Attack Tree Construction

Build comprehensive attack trees to visualize threat paths. Use when mapping attack scenarios, identifying defense gaps, or communicating security risks to stakeholders.

1 minute · 185 words · 9 sections

Install

$ npx skills add wshobson/agents --skill attack-tree-construction

$ npx skills add wshobson/agents

» /plugin marketplace add wshobson/agents

The first command installs just this skill, by the name in its SKILL.md; the second installs the whole repository.

Systematic attack path visualization and analysis.

When to Use This Skill

Visualizing complex attack scenarios
Identifying defense gaps and priorities
Communicating risks to stakeholders
Planning defensive investments
Penetration test planning
Security architecture review

Core Concepts

1. Attack Tree Structure

                    [Root Goal]
                         |
            ┌────────────┴────────────┐
            │                         │
       [Sub-goal 1]              [Sub-goal 2]
       (OR node)                 (AND node)
            │                         │
      ┌─────┴─────┐             ┌─────┴─────┐
      │           │             │           │
   [Attack]   [Attack]      [Attack]   [Attack]
    (leaf)     (leaf)        (leaf)     (leaf)

2. Node Types

Type	Symbol	Description
OR	Oval	Any child achieves goal
AND	Rectangle	All children required
Leaf	Box	Atomic attack step

3. Attack Attributes

Attribute	Description	Values
Cost	Resources needed	$, $$, $$$
Time	Duration to execute	Hours, Days, Weeks
Skill	Expertise required	Low, Medium, High
Detection	Likelihood of detection	Low, Medium, High

Templates and detailed worked examples

Full template library lives in references/details.md. Read that file when you need concrete templates for this skill.

Best Practices

Do’s

Start with clear goals - Define what attacker wants
Be exhaustive - Consider all attack vectors
Attribute attacks - Cost, skill, and detection
Update regularly - New threats emerge
Validate with experts - Red team review

Don’ts

Don’t oversimplify - Real attacks are complex
Don’t ignore dependencies - AND nodes matter
Don’t forget insider threats - Not all attackers are external
Don’t skip mitigations - Trees are for defense planning
Don’t make it static - Threat landscape evolves

Appendix 152.1

1 file · 19 KB

Everything this skill ships beside its prose. All of it is set here, as a subchapter of skill 152.

ReferencesMarkdown · 1 file

Documentation the agent loads on demand, rather than up front.

152.1Detailsreferences/details.md19 KB

Colophon for this issue

Colophon

How this issue was made

Source: github.com/wshobson/agents, branch main, last pushed 21 September 2026.
Licence: MIT — the text of every skill is reproduced unmodified, frontmatter included, under the upstream licence.
Discovery: 183 skills found by walking the repository tree for SKILL.md, not by matching a directory convention. 51 distinct layouts observed: plugins/accessibility-compliance/skills/*/SKILL.md, plugins/agent-teams/skills/*/SKILL.md, plugins/api-scaffolding/skills/*/SKILL.md, plugins/avoid-ai-writing/skills/*/SKILL.md, plugins/backend-development/skills/*/SKILL.md, plugins/before-you-build/skills/*/SKILL.md, plugins/block-no-verify/skills/*/SKILL.md, plugins/blockchain-web3/skills/*/SKILL.md, plugins/brand-landingpage/skills/*/SKILL.md, plugins/business-analytics/skills/*/SKILL.md, plugins/cicd-automation/skills/*/SKILL.md, plugins/cloud-infrastructure/skills/*/SKILL.md, plugins/conductor/skills/*/SKILL.md, plugins/data-engineering/skills/*/SKILL.md, plugins/database-design/skills/*/SKILL.md, plugins/developer-essentials/skills/*/SKILL.md, plugins/dgx-spark-ops/skills/*/SKILL.md.