attack-tree-construction
wshobson/agents
Visualize attack scenarios and defense gaps with systematic threat path mapping.
What is attack-tree-construction?
Build comprehensive attack trees to model how attackers might achieve goals through different paths. Use when planning security architecture, identifying vulnerabilities, communicating risks to stakeholders, or preparing for penetration testing.
- Model complex attack scenarios with OR/AND logic nodes
- Attribute attacks with cost, time, skill, and detection likelihood
- Identify defense gaps and prioritize security investments
- Visualize dependencies between attack steps
- Support red team planning and security reviews
- Communicate threat paths to non-technical stakeholders
How to install attack-tree-construction
npx skills add https://github.com/wshobson/agents --skill attack-tree-constructionHow to use attack-tree-construction
- 1.Define the root goal (what the attacker wants to achieve)
- 2.Identify sub-goals and break them into atomic attack steps
- 3.Assign node types: OR (any child succeeds) or AND (all children required)
- 4.Add attributes to leaf nodes: cost, time, skill level, detection likelihood
- 5.Review with red team or security experts for completeness
- 6.Update the tree as new threats emerge or defenses change
Use cases
- Planning defensive investments by analyzing attack feasibility and cost
- Reviewing security architecture to find unexplored attack vectors
- Preparing penetration test scope by mapping realistic attack paths
- Communicating security risks to executives with visual threat models
- Identifying insider threat scenarios alongside external attacks
- Security architects
- Penetration testers
- Risk managers
- Security engineers
- Threat analysts
attack-tree-construction FAQ
OR nodes mean an attacker can achieve the goal through any one of the child paths. AND nodes require all child steps to succeed—useful for modeling dependencies or multi-stage attacks.
Start with high-level goals and expand branches that are most likely or impactful. Avoid over-granularity; leaf nodes should represent atomic, realistic attack steps.
Yes. Attack trees should model both external and internal threat actors. Insider paths often have lower skill/cost requirements and higher success rates.
Review quarterly or when significant changes occur: new technologies, architecture changes, or emerging threat intelligence.
Yes. They demonstrate systematic threat analysis and risk-based defense planning, supporting security governance and audit requirements.
Full instructions (SKILL.md)
Source of truth, from wshobson/agents.
name: attack-tree-construction description: Build comprehensive attack trees to visualize threat paths. Use when mapping attack scenarios, identifying defense gaps, or communicating security risks to stakeholders.
Attack Tree Construction
Systematic attack path visualization and analysis.
When to Use This Skill
- Visualizing complex attack scenarios
- Identifying defense gaps and priorities
- Communicating risks to stakeholders
- Planning defensive investments
- Penetration test planning
- Security architecture review
Core Concepts
1. Attack Tree Structure
[Root Goal]
|
┌────────────┴────────────┐
│ │
[Sub-goal 1] [Sub-goal 2]
(OR node) (AND node)
│ │
┌─────┴─────┐ ┌─────┴─────┐
│ │ │ │
[Attack] [Attack] [Attack] [Attack]
(leaf) (leaf) (leaf) (leaf)
2. Node Types
| Type | Symbol | Description |
|---|---|---|
| OR | Oval | Any child achieves goal |
| AND | Rectangle | All children required |
| Leaf | Box | Atomic attack step |
3. Attack Attributes
| Attribute | Description | Values |
|---|---|---|
| Cost | Resources needed | $, $$, $$$ |
| Time | Duration to execute | Hours, Days, Weeks |
| Skill | Expertise required | Low, Medium, High |
| Detection | Likelihood of detection | Low, Medium, High |
Templates and detailed worked examples
Full template library lives in references/details.md. Read that file when you need concrete templates for this skill.
Best Practices
Do's
- Start with clear goals - Define what attacker wants
- Be exhaustive - Consider all attack vectors
- Attribute attacks - Cost, skill, and detection
- Update regularly - New threats emerge
- Validate with experts - Red team review
Don'ts
- Don't oversimplify - Real attacks are complex
- Don't ignore dependencies - AND nodes matter
- Don't forget insider threats - Not all attackers are external
- Don't skip mitigations - Trees are for defense planning
- Don't make it static - Threat landscape evolves
Related skills
More from wshobson/agents and the wider catalog.
tailwind-design-system
Build production-ready design systems with Tailwind CSS v4, design tokens, and component libraries.
typescript-advanced-types
Master TypeScript's advanced type system: generics, conditional types, mapped types, and utility types for type-safe applications.
nodejs-backend-patterns
Build production-ready Node.js backends with Express/Fastify, middleware patterns, auth, and database integration.
python-performance-optimization
Profile and optimize Python code using cProfile, memory profilers, and performance best practices.
brand-landingpage
Brand-first landing page designer with guided interviews and Stitch-powered iteration.
python-testing-patterns
Implement comprehensive testing strategies with pytest, fixtures, mocking, and test-driven development.