AutoGineer
Generated banner for Attack Tree Construction
Generated logo for Attack Tree Construction

Attack Tree Construction

Seth HobsonCommunityCreated by Seth Hobson

  • Skill
  • Guidelines
  • Security
  • MIT
  • No issues found
Download ZIP

From the author

Build comprehensive attack trees to visualize threat paths. Use when mapping attack scenarios, identifying defense gaps, or communicating security risks to stakeholders.
— the description by Seth Hobson

AutoGineer summary

Written by AutoGineer from the skill’s own files, not by the author

Attack Tree Construction provides a structured methodology for modeling security threats by breaking down high-level goals into granular, actionable attack steps. By utilizing a hierarchical tree structure with AND/OR logic, this skill enables security professionals to map complex threat scenarios, identify critical defense gaps, and prioritize investments based on quantitative attributes like cost, time, skill requirements, and detection risk.

What it does

  • Visualizes complex attack scenarios through hierarchical tree structures.
  • Defines attack paths using logical AND/OR nodes to represent dependencies.
  • Assigns quantitative attributes such as cost, time, and skill to attack steps.
  • Identifies critical defense gaps by analyzing potential threat vectors.
  • Supports risk communication by providing a clear visual model for stakeholders.
  • Facilitates data-driven security planning using structured modeling templates.

When to use it

  • During security architecture reviews to identify potential vulnerabilities.
  • When planning penetration tests to ensure comprehensive coverage.
  • For communicating specific security risks and threat paths to non-technical stakeholders.
  • When prioritizing defensive investments based on the difficulty or cost of an attack.
  • To map out potential insider and external threat scenarios.

Advantages

  • Provides a clear, logical representation of complex security threats.
  • Allows for the quantification of attack paths to aid in risk prioritization.
  • Helps uncover hidden dependencies and defense gaps.
  • Standardizes the approach to threat modeling across teams.
  • Supports both qualitative and quantitative security analysis.

Usage examples

“Create an attack tree for a web application login bypass.”
The agent generates a hierarchical tree starting with the root goal, branching into sub-goals like credential stuffing or session hijacking, and defining leaf nodes for specific attack steps.
“Analyze the cost and difficulty of an unauthorized database access attack.”
The agent maps the attack path, assigns cost and skill attributes to each node, and calculates the aggregate difficulty to identify the most likely path an attacker would take.

Install

  1. Download the skill as a ZIP:

    https://mp-staging.autogineer.com/agent-skills/wshobson/attack-tree-construction/download

  2. Unzip it into the cross-client skills folder of your project:

    mkdir -p .agents/skills && unzip attack-tree-construction.zip -d .agents/skills

Documentation by Seth Hobson

Attack Tree Construction

Systematic attack path visualization and analysis.

When to Use This Skill

  • Visualizing complex attack scenarios

  • Identifying defense gaps and priorities

  • Communicating risks to stakeholders

  • Planning defensive investments

  • Penetration test planning

  • Security architecture review

Core Concepts

1. Attack Tree Structure
                    [Root Goal]
                         |
            ┌────────────┴────────────┐
            │                         │
       [Sub-goal 1]              [Sub-goal 2]
       (OR node)                 (AND node)
            │                         │
      ┌─────┴─────┐             ┌─────┴─────┐
      │           │             │           │
   [Attack]   [Attack]      [Attack]   [Attack]
    (leaf)     (leaf)        (leaf)     (leaf)
2. Node Types
TypeSymbolDescription
OROvalAny child achieves goal
ANDRectangleAll children required
LeafBoxAtomic attack step
3. Attack Attributes
AttributeDescriptionValues
CostResources needed$, $$, $$$
TimeDuration to executeHours, Days, Weeks
SkillExpertise requiredLow, Medium, High
DetectionLikelihood of detectionLow, Medium, High

Templates and detailed worked examples

Full template library lives in references/details.md. Read that file when you need concrete templates for this skill.

Best Practices

Do's

  • Start with clear goals - Define what attacker wants

  • Be exhaustive - Consider all attack vectors

  • Attribute attacks - Cost, skill, and detection

  • Update regularly - New threats emerge

  • Validate with experts - Red team review

Don'ts

  • Don't oversimplify - Real attacks are complex

  • Don't ignore dependencies - AND nodes matter

  • Don't forget insider threats - Not all attackers are external

  • Don't skip mitigations - Trees are for defense planning

  • Don't make it static - Threat landscape evolves

Files

Requirements and compatibility

Works with: Claude Code, Claude apps, OpenAI Codex, GitHub Copilot, Cursor, Gemini CLI, Kiro, OpenCode, Goose, Amp, Roo Code, JetBrains Junie, Factory Droid, Devin (ex-Windsurf), Mistral Vibe, OpenHands, Letta

“Works with” means the tool reads the open Agent Skills format; a skill written for one tool may use features others lack.

Needs: Needs Node.js

Security

No issues found by our static scan· No issues found

A static scan is not a guarantee. Skills are third-party content: review a skill before you let an agent use it.

Attribution and licence

Created by
Seth Hobson
Publisher
Seth Hobson (Community)
Source
wshobson/agents · plugins/security-scanning/skills/attack-tree-construction · commit 4bde316
Licence
MIT License (redistribution allowed)
  • LICENSE (added by AutoGineer from LICENSE)
  • ATTRIBUTION.md (written by AutoGineer)
Synced

AutoGineer is not affiliated with or endorsed by Seth Hobson.

Download ZIP

The ZIP holds the skill’s files, its licence files and an ATTRIBUTION.md. Download attack-tree-construction.zip