission checklist

• The plugin lives in a public GitHub repository.
• The ref and/or sha I provided is immutable (release tag and/or full 40-character commit SHA), not a branch.
• This submission follows this repository's contribution, security, and responsible AI policies.
• This plugin is not already listed in the Awesome Copilot marketplace.

[github-actions]

✅ External plugin intake passed

This submission passed automated intake validation and quality checks and is ready for maintainer review.

• Plugin: tmforge
• Repository: https://github.com/Hacks4Snacks/tmforge
• Ref: v0.11.0
• SHA: 8c22d85c4cb65f416c228bb2a73ae9f364aa549b

Reviewer signals

These are non-blocking heuristics for maintainer review; they are not evidence of misconduct or low quality.

Signal	Result
Repository age	59 day(s)
Repository activity	0 stars; 0 watchers; 0 forks
Repository counts	0 stars · 0 watchers · 0 forks · 8 open issues/PRs
Homepage heuristics	⚠️ pricing, checkout

Quality gate summary

Legend: ✅ pass · ⚠️ warning · 🛑 fail

Gate	Status
spec compliance (non-blocking)	✅ pass
vally lint	✅ pass
install smoke test	✅ pass
version match	✅ pass
ref/sha consistency	✅ pass
canvas structure	⚪ not_run

• spec compliance: pass
• vally lint: pass
• install smoke test: pass
• version match: pass
• ref/sha consistency: pass
• canvas structure: not_run
• overall: pass

spec compliance output (✅ pass)

Agent Plugins v1.0.0 manifest checks passed for plugin.json.

vally lint output (✅ pass)

✅ threat-modeling-tmforge (2/2 checks passed)
    ✓ [spec-compliance] All 1 skill(s) are spec-compliant.
        ✓ spec-compliance: All spec checks passed.
    ✓ [valid-refs] All file references across 1 skill(s) are valid.
        ✓ valid-refs: All file references resolve to existing files within the skill directory.
✅ threat-modeling (2/2 checks passed)
    ✓ [spec-compliance] All 1 skill(s) are spec-compliant.
        ✓ spec-compliance: All spec checks passed.
    ✓ [valid-refs] All file references across 1 skill(s) are valid.
        ✓ valid-refs: All file references resolve to existing files within the skill directory.

2 skill(s) linted, 2 passed

install smoke test output (✅ pass)

Install smoke test succeeded. Verified /tmp/external-plugin-quality-fMpXsO/copilot-home/.copilot/installed-plugins/external-plugin-intake/tmforge/plugin.json.

Version match output

- v0.11.0: matched version "0.11.0" at "plugins/tmforge/plugin.json".
- 8c22d85c4cb65f416c228bb2a73ae9f364aa549b: matched version "0.11.0" at "plugins/tmforge/plugin.json".

Ref/SHA consistency output

source.ref "v0.11.0" resolves to the same commit as source.sha "8c22d85c4cb65f416c228bb2a73ae9f364aa549b".

Canvas structure output

Canvas structure gate skipped because plugin is not tagged with "canvas".

Canonical external.json payload

{
  "name": "tmforge",
  "description": "The Strider agent that comes with the tmforge plugin adds evidence-backed STRIDE threat modeling to GitHub Copilot, with structured risk assessment, deterministic validation, and Markdown reports. Optional tmforge integration supports creating, updating, and verifying Microsoft Threat Modeling Tool (.tm7) models.",
  "version": "0.11.0",
  "author": {
    "name": "Mark Dalton Gray",
    "url": "https://github.com/Hacks4Snacks"
  },
  "repository": "https://github.com/Hacks4Snacks/tmforge",
  "homepage": "https://github.com/Hacks4Snacks/tmforge/tree/main/plugins/tmforge",
  "license": "MIT",
  "keywords": [
    "data-flow-diagrams",
    "risk-assessment",
    "security-review",
    "stride",
    "strider",
    "threat-modeling",
    "threat-modeling-as-code",
    "tm7",
    "tmforge",
    "trust-boundaries"
  ],
  "source": {
    "source": "github",
    "repo": "Hacks4Snacks/tmforge",
    "path": "plugins/tmforge",
    "ref": "v0.11.0",
    "sha": "8c22d85c4cb65f416c228bb2a73ae9f364aa549b"
  }
}

View workflow run