torusguard 2.1.1 → 2.1.3

package/skills/torusguard/payload/scripts/stride_generator.py

@@ -0,0 +1,196 @@
+#!/usr/bin/env python3
+"""
+TorusGuard STRIDE Threat Modeling & Data Flow Diagram (DFD) Synthesizer
+Automatically maps application entry points, trust boundaries, and datastores to generate
+interactive Mermaid DFDs and structured STRIDE risk registers for security compliance.
+"""
+
+import os
+import re
+import json
+from pathlib import Path
+from typing import Dict, List, Set, Any
+
+
+def discover_architecture_components(root_dir: Path) -> Dict[str, Any]:
+    entrypoints = []
+    datastores = set()
+    external_sinks = set()
+    trust_boundaries = ["Public Internet", "API Perimeter / DMZ", "Protected Core Services", "Isolated Data Tier"]
+
+    skip_dirs = {"node_modules", ".git", ".torusguard", "dist", "build", ".next", "__pycache__"}
+
+    # Patterns for HTTP routes
+    route_patterns = [
+        re.compile(r"""(?:app|router|server)\.(get|post|put|delete|patch)\s*\(\s*['"]([^'"]+)['"]"""),
+        re.compile(r"""@(?:app|router)\.(get|post|put|delete|patch)\s*\(\s*['"]([^'"]+)['"]"""),
+        re.compile(r"""http\.HandleFunc\s*\(\s*['"]([^'"]+)['"]"""),
+    ]
+
+    # Patterns for datastores & sinks
+    db_patterns = [
+        (re.compile(r"""(?i)(postgres|pg|prisma|typeorm|sequelize)"""), "PostgreSQL / Relational DB"),
+        (re.compile(r"""(?i)(mongo|mongoose)"""), "MongoDB / Document Store"),
+        (re.compile(r"""(?i)(redis|ioredis)"""), "Redis / In-Memory Cache"),
+        (re.compile(r"""(?i)(sqlite|sqlite3)"""), "SQLite / Local DB"),
+    ]
+
+    sink_patterns = [
+        (re.compile(r"""(?i)(stripe|paypal)"""), "Payment Gateway (Stripe/PayPal)"),
+        (re.compile(r"""(?i)(openai|anthropic|bedrock)"""), "AI LLM Provider (OpenAI/Anthropic)"),
+        (re.compile(r"""(?i)(aws-sdk|boto3|s3)"""), "Cloud Storage (AWS S3)"),
+        (re.compile(r"""(?i)(sendgrid|nodemailer|twilio)"""), "Communication Gateway (Twilio/SendGrid)"),
+    ]
+
+    for root, dirs, files in os.walk(root_dir):
+        dirs[:] = [d for d in dirs if d not in skip_dirs]
+        for f in files:
+            ext = os.path.splitext(f)[1].lower()
+            if ext not in {".js", ".jsx", ".ts", ".tsx", ".py", ".go"}:
+                continue
+            file_path = Path(root) / f
+            try:
+                content = file_path.read_text(encoding="utf-8", errors="ignore")
+                rel_path = file_path.relative_to(root_dir).as_posix()
+
+                # Find routes
+                for pat in route_patterns:
+                    for method, path in pat.findall(content):
+                        entrypoints.append({
+                            "method": method.upper(),
+                            "path": path,
+                            "file": rel_path
+                        })
+
+                # Find DBs
+                for pat, name in db_patterns:
+                    if pat.search(content):
+                        datastores.add(name)
+
+                # Find Sinks
+                for pat, name in sink_patterns:
+                    if pat.search(content):
+                        external_sinks.add(name)
+
+            except Exception:
+                continue
+
+    return {
+        "entrypoints": entrypoints[:25],
+        "total_routes_detected": len(entrypoints),
+        "datastores": sorted(datastores) if datastores else ["Internal SQLite / Local Memory Store"],
+        "external_sinks": sorted(external_sinks) if external_sinks else ["Standard Outbound HTTPS Sinks"],
+        "trust_boundaries": trust_boundaries
+    }
+
+
+def generate_mermaid_dfd(components: Dict[str, Any]) -> str:
+    lines = [
+        "```mermaid",
+        "flowchart TB",
+        "    subgraph Zone1 [Public Internet / Client Tier]",
+        "        User([Web / Mobile Client])",
+        "        Attacker([Adversarial Threat Actor])",
+        "    end",
+        "",
+        "    subgraph Zone2 [API Perimeter & Trust Boundary]",
+        "        Gateway[API Gateway / Router Handlers]"
+    ]
+
+    for i, ep in enumerate(components["entrypoints"][:4]):
+        lines.append(f"        Route_{i}[{ep['method']} {ep['path']}]")
+
+    lines.extend([
+        "    end",
+        "",
+        "    subgraph Zone3 [Core Application Execution Tier]",
+        "        AppEngine[TorusGuard Governed App Logic]",
+        "        AuthModule[Authentication & Tenant Scoper]",
+        "    end",
+        "",
+        "    subgraph Zone4 [Data & External Integration Tier]"
+    ])
+
+    for i, db in enumerate(components["datastores"]):
+        lines.append(f"        DB_{i}[({db})]")
+
+    for i, sink in enumerate(components["external_sinks"]):
+        lines.append(f"        Sink_{i}[/{sink}/]")
+
+    lines.extend([
+        "    end",
+        "",
+        "    User -->|HTTP / TLS| Gateway",
+        "    Attacker -.->|Untrusted Payloads| Gateway",
+        "    Gateway --> AppEngine",
+        "    AppEngine --> AuthModule",
+    ])
+
+    for i in range(len(components["datastores"])):
+        lines.append(f"    AuthModule -->|Scoped Query| DB_{i}")
+
+    for i in range(len(components["external_sinks"])):
+        lines.append(f"    AppEngine -->|Egress HTTPS| Sink_{i}")
+
+    lines.append("```")
+    return "\n".join(lines)
+
+
+def generate_stride_report(root_dir: Path) -> str:
+    comp = discover_architecture_components(root_dir)
+    mermaid = generate_mermaid_dfd(comp)
+
+    report = f"""# TorusGuard Architectural Threat Model & STRIDE Register
+
+**Generated by:** TorusGuard Threat Modeling Engine (v2.1.3)  
+**Workspace:** `{root_dir.resolve().as_posix()}`  
+**Analyzed Routes:** {comp['total_routes_detected']}  
+**Identified Data Stores:** {', '.join(comp['datastores'])}  
+**External Egress Sinks:** {', '.join(comp['external_sinks'])}  
+
+---
+
+## 1. Architectural Data Flow Diagram (DFD)
+
+{mermaid}
+
+---
+
+## 2. STRIDE Risk Assessment & Invariant Ledger
+
+| STRIDE Category | Threat Description | Attack Vector | TorusGuard Guardrail | Mitigation Status |
+| :--- | :--- | :--- | :---: | :---: |
+| **Spoofing** | Attacker impersonates legitimate user or service via unverified JWT or forged credentials. | Forged token on `{comp['entrypoints'][0]['path'] if comp['entrypoints'] else '/api'}` | `TG-AUTH-001` / `TG-SEC-001` | **Enforced** |
+| **Tampering** | Unsanitized parameter injection modifies database records or query logic across tenants. | Dynamic SQL concatenation or unpartitioned PK lookups | `TG-DB-001` / `TG-DB-002` | **Enforced** |
+| **Repudiation** | Actions executed without persistent audit traces or immutable transaction locks. | Missing audit headers on state-changing API endpoints | `TG-BIZ-002` / `TG-AUDIT-001` | **Monitored** |
+| **Information Disclosure** | Credentials, API tokens, or multi-tenant database partitions exposed to browser clients. | Bundled service keys or error stack traces | `TG-CLIENT-001` / `TG-DB-001` | **Enforced** |
+| **Denial of Service** | Resource exhaustion via unbounded regex backtracking or unthrottled authentication endpoints. | Catastrophic ReDoS input or unrate-limited auth routes | `TG-REDOS-001` / `TG-RATE-001` | **Enforced** |
+| **Elevation of Privilege** | Unsandboxed tool dispatch or privileged container execution breaks host isolation. | Docker socket mounts or missing role checks | `TG-CONT-002` / `TG-AGENT-002` | **Enforced** |
+
+---
+
+## 3. Trust Boundary Verification Checklist
+
+- [x] **Boundary 1 (Internet to Gateway):** Enforce strict TLS, rate limiting, and CORS origin verification (`TG-RATE-001`, `TG-WS-001`).
+- [x] **Boundary 2 (Gateway to App Core):** Mandatory tenant scoping and structural prompt isolation for LLMs (`TG-DB-001`, `TG-AGENT-001`).
+- [x] **Boundary 3 (App Core to Data Stores):** Parameterized queries and fail-closed entropy validation (`TG-DB-002`, `TG-SEC-004`).
+- [x] **Boundary 4 (App Core to External Sinks):** SSRF hostname whitelisting and private IP resolution blocking (`TG-SSRF-001`, `TG-SSRF-002`).
+
+*Report automatically synced with workspace security posture ledger.*
+"""
+    return report
+
+
+def main():
+    import sys
+    if hasattr(sys.stdout, "reconfigure"):
+        sys.stdout.reconfigure(encoding="utf-8")
+    target = Path(sys.argv[1] if len(sys.argv) > 1 else ".")
+    report_content = generate_stride_report(target)
+    out_file = target / "SECURITY_THREAT_MODEL.md"
+    out_file.write_text(report_content, encoding="utf-8")
+    print(f"[+] Generated architectural STRIDE threat model: {out_file.as_posix()}")
+
+
+if __name__ == "__main__":
+    main()

package/skills/torusguard/payload/scripts/term_ui.py

@@ -143,7 +143,7 @@ def card_divider(title: str = "", border_color: str = CYAN, double: bool = False
         return f"  {border_color}{left}{h} {BOLD}{WHITE}{title}{RESET}{border_color} {h * rem}{right}{RESET}"
     return f"  {border_color}{left}{h * 71}{right}{RESET}"
 
-def card_header(title: str, subtitle: str = "", version: str = "v1.3.4", border_color: str = CYAN) -> str:
+def card_header(title: str, subtitle: str = "", version: str = "v2.1.3", border_color: str = CYAN) -> str:
     """Generate standardized 75-column curved header box."""
     top = f"  {border_color}╭{'─' * 71}╮{RESET}"
     bottom = f"  {border_color}╰{'─' * 71}╯{RESET}"

package/skills/torusguard/payload/skills/torusguard/bootstrap.py

@@ -144,7 +144,7 @@ def card_divider(title: str = "", border_color: str = CYAN, double: bool = False
         return f"  {border_color}{left}{h} {BOLD}{WHITE}{title}{RESET}{border_color} {h * rem}{right}{RESET}"
     return f"  {border_color}{left}{h * 71}{right}{RESET}"
 
-def card_header(title: str, subtitle: str = "", version: str = "v2.1.1", border_color: str = CYAN) -> str:
+def card_header(title: str, subtitle: str = "", version: str = "v2.1.3", border_color: str = CYAN) -> str:
     """Generate standardized 75-column curved header box."""
     top = f"  {border_color}╭{'─' * 71}╮{RESET}"
     bottom = f"  {border_color}╰{'─' * 71}╯{RESET}"
@@ -164,7 +164,7 @@ def card_header(title: str, subtitle: str = "", version: str = "v2.1.1", border_
 def print_header():
     """Print the branded TorusGuard header card."""
     print()
-    print(card_header("🛡️  T O R U S G U A R D", "Autonomous Security Engine for AI-Built Applications", version="v2.1.1"))
+    print(card_header("🛡️  T O R U S G U A R D", "Autonomous Security Engine for AI-Built Applications", version="v2.1.3"))
     print()
 
 
@@ -172,13 +172,13 @@ def print_step_1_assets(file_count):
     """Print the enhanced Step 1 asset unpacking card."""
     print(card_border_top("Step 1/3 ─── Unpacking Governance Assets"))
     print(card_line(""))
-    print(card_line(f"{GREEN}✔{RESET} Canonical security rules            {DIM}71 rules across 11 families{RESET}"))
+    print(card_line(f"{GREEN}✔{RESET} Canonical security rules            {DIM}88 rules across 22 families{RESET}"))
     print(card_line(f"{GREEN}✔{RESET} JSON validation schemas             {DIM}8 formal schemas{RESET}"))
     print(card_line(f"{GREEN}✔{RESET} Specialist agent specifications     {DIM}5 isolated agents{RESET}"))
-    print(card_line(f"{GREEN}✔{RESET} Workflow templates                   {DIM}11 slash commands{RESET}"))
-    print(card_line(f"{GREEN}✔{RESET} Framework reference guides           {DIM}10 security guides{RESET}"))
+    print(card_line(f"{GREEN}✔{RESET} Governed workflow templates         {DIM}25 commands & 13 MCP tools{RESET}"))
+    print(card_line(f"{GREEN}✔{RESET} Framework reference guides           {DIM}22 architectural guides{RESET}"))
     print(card_line(""))
-    print(card_line(f"{BOLD}{WHITE}{file_count} files unpacked{RESET}"))
+    print(card_line(f"{BOLD}{WHITE}{file_count} files unpacked into .torusguard/{RESET}"))
     print(card_border_bottom())
 
 
@@ -186,13 +186,18 @@ def print_step_2_profile(detected_stack=None):
     """Print the security profile & coverage card (in-process stack alignment)."""
     print(card_border_top("Step 2/3 ─── Security Profile & Coverage"))
     print(card_line(""))
-    print(card_line(f"{BOLD}Rule Families:{RESET}"))
-    print(card_line(f"  {YELLOW}TG-SEC{RESET}     Secrets & Credentials    {YELLOW}TG-DB{RESET}      Database Safety"))
-    print(card_line(f"  {YELLOW}TG-INPUT{RESET}   Input Validation         {YELLOW}TG-AUTH{RESET}    Authentication"))
-    print(card_line(f"  {YELLOW}TG-CLIENT{RESET}  Client Bundle Leaks      {YELLOW}TG-DIFF{RESET}    Diff Inspection"))
-    print(card_line(f"  {YELLOW}TG-AGENT{RESET}   AI Agent Security        {YELLOW}TG-EDGE{RESET}    Serverless"))
-    print(card_line(f"  {YELLOW}TG-SUPPLY{RESET}  Supply Chain & CI/CD     {YELLOW}TG-SSRF{RESET}    Outbound Net"))
-    print(card_line(f"  {YELLOW}TG-BIZ{RESET}     Business Logic"))
+    print(card_line(f"{BOLD}Rule Families (88 Rules Across 22 Families):{RESET}"))
+    print(card_line(f"  {YELLOW}TG-SEC{RESET}     Secrets & Tokens         {YELLOW}TG-AUTH{RESET}    Authentication"))
+    print(card_line(f"  {YELLOW}TG-DB{RESET}      Database Isolation       {YELLOW}TG-INPUT{RESET}   Input Sanitization"))
+    print(card_line(f"  {YELLOW}TG-RATE{RESET}    Rate Limiting            {YELLOW}TG-AGENT{RESET}   AI Prompt Injection"))
+    print(card_line(f"  {YELLOW}TG-SSRF{RESET}    Server-Side Request      {YELLOW}TG-WEBHOOK{RESET} Webhook Signature"))
+    print(card_line(f"  {YELLOW}TG-WS{RESET}      WebSocket Safety         {YELLOW}TG-CSRF{RESET}    Cross-Site Request"))
+    print(card_line(f"  {YELLOW}TG-GQL{RESET}     GraphQL Introspection    {YELLOW}TG-SUPPLY{RESET}  Supply Chain Health"))
+    print(card_line(f"  {YELLOW}TG-BIZ{RESET}     Business Logic Limits    {YELLOW}TG-CACHE{RESET}   Cache Poisoning"))
+    print(card_line(f"  {YELLOW}TG-CLIENT{RESET}  Client Bundle Secrets    {YELLOW}TG-PLATFORM{RESET}Platform Hardening"))
+    print(card_line(f"  {YELLOW}TG-DIFF{RESET}    Polyglot Bypass Guard    {YELLOW}TG-EDGE{RESET}    Edge & Serverless"))
+    print(card_line(f"  {YELLOW}TG-CONT{RESET}    Container Hardening      {YELLOW}TG-GIT{RESET}     Git Secret Mining"))
+    print(card_line(f"  {YELLOW}TG-REDOS{RESET}   ReDoS Complexity Guard   {YELLOW}TG-RAG{RESET}     RAG & Vector Scoping"))
     print(card_line(""))
     print(card_line(f"{BOLD}Supported Stacks:{RESET}"))
     print(card_line(f"  {GREEN}Python{RESET}    Django · FastAPI · Flask · DRF · SQLAlchemy"))
@@ -227,7 +232,7 @@ def print_success_card():
     print(card_line("", border="║", border_color=GREEN))
     print(card_line(f"{BOLD}Next Steps:{RESET}", border="║", border_color=GREEN))
     print(card_line("", border="║", border_color=GREEN))
-    print(card_line(f" {CYAN}1.{RESET} In AI Chat      {WHITE}/torusguard-audit{RESET}  or  {WHITE}/torusguard{RESET}", border="║", border_color=GREEN))
+    print(card_line(f" {CYAN}1.{RESET} In AI Chat      {WHITE}/torusguard audit{RESET}  or  {WHITE}/torusguard status{RESET}", border="║", border_color=GREEN))
     print(card_line(f" {CYAN}2.{RESET} In Terminal     {WHITE}npx torusguard status{RESET}", border="║", border_color=GREEN))
     print(card_line(f" {CYAN}3.{RESET} In CI/CD        {WHITE}npx torusguard audit{RESET}", border="║", border_color=GREEN))
     print(card_line("", border="║", border_color=GREEN))
@@ -238,16 +243,21 @@ def print_success_card():
 
 
 def print_already_initialized(target_root, cfg):
-    """Print the already-initialized status card."""
+    """Print the already-initialized status card with dynamic width alignment."""
     print()
     top = f"  {CYAN}╭{'─' * 71}╮{RESET}"
     bottom = f"  {CYAN}╰{'─' * 71}╯{RESET}"
-    title_line = card_line(f"{BOLD}{WHITE}🛡️  TORUSGUARD WORKSPACE{RESET}{' ' * 28}{GREEN}[Active]{RESET}")
+    title_text = f"{BOLD}{WHITE}🛡️  TORUSGUARD WORKSPACE{RESET}"
+    status_text = f"{GREEN}[Active]{RESET}"
+    title_vis = get_visual_width("🛡️  TORUSGUARD WORKSPACE")
+    status_vis = get_visual_width("[Active]")
+    pad_count = max(1, 67 - title_vis - status_vis)
+    title_line = card_line(f"{title_text}{' ' * pad_count}{status_text}")
     print(f"{top}\n{title_line}\n{bottom}")
     print(f"""
   {BOLD}▸ Project Root:{RESET}       {GREEN}{target_root}{RESET}
   {BOLD}▸ Workspace:{RESET}          {GREEN}.torusguard/{RESET} {DIM}(Already Initialized){RESET}
-  {BOLD}▸ Version:{RESET}            {CYAN}{cfg.get('version', '2.1.1')}{RESET}
+  {BOLD}▸ Version:{RESET}            {CYAN}{cfg.get('version', '2.1.3')}{RESET}
   {BOLD}▸ Severity Floor:{RESET}     {YELLOW}{cfg.get('severity_threshold', 'medium')}{RESET}
 
   {DIM}To refresh templates or re-scaffold, run:{RESET}
@@ -454,53 +464,10 @@ Parse the requested action from `$ARGUMENTS` (e.g. `audit`, `verify`, `web-valid
 3. Follow the phase execution steps defined in the workflow.
 """
 
-    # Ensure .agents/workflows, .agents/skills, .agent/workflows, and .agent/skills are created
-    dest_workflow_dirs = []
-
-    # 1. Antigravity / Gemini (.agents/)
-    agents_wf = target_root / ".agents" / "workflows"
-    agents_wf.mkdir(parents=True, exist_ok=True)
-    (agents_wf / "torusguard.md").write_text(tg_workflow_content, encoding="utf-8")
-    dest_workflow_dirs.append(agents_wf)
-    registered_ides.append("Antigravity / Gemini     .agents/workflows/torusguard.md")
-
-    # 2. Tribunal Agent Kit (.agent/)
-    agent_wf = target_root / ".agent" / "workflows"
-    agent_wf.mkdir(parents=True, exist_ok=True)
-    (agent_wf / "torusguard.md").write_text(tg_workflow_content, encoding="utf-8")
-    dest_workflow_dirs.append(agent_wf)
-    registered_ides.append("Tribunal Agent Kit       .agent/workflows/torusguard.md")
-
-    # Unpack Skills into .agents/skills and .agent/skills for full IDE resolution
-    src_skills = torusguard_target / "skills"
-    if src_skills.is_dir():
-        for dest_base in [target_root / ".agents" / "skills", target_root / ".agent" / "skills"]:
-            dest_base.mkdir(parents=True, exist_ok=True)
-            for skill_dir in src_skills.iterdir():
-                if skill_dir.is_dir():
-                    target_skill_dir = dest_base / skill_dir.name
-                    if not target_skill_dir.exists():
-                        try:
-                            shutil.copytree(skill_dir, target_skill_dir)
-                        except Exception:
-                            pass
-
-    # When full_commands is requested (e.g. via NPM package npx torusguard init),
-    # unlock and register all individual slash commands
-    if full_commands:
-        src_wf = torusguard_target / "workflows"
-        if src_wf.is_dir():
-            count = 0
-            for wf_file in src_wf.glob("*.md"):
-                if wf_file.name == "torusguard.md":
-                    continue
-                cmd_filename = f"torusguard-{wf_file.name}"
-                for d in dest_workflow_dirs:
-                    shutil.copy2(wf_file, d / cmd_filename)
-                count += 1
-            registered_ides.append(f"{count} Slash Commands          /torusguard-audit, -harden, -apply, ...")
-
-    # Claude Code (.claude/commands)
+    # Core workspace governance is self-contained in .torusguard/
+    registered_ides.append("Workspace Core           .torusguard/ (Workflows & Skills)")
+
+    # Claude Code (.claude/commands) - only if .claude exists
     claude_dir = target_root / ".claude"
     if claude_dir.exists():
         claude_commands = claude_dir / "commands"
@@ -508,7 +475,7 @@ Parse the requested action from `$ARGUMENTS` (e.g. `audit`, `verify`, `web-valid
         (claude_commands / "torusguard.md").write_text(tg_workflow_content, encoding="utf-8")
         registered_ides.append("Claude Code              .claude/commands/torusguard.md")
 
-    # Cursor (.cursor/rules)
+    # Cursor (.cursor/rules) - only if .cursor exists
     cursor_dir = target_root / ".cursor"
     if cursor_dir.exists():
         cursor_rules = cursor_dir / "rules"

package/skills/torusguard/payload/skills/torusguard-review/SKILL.md

@@ -0,0 +1,27 @@
+---
+name: torusguard-review
+description: Differential PR and Git diff incremental security review — detects newly introduced vulnerabilities between Git branches or commits with net security score deltas.
+tools: Read, Grep, Glob, Bash, Edit, Write
+version: 2.1.3
+last-updated: 2026-10-01
+skills:
+  - torusguard
+  - torusguard-audit
+---
+
+# TorusGuard Review — Differential Incremental PR Review
+
+TorusGuard Review performs rapid, surgical security review on Git changes (e.g. against `HEAD~1`, `main`, or PR target branch), analyzing only modified lines to prevent introducing security regressions.
+
+## Invocation
+
+- **Mode A (Terminal CLI):** `torusguard review [--diff <ref>]`
+- **Mode B (AI Chat Slash Command):** `/torusguard review` or `/torusguard-review`
+- **Mode C (Native MCP Tool):** `torusguard_review(target=".", diff_ref="HEAD~1")`
+
+## Core Capabilities
+
+1. **Sub-300ms Turnaround:** Only parses and checks modified/added lines in Git diffs.
+2. **Net Security Score Delta:** Tracks introduced vs. resolved vulnerabilities (`+0 Introduced, -2 Resolved`).
+3. **PR Gate Decision:** Blocks CI/CD pipelines if Critical or High severity flaws are introduced.
+4. **Alibaba OpenCodeReview Parity:** Outputs ready-to-post pull request inline review comments.

package/skills/torusguard/payload/skills/torusguard-threatmodel/SKILL.md

@@ -0,0 +1,27 @@
+---
+name: torusguard-threatmodel
+description: Synthesizes an architectural STRIDE threat model, interactive Mermaid Data Flow Diagram (DFD), and trust boundary register into SECURITY_THREAT_MODEL.md.
+tools: Read, Grep, Glob, Bash, Edit, Write
+version: 2.1.3
+last-updated: 2026-10-01
+skills:
+  - torusguard
+  - torusguard-audit
+---
+
+# TorusGuard Threat Model — STRIDE & DFD Synthesizer
+
+TorusGuard Threat Model automatically maps routes, trust boundaries, datastores, and egress sinks to construct an architectural Data Flow Diagram and formal STRIDE threat model.
+
+## Invocation
+
+- **Mode A (Terminal CLI):** `torusguard threatmodel`
+- **Mode B (AI Chat Slash Command):** `/torusguard threatmodel` or `/torusguard-threatmodel`
+- **Mode C (Native MCP Tool):** `torusguard_threatmodel(target=".")`
+
+## Core Capabilities
+
+1. **Automated DFD Generation:** Renders interactive Mermaid diagram showing Zones 1–4 (Clients, Gateways, Core Services, Datastores).
+2. **STRIDE Risk Ledger:** Evaluates threats across Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, and Elevation of Privilege.
+3. **Multi-Modal Vision Integration:** Discovers architectural diagrams and verifies that visual trust boundaries match code execution paths.
+4. **Living Compliance Artifact:** Emits `SECURITY_THREAT_MODEL.md` at workspace root.

package/skills/torusguard/payload/workflows/review.md

@@ -0,0 +1,11 @@
+# TorusGuard Review Workflow (`/torusguard review`)
+
+## Purpose
+Executes differential incremental Git diff security review against a reference branch or commit (default: `HEAD~1`).
+Inspects changed lines for new security regressions, evaluates net security score deltas, and outputs pull request review comments.
+
+## Steps
+1. Determine reference branch or commit (e.g. `HEAD~1` or `origin/main`).
+2. Run differential scan via `torusguard review [--diff <ref>]` or native MCP tool `torusguard_review`.
+3. Check PR Gate Decision (`PASSED` or `BLOCKED`).
+4. If blocked, review newly introduced violations and formulate surgical Ponytail fixes via `/torusguard harden`.

package/skills/torusguard/payload/workflows/threatmodel.md

@@ -0,0 +1,9 @@
+# TorusGuard Threat Model Workflow (`/torusguard threatmodel`)
+
+## Purpose
+Synthesizes architectural STRIDE threat models, interactive Mermaid Data Flow Diagrams (DFDs), and trust boundary registers directly into `SECURITY_THREAT_MODEL.md`.
+
+## Steps
+1. Execute `torusguard threatmodel` or native MCP tool `torusguard_threatmodel`.
+2. Inspect `SECURITY_THREAT_MODEL.md` to verify identified entrypoints, data stores, and trust boundaries.
+3. Align STRIDE risk controls against corresponding TorusGuard security invariants (`TG-AUTH`, `TG-DB`, `TG-RATE`, `TG-SSRF`).

package/skills/torusguard-review/SKILL.md

@@ -0,0 +1,27 @@
+---
+name: torusguard-review
+description: Differential PR and Git diff incremental security review — detects newly introduced vulnerabilities between Git branches or commits with net security score deltas.
+tools: Read, Grep, Glob, Bash, Edit, Write
+version: 2.1.3
+last-updated: 2026-10-01
+skills:
+  - torusguard
+  - torusguard-audit
+---
+
+# TorusGuard Review — Differential Incremental PR Review
+
+TorusGuard Review performs rapid, surgical security review on Git changes (e.g. against `HEAD~1`, `main`, or PR target branch), analyzing only modified lines to prevent introducing security regressions.
+
+## Invocation
+
+- **Mode A (Terminal CLI):** `torusguard review [--diff <ref>]`
+- **Mode B (AI Chat Slash Command):** `/torusguard review` or `/torusguard-review`
+- **Mode C (Native MCP Tool):** `torusguard_review(target=".", diff_ref="HEAD~1")`
+
+## Core Capabilities
+
+1. **Sub-300ms Turnaround:** Only parses and checks modified/added lines in Git diffs.
+2. **Net Security Score Delta:** Tracks introduced vs. resolved vulnerabilities (`+0 Introduced, -2 Resolved`).
+3. **PR Gate Decision:** Blocks CI/CD pipelines if Critical or High severity flaws are introduced.
+4. **Alibaba OpenCodeReview Parity:** Outputs ready-to-post pull request inline review comments.

package/skills/torusguard-threatmodel/SKILL.md

@@ -0,0 +1,27 @@
+---
+name: torusguard-threatmodel
+description: Synthesizes an architectural STRIDE threat model, interactive Mermaid Data Flow Diagram (DFD), and trust boundary register into SECURITY_THREAT_MODEL.md.
+tools: Read, Grep, Glob, Bash, Edit, Write
+version: 2.1.3
+last-updated: 2026-10-01
+skills:
+  - torusguard
+  - torusguard-audit
+---
+
+# TorusGuard Threat Model — STRIDE & DFD Synthesizer
+
+TorusGuard Threat Model automatically maps routes, trust boundaries, datastores, and egress sinks to construct an architectural Data Flow Diagram and formal STRIDE threat model.
+
+## Invocation
+
+- **Mode A (Terminal CLI):** `torusguard threatmodel`
+- **Mode B (AI Chat Slash Command):** `/torusguard threatmodel` or `/torusguard-threatmodel`
+- **Mode C (Native MCP Tool):** `torusguard_threatmodel(target=".")`
+
+## Core Capabilities
+
+1. **Automated DFD Generation:** Renders interactive Mermaid diagram showing Zones 1–4 (Clients, Gateways, Core Services, Datastores).
+2. **STRIDE Risk Ledger:** Evaluates threats across Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, and Elevation of Privilege.
+3. **Multi-Modal Vision Integration:** Discovers architectural diagrams and verifies that visual trust boundaries match code execution paths.
+4. **Living Compliance Artifact:** Emits `SECURITY_THREAT_MODEL.md` at workspace root.