# Build Defensible Attack Trees

Complex threats are difficult to compare when attack paths and dependencies remain implicit. This skill structures paths, scores leaf nodes, maps mitigations, and highlights defense priorities.

## Install

```bash
npx skillstore add sickn33/attack-tree-construction
```

## Metadata

- Status: approved
- Slug: sickn33-attack-tree-construction
- Skillstore revision: r2
- Version status: missing
- Tree hash: 20b9be9fbccd86d6d08a34850a10803bd742fbaf7d9d5810404922625ceda386
- Author: sickn33
- GitHub username: sickn33
- License: MIT
- Repository: https://github.com/sickn33/antigravity-awesome-skills/tree/main/skills/attack-tree-construction
- Ref: 86d877f219e2131f05dd5b37c5e329c71c7b8ec4
- Supported tools: Claude, Codex, Claude Code
- Audit status: complete
- Agent install advisory: allowed
- Manual install advisory: allowed
- Artifact signature: available
- Audit attestation: unavailable
- Human verification: not\_verified
- Risk factors: external\_commands
- Quality score: 70
- Public page: https://skillstore.pages.dev/skills/sickn33-attack-tree-construction
- Manifest: https://skillstore.pages.dev/api/skills/sickn33-attack-tree-construction/manifest

## Capabilities

- Defines attacker goals and decomposes them into AND and OR branches.
- Annotates leaf attacks with difficulty, cost, time, detection risk, and mitigations.
- Identifies easiest, cheapest, and lowest-detection paths from supplied tree data.
- Analyzes mitigation coverage and highlights nodes shared across multiple paths.
- Provides reference patterns for Mermaid, PlantUML, and structured data exports.
- Prioritizes mitigations by their estimated impact across modeled paths.

## Use Cases

- Design Security Controls: Map likely paths to a protected asset and identify controls that interrupt the most branches.
- Scope Authorized Assessments: Turn an approved attacker objective into explicit test paths, assumptions, and defensive validation targets.
- Explain Risk Priorities: Present threat dependencies and mitigation coverage in a structure that supports investment decisions.

## Prompt Templates

### Create a Basic Tree

```
Create an attack tree for [system]. Use [authorized attacker goal] as the root. Separate AND and OR nodes. Add one mitigation per leaf.
```

### Add Path Attributes

```
Expand this attack tree: [tree]. Rate each leaf by cost, skill, time, and detection risk. State assumptions and suggest defensive controls.
```

### Analyze Mitigation Coverage

```
Review [tree] and [existing controls]. Identify open paths, shared critical nodes, and controls with the greatest estimated coverage. Keep attack details non-operational.
```

### Compare Defensive Scenarios

```
Compare the current and proposed controls for [authorized scope]. Recalculate path exposure, explain uncertainty, and produce separate technical and executive summaries.
```

## Limitations

- Does not validate assumptions against a live environment or execute security tests.
- Scores depend on analyst judgment and are not calibrated with empirical threat data.
- Provides reference snippets, not a tested application or executable package.
- Can expose sensitive attack paths if outputs are shared beyond authorized stakeholders.

## Best Practices

- Confirm authorization, scope, protected assets, and the attacker goal before building the tree.
- Record assumptions and use consistent scales for difficulty, cost, time, and detection.
- Attach mitigations to every leaf and review the model with relevant technical experts.

## Anti Patterns

- Do not include operational exploit steps, malware instructions, or real credentials.
- Do not treat subjective scores as measured probabilities or verified environment facts.
- Do not publish sensitive attack paths outside the authorized stakeholder group.

## Security Audit

- Audited at: 2026-07-23T20:23:53.109\+00:00
- Summary: All 11 static detections are false positives. The backticks delimit file paths, the reconnaissance matches are ordinary tree-processing code, and the keylogger term is a labeled threat with mitigations. One medium semantic concern remains because the playbook ranks low-effort and low-detection attack paths while conditionally allowing sensitive exploit details.

## Stats

- Views: 116
- Downloads: 8
- Favorites: 0
- Popularity score: 0