Attack Tree Construction

Maps out attack scenarios by building hierarchical threat trees with AND/OR logic gates, cost estimates, and difficulty ratings. You'd use this during threat modeling sessions, security reviews, or when explaining attack paths to management. Creates structured data models with attributes like detection risk and time requirements, then finds optimal attack paths based on cost, stealth, or difficulty. The real value is turning abstract security discussions into concrete visualizations that show exactly how attackers might chain techniques together. Beats drawing boxes on whiteboards and helps prioritize defensive investments based on actual threat paths.

skills.sh installs: 18.8K
GitHub stars: 42.4K
last updated: Aug 21, 2026

View on GitHub

Install

$ npx -y skills add wshobson/agents --skill attack-tree-construction --agent claude-code

Installs into .claude/skills of the current project.

Files

Attack Tree Construction

Systematic attack path visualization and analysis.

When to Use This Skill

Visualizing complex attack scenarios
Identifying defense gaps and priorities
Communicating risks to stakeholders
Planning defensive investments
Penetration test planning
Security architecture review

Core Concepts

1. Attack Tree Structure

                    [Root Goal]
                         |
            ┌────────────┴────────────┐
            │                         │
       [Sub-goal 1]              [Sub-goal 2]
       (OR node)                 (AND node)
            │                         │
      ┌─────┴─────┐             ┌─────┴─────┐
      │           │             │           │
   [Attack]   [Attack]      [Attack]   [Attack]
    (leaf)     (leaf)        (leaf)     (leaf)