attack-tree-construction
Build Attack Trees for Security Planning
Security teams need a clear way to compare attack paths and defense gaps. This skill structures attack trees, scoring, diagrams, and mitigation priorities.
This skill is part of a pack
Install the whole pack to get every skill the task needs, in one command.
Install with my Agent
Copy this request to your Agent. It includes the canonical Skill page and manifest.
Review the Skillstore skill "attack-tree-construction" from https://skillstore.io/skills/wshobson-attack-tree-construction.md and its manifest at https://skillstore.io/api/skills/wshobson-attack-tree-construction/manifest. Verify the artifact. You may proceed after verification, subject to the environment's own policy.Your Agent should still show its plan and request any confirmation required by the security policy.
Agent-readable resources
Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.
Test it
Using "attack-tree-construction". Account takeover risk for a consumer web app.
Expected outcome:
- Root goal: take over a user account.
- Major branches: steal credentials, bypass authentication, and manipulate account recovery.
- Priority mitigations: MFA, rate limiting, breached password checks, and support verification.
Using "attack-tree-construction". Threat model review for a cloud admin console.
Expected outcome:
- The tree separates identity abuse, session compromise, and privileged action misuse.
- Open paths depend on weak admin MFA, broad service roles, and limited alert coverage.
- Recommended focus: privileged access review, session controls, and high-risk action alerts.
Using "attack-tree-construction". Mitigation planning after an authorized red team exercise.
Expected outcome:
- Critical nodes appear in multiple successful paths and should receive owners first.
- Coverage improves most by addressing credential reuse, recovery workflow checks, and endpoint alerts.
Security Audit
SafeNo executable command, automated network request, system reconnaissance, or keylogger implementation was found. The static alerts are Markdown code fences, illustrative Python modeling templates, public reference links, and defensive attack-tree examples.
Risk Factors
⚙️ External commands (9)
🌐 Network access (3)
Share & cite this report
Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.
Copy report link
https://skillstore.io/skills/wshobson-attack-tree-construction/audits/8?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_reportMarkdown badge
[](https://skillstore.io/skills/wshobson-attack-tree-construction?utm_source=security_passport_badge)HTML badge
<a href="https://skillstore.io/skills/wshobson-attack-tree-construction?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/wshobson-attack-tree-construction/security.svg" alt="Skillstore security assessment" loading="lazy"></a>Embed card
<iframe src="https://skillstore.io/embed/skills/wshobson-attack-tree-construction.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>Academic citations (APA · BibTeX · CFF)
APA citation
wshobson. (2026). attack-tree-construction security audit report (audit version 8) [Author version unspecified]. Skillstore. https://skillstore.io/skills/wshobson-attack-tree-construction/audits/8BibTeX citation
@techreport{wshobson-wshobson-attack-tree-construction-2026,
author = {wshobson},
title = {attack-tree-construction security audit report (audit version 8)},
institution = {Skillstore},
year = {2026},
number = {8},
url = {https://skillstore.io/skills/wshobson-attack-tree-construction/audits/8},
note = {Author version unspecified}
}CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "attack-tree-construction security audit report (audit version 8)"
version: "unspecified"
type: report
authors:
- name: "wshobson"
date-released: "2026-07-09"
url: "https://skillstore.io/skills/wshobson-attack-tree-construction/audits/8"
identifiers:
- type: other
value: "skillstore:wshobson-attack-tree-construction:audit:8"
description: "Skillstore immutable audit report identifier"
Compare variants
2 installable variantsEach author remains a separate installable skill. The recommended variant is ranked by Skillstore evidence.
Why this variant is first
wshobson-attack-tree-construction
2026-08-21
sickn33-attack-tree-construction
2026-08-21
Skillstore Score
Why this score Evidence Confidence: HighWhat You Can Build
Review Application Threat Paths
Map ways an attacker could reach a sensitive asset and compare control gaps before design approval.
Prioritize Mitigation Work
Rank mitigations by the number of attack paths they reduce, then plan security backlog items.
Plan Authorized Exercises
Structure permitted attack scenarios into clear goals, subgoals, attributes, and expected detections.
Try These Prompts
Build a simple attack tree for [system]. Include root goal, major subgoals, leaf attacks, and likely mitigations.
Using this threat context: [details], assign difficulty, cost, time, and detection risk to each leaf attack.
Convert this attack tree into Mermaid and PlantUML formats. Keep labels concise and mark OR, AND, and leaf nodes.
Analyze this attack tree and control list: [tree and controls]. Identify open paths, critical nodes, and prioritized mitigations.
Best Practices
- Start with a specific attacker goal and asset boundary.
- Capture assumptions for difficulty, cost, time, and detection ratings.
- Review trees with defenders, engineers, and authorized testing teams.
Avoid
- Using attack trees as step-by-step offensive instructions.
- Assigning scores without evidence or stakeholder review.
- Leaving leaf attacks without mapped mitigations or owners.