From 6e91575976d24cf91063cb734b22f710815bc9b4 Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" <41898282+github-actions[bot]@users.noreply.github.com> Date: Wed, 23 Sep 2026 13:37:30 +0000 Subject: [PATCH 1/2] Add ThreatSpec extension to community catalog Add threatspec extension submitted by @hupe1980 to:\n- extensions/catalog.community.json (alphabetical order)\n- docs/community/extensions.md community extensions table\n\nCloses #4660\n\nAssisted-by: GitHub Copilot (model: gpt-5.2-codex, autonomous)\nCo-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --- docs/community/extensions.md | 1 + extensions/catalog.community.json | 52 ++++++++++++++++++++++++++++++- 2 files changed, 52 insertions(+), 1 deletion(-) diff --git a/docs/community/extensions.md b/docs/community/extensions.md index 174d5ad5ce..ea866ccc91 100644 --- a/docs/community/extensions.md +++ b/docs/community/extensions.md @@ -180,6 +180,7 @@ The following community-contributed extensions are available in [`catalog.commun | TDD Extension | Drives spec-kit implementation with tests: a language-agnostic red-green-refactor loop with a per-feature test list, recorded red and green evidence, and mutation-checked test strength. | `process` | Read+Write | [spec-kit-tdd](https://github.com/d0whc3r/spec-kit-tdd) | | Team Assign | Assign tasks.md items to human engineers, split into subtasks, and generate a per-engineer workboard | `process` | Read+Write | [spec-kit-team-assign](https://github.com/tarunkumarbhati/spec-kit-team-assign) | | Test Coverage Drift Control | Generate incremental coverage drift reports and planned remediation tasks after implementation | `code` | Read+Write | [spec-kit-test-coverage-drift-control](https://github.com/benizzio/spec-kit-test-coverage-drift-control) | +| ThreatSpec | STRIDE and AI/ML threat modeling with threat-to-test traceability and security convergence | `process` | Read+Write | [spec-kit-threatspec](https://github.com/hupe1980/spec-kit-threatspec) | | Time Machine | Retroactively apply the full SDD workflow to existing codebases — analyse, spec, and ship feature-by-feature | `process` | Read+Write | [spec-kit-time-machine](https://github.com/teeyo/spec-kit-time-machine) | | TinySpec | Lightweight single-file workflow for small tasks — skip the heavy multi-step SDD process | `process` | Read+Write | [spec-kit-tinyspec](https://github.com/Quratulain-bilal/spec-kit-tinyspec) | | Token Budget | Reduces LLM token consumption in Spec Kit workflows: compact artifacts in-place, scope per-phase reading, suppress prose padding, and report token usage | `process` | Read+Write | [spec-kit-token-budget](https://github.com/tinesoft/spec-kit-token-budget) | diff --git a/extensions/catalog.community.json b/extensions/catalog.community.json index 4822c6b514..2e2d32de48 100644 --- a/extensions/catalog.community.json +++ b/extensions/catalog.community.json @@ -1,6 +1,6 @@ { "schema_version": "1.0", - "updated_at": "2026-09-18T00:00:00Z", + "updated_at": "2026-09-23T00:00:00Z", "catalog_url": "https://raw.githubusercontent.com/github/spec-kit/main/extensions/catalog.community.json", "extensions": { "adrkit": { @@ -5781,6 +5781,56 @@ "created_at": "2026-04-25T00:00:00Z", "updated_at": "2026-04-25T00:00:00Z" }, + "threatspec": { + "name": "ThreatSpec — Threat Modeling & Security Traceability", + "id": "threatspec", + "description": "STRIDE and AI/ML threat modeling with threat-to-test traceability and security convergence", + "author": "hupe1980", + "version": "0.1.0", + "download_url": "https://github.com/hupe1980/spec-kit-threatspec/archive/refs/tags/v0.1.0.zip", + "sha256": "6003b667e01e51a4637e4b6c2f2cea644674449f5bd2e7ed9301d3459a5a9c40", + "repository": "https://github.com/hupe1980/spec-kit-threatspec", + "homepage": "https://github.com/hupe1980/spec-kit-threatspec", + "documentation": "https://github.com/hupe1980/spec-kit-threatspec/blob/main/README.md", + "changelog": "https://github.com/hupe1980/spec-kit-threatspec/blob/main/CHANGELOG.md", + "license": "MIT", + "category": "process", + "effect": "read-write", + "requires": { + "speckit_version": ">=1.0.0", + "tools": [ + { + "name": "python", + "version": ">=3.8", + "required": true + }, + { + "name": "uv", + "required": false + }, + { + "name": "jsonschema", + "required": false + } + ] + }, + "provides": { + "commands": 3, + "hooks": 7 + }, + "tags": [ + "security", + "threat-modeling", + "llm", + "agentic", + "traceability" + ], + "verified": false, + "downloads": 0, + "stars": 0, + "created_at": "2026-09-23T00:00:00Z", + "updated_at": "2026-09-23T00:00:00Z" + }, "tldr": { "name": "Spec Kit TLDR", "id": "tldr", From 9a91a51ac541d389a1e333440ee33edbe488040a Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Wed, 23 Sep 2026 16:16:08 +0000 Subject: [PATCH 2/2] Add PyYAML requirement to ThreatSpec catalog entry Co-authored-by: KSchlobohm <23503973+KSchlobohm@users.noreply.github.com> --- extensions/catalog.community.json | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/extensions/catalog.community.json b/extensions/catalog.community.json index 2e2d32de48..490a173b9c 100644 --- a/extensions/catalog.community.json +++ b/extensions/catalog.community.json @@ -5804,6 +5804,10 @@ "version": ">=3.8", "required": true }, + { + "name": "pyyaml", + "required": true + }, { "name": "uv", "required": false