[extension] Add ThreatSpec extension to community catalog (#4701)

* Add ThreatSpec extension to community catalog

Add threatspec extension submitted by @hupe1980 to:\n- extensions/catalog.community.json (alphabetical order)\n- docs/community/extensions.md community extensions table\n\nCloses #4660\n\nAssisted-by: GitHub Copilot (model: gpt-5.2-codex, autonomous)\nCo-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* Add PyYAML requirement to ThreatSpec catalog entry

Co-authored-by: KSchlobohm <23503973+KSchlobohm@users.noreply.github.com>

---------

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: KSchlobohm <23503973+KSchlobohm@users.noreply.github.com>

Author: 3 people

docs/community/extensions.md

@@ -180,6 +180,7 @@ The following community-contributed extensions are available in [`catalog.commun
 | TDD Extension | Drives spec-kit implementation with tests: a language-agnostic red-green-refactor loop with a per-feature test list, recorded red and green evidence, and mutation-checked test strength. | `process` | Read+Write | [spec-kit-tdd](https://github.com/d0whc3r/spec-kit-tdd) |
 | Team Assign | Assign tasks.md items to human engineers, split into subtasks, and generate a per-engineer workboard | `process` | Read+Write | [spec-kit-team-assign](https://github.com/tarunkumarbhati/spec-kit-team-assign) |
 | Test Coverage Drift Control | Generate incremental coverage drift reports and planned remediation tasks after implementation | `code` | Read+Write | [spec-kit-test-coverage-drift-control](https://github.com/benizzio/spec-kit-test-coverage-drift-control) |
+| ThreatSpec | STRIDE and AI/ML threat modeling with threat-to-test traceability and security convergence | `process` | Read+Write | [spec-kit-threatspec](https://github.com/hupe1980/spec-kit-threatspec) |
 | Time Machine | Retroactively apply the full SDD workflow to existing codebases — analyse, spec, and ship feature-by-feature | `process` | Read+Write | [spec-kit-time-machine](https://github.com/teeyo/spec-kit-time-machine) |
 | TinySpec | Lightweight single-file workflow for small tasks — skip the heavy multi-step SDD process | `process` | Read+Write | [spec-kit-tinyspec](https://github.com/Quratulain-bilal/spec-kit-tinyspec) |
 | Token Budget | Reduces LLM token consumption in Spec Kit workflows: compact artifacts in-place, scope per-phase reading, suppress prose padding, and report token usage | `process` | Read+Write | [spec-kit-token-budget](https://github.com/tinesoft/spec-kit-token-budget) |

extensions/catalog.community.json

@@ -1,6 +1,6 @@
 {
   "schema_version": "1.0",
-  "updated_at": "2026-09-18T00:00:00Z",
+  "updated_at": "2026-09-23T00:00:00Z",
   "catalog_url": "https://raw.githubusercontent.com/github/spec-kit/main/extensions/catalog.community.json",
   "extensions": {
     "adrkit": {
@@ -5781,6 +5781,60 @@
       "created_at": "2026-04-25T00:00:00Z",
       "updated_at": "2026-04-25T00:00:00Z"
     },
+    "threatspec": {
+      "name": "ThreatSpec — Threat Modeling & Security Traceability",
+      "id": "threatspec",
+      "description": "STRIDE and AI/ML threat modeling with threat-to-test traceability and security convergence",
+      "author": "hupe1980",
+      "version": "0.1.0",
+      "download_url": "https://github.com/hupe1980/spec-kit-threatspec/archive/refs/tags/v0.1.0.zip",
+      "sha256": "6003b667e01e51a4637e4b6c2f2cea644674449f5bd2e7ed9301d3459a5a9c40",
+      "repository": "https://github.com/hupe1980/spec-kit-threatspec",
+      "homepage": "https://github.com/hupe1980/spec-kit-threatspec",
+      "documentation": "https://github.com/hupe1980/spec-kit-threatspec/blob/main/README.md",
+      "changelog": "https://github.com/hupe1980/spec-kit-threatspec/blob/main/CHANGELOG.md",
+      "license": "MIT",
+      "category": "process",
+      "effect": "read-write",
+      "requires": {
+        "speckit_version": ">=1.0.0",
+        "tools": [
+          {
+            "name": "python",
+            "version": ">=3.8",
+            "required": true
+          },
+          {
+            "name": "pyyaml",
+            "required": true
+          },
+          {
+            "name": "uv",
+            "required": false
+          },
+          {
+            "name": "jsonschema",
+            "required": false
+          }
+        ]
+      },
+      "provides": {
+        "commands": 3,
+        "hooks": 7
+      },
+      "tags": [
+        "security",
+        "threat-modeling",
+        "llm",
+        "agentic",
+        "traceability"
+      ],
+      "verified": false,
+      "downloads": 0,
+      "stars": 0,
+      "created_at": "2026-09-23T00:00:00Z",
+      "updated_at": "2026-09-23T00:00:00Z"
+    },
     "tldr": {
       "name": "Spec Kit TLDR",
       "id": "tldr",