attack-tree-construction

Use it when:: You're mapping how an attacker could reach a goal, planning a penetration test, or explaining security risks and defensive priorities to stakeholders.
Attack tree:: A goal at the root, split into sub-goals; an OR node needs any one child, an AND node all of them, and leaves are single attack steps.
You get:: A tree whose attacks are rated by cost, time, skill and detection risk, exportable as a Mermaid or PlantUML diagram.
Finds:: The easiest, cheapest and stealthiest paths, the nodes most paths go through, open paths left by your mitigations, and which mitigations to do first.

TL;DR

An attack tree starts from what an attacker wants, such as taking over an account, and breaks it down into the ways to get there. This skill gives the agent the structure and the attributes to rate each attack: cost, time, skill needed and likelihood of detection. Its Python templates model nodes and trees, build them step by step with a builder (an account-takeover tree is the example), export them as Mermaid or PlantUML diagrams, and analyze them: every path to the goal, each path's difficulty and cost, the nodes that appear in the most paths, how many paths your mitigations block, and which mitigations block the most. The rules: start from clear attacker goals, consider every vector including insiders, respect what AND nodes require, have a red team review the tree, keep it updated, and use it to plan defenses rather than stopping at the diagram.

Summarizes the skill at 4bde316.

npx skills add https://github.com/wshobson/agents --skill attack-tree-construction

skills.sh page Source on GitHub All skills from wshobson/agents

Total Downloads: 18,700 on skills.sh, Nov 9, 2026
Repo stars: 42,334 wshobson/agents
First seen: Jan 20, 2026 on skills.sh

Weekly Downloads

429

-39% over the 8 weeks to Nov 9

Weekly values

Week to	Installs
Sep 21	701
Sep 28	996
Oct 5	1,191
Oct 12	827
Oct 19	697
Oct 26	782
Nov 2	763
Nov 9	429

Category	category:security category:software-engineering Compliance, guardrails, skill vetting and browser fingerprinting. Everything for building software: planning, coding, debugging, design, frameworks, cloud, agents and skills.
Type	type:guidelines Knowledge and rules the agent applies while it works: best practices, design principles, API references.
Effect	effect:none Adds no side effects of its own. It shapes how the agent thinks, writes or reviews. Guidelines and routers are always effect:none, even when the task they support edits code.
Needs	needs:none Instructions only. Works in any agent that supports skills.
Publisher	by:community Everyone else. Unverified vendor claims default to community.
Topics	security diagrams

SKILL.md

From wshobson/agents at 4bde316. Checked daily, last changed Nov 6, 2026.

Frontmatter

name: attack-tree-construction
description: Build comprehensive attack trees to visualize threat paths. Use when mapping attack scenarios, identifying defense gaps, or communicating security risks to stakeholders.

Attack Tree Construction

Systematic attack path visualization and analysis.

When to Use This Skill

Visualizing complex attack scenarios
Identifying defense gaps and priorities
Communicating risks to stakeholders
Planning defensive investments
Penetration test planning
Security architecture review

Core Concepts

1. Attack Tree Structure

                    [Root Goal]
                         |
            ┌────────────┴────────────┐
            │                         │
       [Sub-goal 1]              [Sub-goal 2]
       (OR node)                 (AND node)
            │                         │
      ┌─────┴─────┐             ┌─────┴─────┐
      │           │             │           │
   [Attack]   [Attack]      [Attack]   [Attack]
    (leaf)     (leaf)        (leaf)     (leaf)

2. Node Types

Type	Symbol	Description
OR	Oval	Any child achieves goal
AND	Rectangle	All children required
Leaf	Box	Atomic attack step

3. Attack Attributes

Attribute	Description	Values
Cost	Resources needed	$, $$, $$$
Time	Duration to execute	Hours, Days, Weeks
Skill	Expertise required	Low, Medium, High
Detection	Likelihood of detection	Low, Medium, High

Templates and detailed worked examples

Full template library lives in references/details.md. Read that file when you need concrete templates for this skill.

Best Practices

Do's

Start with clear goals - Define what attacker wants
Be exhaustive - Consider all attack vectors
Attribute attacks - Cost, skill, and detection
Update regularly - New threats emerge
Validate with experts - Red team review

Don'ts

Don't oversimplify - Real attacks are complex
Don't ignore dependencies - AND nodes matter
Don't forget insider threats - Not all attackers are external
Don't skip mitigations - Trees are for defense planning
Don't make it static - Threat landscape evolves