Attack Tree Builder

Attack tree construction

by wshobson · MIT license · ★ 39,857 on GitHub · updated Sep 21

Build comprehensive attack trees to visualize threat paths. Use when mapping attack scenarios, identifying defense gaps, or communicating security risks to stakeholders.

---
name: attack-tree-construction
description: Build comprehensive attack trees to visualize threat paths. Use when mapping attack scenarios, identifying defense gaps, or communicating security risks to stakeholders.
---

# Attack Tree Construction

Systematic attack path visualization and analysis.

## When to Use This Skill

- Visualizing complex attack scenarios
- Identifying defense gaps and priorities
- Communicating risks to stakeholders
- Planning defensive investments
- Penetration test planning
- Security architecture review

Overview

Full template library lives in references/details.md. Read that file when you need concrete templates for this skill.

Manual install (npx, ZIP)

Claude Codenpx skills add wshobson/agents --skill attack-tree-construction -g -a claude-code

Claude Code (manual)

mkdir -p ~/.claude/skills && curl -sL https://codeload.github.com/wshobson/agents/tar.gz/4236bb91f839 \
  | tar -xz -C ~/.claude/skills --strip-components=4 agents-4236bb91f839/plugins/security-scanning/skills/attack-tree-construction

Windows (PowerShell)

New-Item -ItemType Directory -Force "$HOME\.claude\skills" | Out-Null; Invoke-WebRequest "https://m.agentalley.io/zip/00e64549f3c0bc0b1f10/attack-tree-construction.zip" -OutFile "$env:TEMP\attack-tree-construction.zip"; Expand-Archive "$env:TEMP\attack-tree-construction.zip" -DestinationPath "$HOME\.claude\skills" -Force

Claude.ai / desktopDownload the ZIP and upload it under Settings → Capabilities → Skills.

Codex, Cursor, other agentsPoint them at SKILL.md. The other files are plain text.

Connects with Agent Alley MCP · agentalley.io/mcp

Files included

SKILL.md2.6 KB
references/1 file · 19.4 KB

Read the files here

wshobson/4236bb92 files

SKILL.md2.6 KB

SKILL.md

Show the full text75 lines

attack-tree-construction/SKILL.md75 lines · 2.6 KB

PreviewCode

Outline

RawView on GitHub

Attack Tree Construction

Systematic attack path visualization and analysis.

When to Use This Skill

Visualizing complex attack scenarios
Identifying defense gaps and priorities
Communicating risks to stakeholders
Planning defensive investments
Penetration test planning
Security architecture review

Core Concepts

1. Attack Tree Structure

                    [Root Goal]
                         |
            ┌────────────┴────────────┐
            │                         │
       [Sub-goal 1]              [Sub-goal 2]
       (OR node)                 (AND node)
            │                         │
      ┌─────┴─────┐             ┌─────┴─────┐
      │           │             │           │
   [Attack]   [Attack]      [Attack]   [Attack]
    (leaf)     (leaf)        (leaf)     (leaf)

2. Node Types

Type	Symbol	Description
OR	Oval	Any child achieves goal
AND	Rectangle	All children required
Leaf	Box	Atomic attack step

3. Attack Attributes

Attribute	Description	Values
Cost	Resources needed	$, $$, $$$
Time	Duration to execute	Hours, Days, Weeks
Skill	Expertise required	Low, Medium, High
Detection	Likelihood of detection	Low, Medium, High

Templates and detailed worked examples

Full template library lives in references/details.md. Read that file when you need concrete templates for this skill.

Best Practices

Do's

Start with clear goals - Define what attacker wants
Be exhaustive - Consider all attack vectors
Attribute attacks - Cost, skill, and detection
Update regularly - New threats emerge
Validate with experts - Red team review

Don'ts

Don't oversimplify - Real attacks are complex
Don't ignore dependencies - AND nodes matter
Don't forget insider threats - Not all attackers are external
Don't skip mitigations - Trees are for defense planning
Don't make it static - Threat landscape evolves

1	---
2	name: attack-tree-construction
3	description: Build comprehensive attack trees to visualize threat paths. Use when mapping attack scenarios, identifying defense gaps, or communicating security risks to stakeholders.
4	---
5
6	# Attack Tree Construction
7
8	Systematic attack path visualization and analysis.
9
10	## When to Use This Skill
11
12	- Visualizing complex attack scenarios
13	- Identifying defense gaps and priorities
14	- Communicating risks to stakeholders
15	- Planning defensive investments
16	- Penetration test planning
17	- Security architecture review
18
19	## Core Concepts
20
21	### 1. Attack Tree Structure
22
23	```
24	[Root Goal]
25	\|
26	┌────────────┴────────────┐
27	│ │
28	[Sub-goal 1] [Sub-goal 2]
29	(OR node) (AND node)
30	│ │
31	┌─────┴─────┐ ┌─────┴─────┐
32	│ │ │ │
33	[Attack] [Attack] [Attack] [Attack]
34	(leaf) (leaf) (leaf) (leaf)
35	```
36
37	### 2. Node Types
38
39	\| Type \| Symbol \| Description \|
40	\| -------- \| --------- \| ----------------------- \|
41	\| OR \| Oval \| Any child achieves goal \|
42	\| AND \| Rectangle \| All children required \|
43	\| Leaf \| Box \| Atomic attack step \|
44
45	### 3. Attack Attributes
46
47	\| Attribute \| Description \| Values \|
48	\| ------------- \| ----------------------- \| ------------------ \|
49	\| Cost \| Resources needed \| $, $$, $$$ \|
50	\| Time \| Duration to execute \| Hours, Days, Weeks \|
51	\| Skill \| Expertise required \| Low, Medium, High \|
52	\| Detection \| Likelihood of detection \| Low, Medium, High \|
53
54	## Templates and detailed worked examples
55
56	Full template library lives in `references/details.md`. Read that file when you need concrete templates for this skill.
57
58	## Best Practices
59
60	### Do's
61
62	- Start with clear goals - Define what attacker wants
63	- Be exhaustive - Consider all attack vectors
64	- Attribute attacks - Cost, skill, and detection
65	- Update regularly - New threats emerge
66	- Validate with experts - Red team review
67
68	### Don'ts
69
70	- Don't oversimplify - Real attacks are complex
71	- Don't ignore dependencies - AND nodes matter
72	- Don't forget insider threats - Not all attackers are external
73	- Don't skip mitigations - Trees are for defense planning
74	- Don't make it static - Threat landscape evolves
75