Agent skill

Attack Flow

by wiz-sec-public in wiz-sec-public/SITF

Generate SITF-compliant attack flow JSON files from attack descriptions or incident reports.

Custom licenceAuto-check passedSecurity

Install Attack Flow

skills CLI

$ npx skills add wiz-sec-public/SITF --skill attack-flow -a claude-code

Project install by default; add -g for ~/.claude/skills/.

GitHub CLI

$ gh skill install wiz-sec-public/SITF attack-flow --agent claude-code

Project scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).

Manual copy

$ git clone --depth 1 https://github.com/wiz-sec-public/SITF.git skills-src && mkdir -p .claude/skills && cp -r skills-src/.claude/skills/attack-flow .claude/skills/attack-flow && rm -rf skills-src

Use ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.

Claude Code skills documentation · loads skills from .claude/skills/

Paste into Claude Code

Install the "attack-flow" agent skill from https://github.com/wiz-sec-public/SITF/tree/main/.claude/skills/attack-flow into .claude/skills/attack-flow/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "attack-flow", then confirm the skill loads.

Claude Code copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.

$skill-installer

$skill-installer install https://github.com/wiz-sec-public/SITF/tree/main/.claude/skills/attack-flow

Type this inside Codex. $skill-installer <name> installs a curated skill from openai/skills. The installer writes to $CODEX_HOME/skills (default ~/.codex/skills). Restart Codex if the skill does not show up.

skills CLI

$ npx skills add wiz-sec-public/SITF --skill attack-flow -a codex

Project install goes to .agents/skills/; add -g for ~/.codex/skills/.

GitHub CLI

$ gh skill install wiz-sec-public/SITF attack-flow --agent codex

Project scope by default (.agents/skills/); add --scope user for a personal install.

Manual copy

$ git clone --depth 1 https://github.com/wiz-sec-public/SITF.git skills-src && mkdir -p .agents/skills && cp -r skills-src/.claude/skills/attack-flow .agents/skills/attack-flow && rm -rf skills-src

Use ~/.agents/skills/ instead of .agents/skills for a personal install.

Codex skills documentation · loads skills from .agents/skills/

Paste into Codex

Install the "attack-flow" agent skill from https://github.com/wiz-sec-public/SITF/tree/main/.claude/skills/attack-flow into .agents/skills/attack-flow/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "attack-flow", then confirm the skill loads.

Codex copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.

skills CLI

$ npx skills add wiz-sec-public/SITF --skill attack-flow -a cursor

Project install goes to .agents/skills/; add -g for ~/.cursor/skills/.

GitHub CLI

$ gh skill install wiz-sec-public/SITF attack-flow --agent cursor

Project scope by default (.agents/skills/); add --scope user for a personal install.

Manual copy

$ git clone --depth 1 https://github.com/wiz-sec-public/SITF.git skills-src && mkdir -p .cursor/skills && cp -r skills-src/.claude/skills/attack-flow .cursor/skills/attack-flow && rm -rf skills-src

Use ~/.cursor/skills/ instead of .cursor/skills for a personal install.

Cursor skills documentation · loads skills from .cursor/skills/, .agents/skills/, .claude/skills/, .codex/skills/

Paste into Cursor

Install the "attack-flow" agent skill from https://github.com/wiz-sec-public/SITF/tree/main/.claude/skills/attack-flow into .cursor/skills/attack-flow/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "attack-flow", then confirm the skill loads.

Cursor copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.

gemini skills install

$ gemini skills install https://github.com/wiz-sec-public/SITF.git --path .claude/skills/attack-flow

--scope user (default) or --scope workspace; --path is the subfolder of the repo that holds the skill; --consent skips the security confirmation prompt.

skills CLI

$ npx skills add wiz-sec-public/SITF --skill attack-flow -a gemini-cli

Project install goes to .agents/skills/; add -g for ~/.gemini/skills/.

GitHub CLI

$ gh skill install wiz-sec-public/SITF attack-flow --agent gemini-cli

Project scope by default (.agents/skills/); add --scope user for a personal install.

Manual copy

$ git clone --depth 1 https://github.com/wiz-sec-public/SITF.git skills-src && mkdir -p .gemini/skills && cp -r skills-src/.claude/skills/attack-flow .gemini/skills/attack-flow && rm -rf skills-src

Use ~/.gemini/skills/ instead of .gemini/skills for a personal install, then run /skills reload.

Gemini CLI skills documentation · loads skills from .gemini/skills/, .agents/skills/

Paste into Gemini CLI

Install the "attack-flow" agent skill from https://github.com/wiz-sec-public/SITF/tree/main/.claude/skills/attack-flow into .gemini/skills/attack-flow/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "attack-flow", then confirm the skill loads.

Gemini CLI copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.

GitHub CLI

$ gh skill install wiz-sec-public/SITF attack-flow

Installs for Copilot at project scope by default; add --scope user for a personal install. Preview a skill first with gh skill preview. Needs GitHub CLI 2.90.0 or later (public preview).

skills CLI

$ npx skills add wiz-sec-public/SITF --skill attack-flow -a github-copilot

Project install goes to .agents/skills/; add -g for ~/.copilot/skills/.

Manual copy

$ git clone --depth 1 https://github.com/wiz-sec-public/SITF.git skills-src && mkdir -p .github/skills && cp -r skills-src/.claude/skills/attack-flow .github/skills/attack-flow && rm -rf skills-src

Use ~/.copilot/skills/ instead of .github/skills for a personal install. Commit .github/skills so cloud agent and code review can use it.

GitHub Copilot skills documentation · loads skills from .github/skills/, .claude/skills/, .agents/skills/

Paste into GitHub Copilot

Install the "attack-flow" agent skill from https://github.com/wiz-sec-public/SITF/tree/main/.claude/skills/attack-flow into .github/skills/attack-flow/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "attack-flow", then confirm the skill loads.

GitHub Copilot copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.

skills CLI

$ npx skills add wiz-sec-public/SITF --skill attack-flow -a opencode

OpenCode documents no install command of its own. Project install goes to .agents/skills/; add -g for ~/.config/opencode/skills/.

GitHub CLI

$ gh skill install wiz-sec-public/SITF attack-flow --agent opencode

Project scope by default (.agents/skills/); add --scope user for a personal install.

Manual copy

$ git clone --depth 1 https://github.com/wiz-sec-public/SITF.git skills-src && mkdir -p .opencode/skills && cp -r skills-src/.claude/skills/attack-flow .opencode/skills/attack-flow && rm -rf skills-src

Use ~/.config/opencode/skills/ instead of .opencode/skills for a personal install.

OpenCode skills documentation · loads skills from .opencode/skills/, .claude/skills/, .agents/skills/

Paste into OpenCode

Install the "attack-flow" agent skill from https://github.com/wiz-sec-public/SITF/tree/main/.claude/skills/attack-flow into .opencode/skills/attack-flow/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "attack-flow", then confirm the skill loads.

OpenCode copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.

Facts

Skill name: attack-flow
GitHub stars: 182
Token cost: ~3.1k tokens
SKILL.md length: 863 words
Files: 1
Skills in repo: 2
Repo updated: Jul 29, 2026
First seen: Oct 7, 2026
Licence: Custom licence

At a glance

Generate SITF-compliant attack flow JSON files from attack descriptions or incident reports.

Works in 7 steps: Research → Technique Mapping → Layout Calculation → …
Analyzing supply chain attacks
SKILL.md covers Usage, Instructions, Example and Reference: Working Sample
Calls python3

What it does

Attack Flow is an agent skill from wiz-sec-public/SITF. Generate SITF-compliant attack flow JSON files from attack descriptions or incident reports. Use when analyzing supply chain attacks, breaches, or security incidents.

Its SKILL.md is about 3.1k tokens, which your agent loads only when the skill is triggered. It is a single SKILL.md file with no bundled scripts.

It sits in Security, covering Supply chain security and Security operations. The repository describes itself as: A comprehensive framework for analyzing and defending against attacks targeting Software Development Life Cycle Infrastructure.

When your agent uses it

Analyzing supply chain attacks
Security incidents

Example prompts

“/attack-flow”

Requirements

Python 3

Workflow steps

7 steps, taken from the step headings in SKILL.md.

Research
Technique Mapping
Layout Calculation
JSON Generation
Control Gap Analysis
Validation
Output

What it can do on your machine

Read from SKILL.md and the folder at commit d1d1536. It shows what the files ask for, not the result of running them.

Tool permissions
Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.
From allowed-tools in the SKILL.md frontmatter.
Runs code
Shell commands in SKILL.md call:
- python3
From the folder's file list and the shell code blocks in SKILL.md.
Network
No URLs in SKILL.md.
From URLs in SKILL.md, links to its own repository left out.
Credentials
Names no API keys, tokens, secrets or passwords.
From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.

Context cost

Attack Flow loads about 3.1k tokens when it runs. Until then it costs about 45 tokens; SKILL.md has 863 words of instructions outside code blocks.

Always · name and description, kept in context so the agent knows when to use it: ~45
When it runs · the whole SKILL.md, loaded when a task matches: ~3.1k

Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.

Safety

Auto-check passed

The automated check found no risky patterns in SKILL.md.

Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); files beside SKILL.md are not scanned.

SKILL.md

Its licence (Custom licence) doesn't allow us to republish the file, so here is its outline and opening line. It has 863 words (~3,077 tokens).

“Generate SITF-compliant attack flow JSON files from attack descriptions or incident reports.”

— opening of SKILL.md by wiz-sec-public, Custom licence

name: attack-flow
argument-hint: <attack-name> [websearch|url]
tools: Read, Grep, Glob, WebSearch, WebFetch, Write, Bash

Read the full SKILL.md on GitHub

Files

Just SKILL.md in .claude/skills/attack-flow of wiz-sec-public/SITF.

Open the folder on GitHubat commit d1d1536

Compare with similar skills

Attack Flow next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.

Attack Flow compared with similar skills
Skill	Stars	Used in	Tokens	Auto-check	Licence	Repo updated
Attack Flow this skillwiz-sec-public/SITF	182	—	~3.1k	Automated safety check: Pass	Custom licence	2 mo ago
Hunting For Supply Chain Compromisemukul975/Anthropic-Cybersecurity-Skills	34k	—	~899	Automated safety check: Pass	Apache-2.0	1 mo ago
Securing Systemstelagod/code-abyss	243	—	~581	Automated safety check: Pass	MIT	2 mo ago
Skill Scannergetsentry/skills	1k	4 repos	~2.5k	Automated safety check: Warn	Apache-2.0	6 days ago
Serenity Aleabitoreddityan-labs/serenity-aleabitoreddit	481	1 repos	~3.3k	Automated safety check: Pass	None	7 days ago
Security Alert Triageelastic/agent-skills	592	1 repos	~3.5k	Automated safety check: Notes	Apache-2.0	yesterday

Similar skills

Hunting For Supply Chain Compromise
mukul975/Anthropic-Cybersecurity-Skills
Runs a hypothesis-driven threat hunt for supply-chain compromise (T1195) by querying SIEM/EDR logs for trojanized software updates, compromised dependencies, unauthorized code modifications, and…
34k GitHub stars~899 tokensUpdated 1 mo ago
SecurityAuto-check passed
Securing Systems
telagod/code-abyss
Security engineering router for penetration testing, code auditing, red/blue/purple team operations, threat intelligence, and vulnerability research.
243 GitHub stars~581 tokensUpdated 2 mo ago
SecurityAuto-check passed
Skill Scanner
getsentry/skills
Official
Scan agent skills for security issues. An agent skill from getsentry/skills.
1k GitHub starsUsed in 4 repos~2.5k tokens
SecurityAuto-check: warnings
Serenity Aleabitoreddit
yan-labs/serenity-aleabitoreddit
Apply trader Serenity's (@aleabitoreddit) AI/semiconductor supply-chain analytical lens to US-stock ideas and market judgment.
481 GitHub starsUsed in 1 repo~3.3k tokens
SecurityAuto-check passed
Security Alert Triage
elastic/agent-skills
Official
Triage Elastic Security alerts — gather context, classify threats, create cases, and acknowledge.
592 GitHub starsUsed in 1 repo~3.5k tokens
SecurityAuto-check: notes
Kubernetes Network Security Audit
kubeshark/kubeshark
Hunts for compromised workloads and malicious traffic in a Kubernetes cluster by sweeping network data through Kubeshark MCP, mapped to MITRE ATT&CK.
12k GitHub stars~7.3k tokensUpdated yesterday
SecurityAuto-check: notes

Questions about Attack Flow

What does Attack Flow do?

Generate SITF-compliant attack flow JSON files from attack descriptions or incident reports. Attack Flow is an agent skill from wiz-sec-public/SITF. Generate SITF-compliant attack flow JSON files from attack descriptions or incident reports.

When should I use Attack Flow?

Attack Flow fits situations like: analyzing supply chain attacks; security incidents.

How do I install Attack Flow in Claude Code?

Run `npx skills add wiz-sec-public/SITF --skill attack-flow -a claude-code`. Or copy the skill folder (.claude/skills/attack-flow in wiz-sec-public/SITF) into .claude/skills/attack-flow in your project. Claude Code loads it when a task matches its description.

How do I install Attack Flow in Codex?

Run `npx skills add wiz-sec-public/SITF --skill attack-flow -a codex`. Or copy the skill folder (.claude/skills/attack-flow in wiz-sec-public/SITF) into .agents/skills/attack-flow in your project. Codex loads it when a task matches its description.

Can I use Attack Flow in Cursor, Gemini CLI or GitHub Copilot?

Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add wiz-sec-public/SITF --skill attack-flow -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/attack-flow, .gemini/skills/attack-flow, .github/skills/attack-flow and .opencode/skills/attack-flow in your project.

What does Attack Flow need to run?

Going by SKILL.md and its folder, Attack Flow needs the command-line tools its instructions call (python3). Our summary lists: Python 3.

Does Attack Flow access the network?

SKILL.md contains no URLs. Any network use would come from the scripts or tools the agent runs. This is read from the text; nothing was executed.

Is Attack Flow safe to install?

Our automated static check of SKILL.md found no risky patterns, such as piping downloads into a shell, reading credential files or hidden Unicode. It is not a guarantee. Review the folder before installing.

What licence does Attack Flow use?

Attack Flow has a licence file (the repository's licence) that doesn't match a standard licence. Read it on GitHub before reusing the skill.

How many tokens does Attack Flow use?

About 3.1k tokens (SKILL.md is roughly 12k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full.

What are the alternatives to Attack Flow?

Skills that share tags, products or a category with Attack Flow: Hunting For Supply Chain Compromise (mukul975/Anthropic-Cybersecurity-Skills, 34k stars), Securing Systems (telagod/code-abyss, 243 stars), Skill Scanner (getsentry/skills, 1k stars) and Serenity Aleabitoreddit (yan-labs/serenity-aleabitoreddit, 481 stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.

Who maintains Attack Flow?

wiz-sec-public (a GitHub organization) maintains it in wiz-sec-public/SITF, which has 182 GitHub stars. The repository holds 2 skills in this directory. The repository was last updated on July 29, 2026.

Source: wiz-sec-public/SITF on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.

Attack Flow

Install Attack Flow

Facts

At a glance

What it does

When your agent uses it

Example prompts

Requirements

Workflow steps

What it can do on your machine

Tool permissions

Runs code

Network

Credentials

Context cost

Safety

SKILL.md

Files

Compare with similar skills

Similar skills

Hunting For Supply Chain Compromise

Securing Systems

Skill Scanner

Serenity Aleabitoreddit

Security Alert Triage

Kubernetes Network Security Audit

More from wiz-sec-public/SITF

Technique Proposal

Questions about Attack Flow

Install Attack Flow

Facts

At a glance

What it does

When your agent uses it

Example prompts

Requirements

Workflow steps

What it can do on your machine

Tool permissions

Runs code

Network

Credentials

Context cost

Safety

SKILL.md

Files

Compare with similar skills

Similar skills

Hunting For Supply Chain Compromise

Securing Systems

Skill Scanner

Serenity Aleabitoreddit

Security Alert Triage

Kubernetes Network Security Audit

More from wiz-sec-public/SITF

Technique Proposal

Related

Questions about Attack Flow