New: 97,000+ skills indexed from GitHub repos with 100+ stars · every skill safety-checkedBrowse top skillsTop skills
Esc to closeBrowse all skills
Submit a skillBrowse skills
Submit a skillBrowse skills

Agent skill

Attack Tree Construction

by wshobson in wshobson/agents

Builds attack trees that map how an attacker could reach a goal, with AND and OR nodes and cost, time, skill and detection ratings, to find defense gaps.

MITAuto-check passedSecurity

Install Attack Tree Construction

skills CLI
$ npx skills add wshobson/agents --skill attack-tree-construction -a claude-code

Project install by default; add -g for ~/.claude/skills/.

GitHub CLI
$ gh skill install wshobson/agents attack-tree-construction --agent claude-code

Project scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).

Manual copy
$ git clone --depth 1 https://github.com/wshobson/agents.git skills-src && mkdir -p .claude/skills && cp -r skills-src/plugins/security-scanning/skills/attack-tree-construction .claude/skills/attack-tree-construction && rm -rf skills-src

Use ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.

Claude Code skills documentation · loads skills from .claude/skills/

Facts

Skill name
attack-tree-construction
GitHub stars
40k
Used in
7 other repos
Token cost
~623 tokens
SKILL.md length
186 words
Files
2 (incl. references)
Skills in repo
142
Repo updated
First seen
Licence
MIT

At a glance

Builds attack trees that map how an attacker could reach a goal, with AND and OR nodes and cost, time, skill and detection ratings, to find defense gaps.

  • Works in 3 steps: Attack Tree Structure → Node Types → Attack Attributes
  • Mapping the ways an attacker could reach a specific goal against a system
  • SKILL.md covers When to Use This Skill, Core Concepts, Templates and detailed worked… and Best Practices
  • Instructions only: no scripts, shell commands, URLs or credentials in SKILL.md

What it does

The skill teaches an agent to draw an attack tree from a single root goal, branching into OR nodes where any child achieves the goal, AND nodes where every child is required, and leaf nodes for atomic attack steps. Each step is rated on cost, time, required skill and likelihood of detection so that paths can be compared and prioritized.

It frames trees as a defensive tool for visualizing complex scenarios, finding defense gaps, explaining risk to stakeholders, planning defensive spending, planning penetration tests and reviewing security architecture. Best practices include starting from a clear attacker goal, being exhaustive, covering insider threats and mitigations, respecting AND dependencies, keeping the tree current and having a red team review it. Templates and worked examples sit in `references/details.md`.

When your agent uses it

  • Mapping the ways an attacker could reach a specific goal against a system
  • Showing stakeholders where defenses are weakest and what to fund first
  • Preparing the scope of a penetration test
  • Reviewing a security architecture for gaps

Example prompts

  • “Build an attack tree for an attacker trying to steal customer data from our web app and rate each step.”
  • “Show which branches of this attack tree are cheapest and least likely to be detected.”
  • “Turn our threat model into an attack tree I can present to the leadership team.”

Workflow steps

3 steps, taken from the step headings in SKILL.md.

  1. Attack Tree Structure
  2. Node Types
  3. Attack Attributes

What it can do on your machine

Read from SKILL.md and the folder at commit 46891e7. It shows what the files ask for, not the result of running them.

  • Tool permissions

    Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.

    From allowed-tools in the SKILL.md frontmatter.

  • Runs code

    No scripts in the folder and no shell commands in SKILL.md.

    From the folder's file list and the shell code blocks in SKILL.md.

  • Network

    No URLs in SKILL.md.

    From URLs in SKILL.md, links to its own repository left out.

  • Credentials

    Names no API keys, tokens, secrets or passwords.

    From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.

Context cost

Attack Tree Construction loads about 623 tokens when it runs, and up to ~5.6k if it reads all its reference files. Until then it costs about 49 tokens; SKILL.md has 186 words of instructions outside code blocks.

Always · name and description, kept in context so the agent knows when to use it
~49
When it runs · the whole SKILL.md, loaded when a task matches
~623
With references · SKILL.md plus every file in references/, read only if the agent opens them
~5.6k

Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.

Safety

Auto-check passed

The automated check found no risky patterns in SKILL.md.

Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); files beside SKILL.md are not scanned.

SKILL.md

The full file from wshobson/agents at commit 46891e7, republished under its MIT licence (© wshobson). 186 words, ~623 tokens.

Download SKILL.mdSave it as .claude/skills/attack-tree-construction/SKILL.md (or your agent's skills folder). This skill also uses 1 other file; get the full folder from GitHub.
name
attack-tree-construction
description
Build comprehensive attack trees to visualize threat paths. Use when mapping attack scenarios, identifying defense gaps, or communicating security risks to stakeholders.

Attack Tree Construction

Systematic attack path visualization and analysis.

When to Use This Skill

  • Visualizing complex attack scenarios
  • Identifying defense gaps and priorities
  • Communicating risks to stakeholders
  • Planning defensive investments
  • Penetration test planning
  • Security architecture review

Core Concepts

1. Attack Tree Structure
                    [Root Goal]
                         |
            ┌────────────┴────────────┐
            │                         │
       [Sub-goal 1]              [Sub-goal 2]
       (OR node)                 (AND node)
            │                         │
      ┌─────┴─────┐             ┌─────┴─────┐
      │           │             │           │
   [Attack]   [Attack]      [Attack]   [Attack]
    (leaf)     (leaf)        (leaf)     (leaf)
2. Node Types
TypeSymbolDescription
OROvalAny child achieves goal
ANDRectangleAll children required
LeafBoxAtomic attack step
3. Attack Attributes
AttributeDescriptionValues
CostResources needed$, $$, $$$
TimeDuration to executeHours, Days, Weeks
SkillExpertise requiredLow, Medium, High
DetectionLikelihood of detectionLow, Medium, High

Templates and detailed worked examples

Full template library lives in references/details.md. Read that file when you need concrete templates for this skill.

Best Practices

Do's
  • Start with clear goals - Define what attacker wants
  • Be exhaustive - Consider all attack vectors
  • Attribute attacks - Cost, skill, and detection
  • Update regularly - New threats emerge
  • Validate with experts - Red team review
Don'ts
  • Don't oversimplify - Real attacks are complex
  • Don't ignore dependencies - AND nodes matter
  • Don't forget insider threats - Not all attackers are external
  • Don't skip mitigations - Trees are for defense planning
  • Don't make it static - Threat landscape evolves

© wshobson, MIT. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file

Files

SKILL.md and 1 other file (references) in plugins/security-scanning/skills/attack-tree-construction of wshobson/agents.

  • SKILL.md
  • references/details.md

Open the folder on GitHubat commit 46891e7

Used in 7 other repositories

We found 17 copies of this SKILL.md (exact, near-identical or edited) in other folders, from 7 other GitHub owners. This page covers the copy in wshobson/agents, which our catalogue first saw on October 7, 2026.

Compare with similar skills

Attack Tree Construction next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.

Attack Tree Construction compared with similar skills
SkillStarsUsed inTokensAuto-checkLicenceRepo updated
Attack Tree Construction this skillwshobson/agents40k7 repos~623Automated safety check: PassMIT
Security Audit Scannerruvnet/ruflo74k2 repos~823Automated safety check: PassMIT
CSO Security Auditgarrytan/gstack136k—~4.5kAutomated safety check: PassMIT
Behavioral State Analysisquillai-network/quillshield_skills129—~1.4kAutomated safety check: PassMIT
Commit Security Scancodexstar69/bug-hunter519—~629Automated safety check: PassMIT
CybersecurityAgriciDaniel/claude-cybersecurity227—~11kAutomated safety check: WarnMIT

Similar skills

  • Security Audit Scanner

    ruvnet/ruflo

    Runs claude-flow CLI security scans for input validation, path traversal, SQL injection, XSS, hardcoded secrets and known CVEs, and writes an audit report.

    74k GitHub starsUsed in 2 repos~823 tokens
    SecurityAuto-check passed

  • CSO Security Audit

    garrytan/gstack

    Runs an evidence-first security audit of a codebase through gstack's trusted launcher, with static findings by default and isolated reproduction when enabled.

    136k GitHub stars~4.5k tokensUpdated today
    SecurityAuto-check passed

  • Behavioral State Analysis

    quillai-network/quillshield_skills

    Token-efficient smart contract security auditing via Behavioral State Analysis (BSA).

    129 GitHub stars~1.4k tokensUpdated 6 mo ago
    SecurityAuto-check passed

  • Commit Security Scan

    codexstar69/bug-hunter

    Scan code changes for security vulnerabilities using Bug Hunter-native artifacts and STRIDE context.

    519 GitHub stars~629 tokensUpdated 1 mo ago
    SecurityAuto-check passed

  • Cybersecurity

    AgriciDaniel/claude-cybersecurity

    Ultimate AI-powered cybersecurity code review skill. An agent skill from AgriciDaniel/claude-cybersecurity.

    227 GitHub stars~11k tokensUpdated 5 mo ago
    SecurityAuto-check: warnings

  • Security

    garagon/nanostack

    Use before shipping to production. An agent skill from garagon/nanostack.

    207 GitHub stars~3.7k tokensUpdated 27 days ago
    SecurityAuto-check: notes

More from wshobson/agents

All 142 skills in this repo

  • Cloud Cost Optimization

    wshobson/agents

    Cuts cloud spend across AWS, Azure, GCP and OCI with cost tagging, rightsizing, commitment and spot pricing models, and architecture changes.

    40k GitHub starsUsed in 13 repos~1.7k tokens
    Auto-check passed

  • Billing Automation

    wshobson/agents

    Covers building subscription billing: billing cycles, subscription states, invoice generation, proration, tax handling and dunning for failed payments.

    40k GitHub starsUsed in 12 repos~473 tokens
    Auto-check passed

  • Python Performance Optimization

    wshobson/agents

    Profiles slow Python code with cProfile and memory profilers, then applies targeted fixes for CPU, memory, I/O and query bottlenecks.

    40k GitHub starsUsed in 12 repos~814 tokens
    Auto-check passed

  • Portfolio Risk Metrics

    wshobson/agents

    Covers portfolio risk measurement with VaR, CVaR, Sharpe, Sortino and drawdown, plus guidance on limits, stress tests and tail risk.

    40k GitHub starsUsed in 12 repos~502 tokens
    Auto-check passed

  • DGX Spark Memory and Thermal Ops

    wshobson/agents

    Plans memory headroom, works through out-of-memory failures and watches temperature and power during long ML training jobs on NVIDIA DGX Spark.

    40k GitHub starsUsed in 1 repo~2k tokens
    Auto-check passed

  • Bats Shell Testing Patterns

    wshobson/agents

    Writes unit tests for shell scripts with Bats: error-condition tests, fixtures and mocks, cross-shell checks, parallel runs, helper files and CI integration.

    40k GitHub starsUsed in 11 repos~1.3k tokens
    Auto-check passed

Categories

Questions about Attack Tree Construction

What does Attack Tree Construction do?

Builds attack trees that map how an attacker could reach a goal, with AND and OR nodes and cost, time, skill and detection ratings, to find defense gaps. The skill teaches an agent to draw an attack tree from a single root goal, branching into OR nodes where any child achieves the goal, AND nodes where every child is required, and leaf nodes for atomic attack steps. Each step is rated on cost, time, required skill and likelihood of detection so that paths can be compared and prioritized.

When should I use Attack Tree Construction?

Attack Tree Construction fits situations like: mapping the ways an attacker could reach a specific goal against a system; showing stakeholders where defenses are weakest and what to fund first; preparing the scope of a penetration test; reviewing a security architecture for gaps.

How do I install Attack Tree Construction in Claude Code?

Run `npx skills add wshobson/agents --skill attack-tree-construction -a claude-code`. Or copy the skill folder (plugins/security-scanning/skills/attack-tree-construction in wshobson/agents) into .claude/skills/attack-tree-construction in your project. Claude Code loads it when a task matches its description.

How do I install Attack Tree Construction in Codex?

Run `npx skills add wshobson/agents --skill attack-tree-construction -a codex`. Or copy the skill folder (plugins/security-scanning/skills/attack-tree-construction in wshobson/agents) into .agents/skills/attack-tree-construction in your project. Codex loads it when a task matches its description.

Can I use Attack Tree Construction in Cursor, Gemini CLI or GitHub Copilot?

Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add wshobson/agents --skill attack-tree-construction -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/attack-tree-construction, .gemini/skills/attack-tree-construction, .github/skills/attack-tree-construction and .opencode/skills/attack-tree-construction in your project.

What does Attack Tree Construction need to run?

SKILL.md names no scripts, command-line tools or credentials: Attack Tree Construction is instructions for the agent only.

Does Attack Tree Construction access the network?

SKILL.md contains no URLs. Any network use would come from the scripts or tools the agent runs. This is read from the text; nothing was executed.

Is Attack Tree Construction safe to install?

Our automated static check of SKILL.md found no risky patterns, such as piping downloads into a shell, reading credential files or hidden Unicode. It is not a guarantee. Review the folder before installing.

What licence does Attack Tree Construction use?

Attack Tree Construction is published under the MIT licence (the repository's licence). It allows redistribution, so the full SKILL.md is shown on this page.

How many tokens does Attack Tree Construction use?

About 623 tokens (SKILL.md is roughly 2.5k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full. Its references folder adds about 5k tokens, read only when the agent opens those files.

What are the alternatives to Attack Tree Construction?

Skills that share tags, products or a category with Attack Tree Construction: Security Audit Scanner (ruvnet/ruflo, 74k stars), CSO Security Audit (garrytan/gstack, 136k stars), Behavioral State Analysis (quillai-network/quillshield_skills, 129 stars) and Commit Security Scan (codexstar69/bug-hunter, 519 stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.

Who maintains Attack Tree Construction?

wshobson (a GitHub user) maintains it in wshobson/agents, which has 40,254 GitHub stars. The repository holds 142 skills in this directory. The repository was last updated on October 5, 2026.

Source: wshobson/agents on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.