attack-tree-construction Skill (wshobson) for Claude Code

Helps your agent build attack trees for threat modeling, with Python templates for scoring paths, drawing diagrams and ranking defenses.

Installs: 18.3K; on skills.sh
Stars: 42.1K; on GitHub
Files: 1; besides SKILL.md
Updated: Oct 2026; last repo commit

The skill teaches your agent to model a threat as an attack tree. A root goal splits into sub-goals, with OR nodes where any child works and AND nodes where all are needed, ending in single attack steps. Each step carries cost, time, skill and detection attributes.

SKILL.md holds the concepts and best practices. The templates are in references/details.md: a data model, a builder, Mermaid and PlantUML exporters, and a path analyzer. It loads when you map attack scenarios, find defense gaps or plan defensive spending.

Good for

Security architects mapping how an attacker could reach a goal
Teams explaining risk to non-technical stakeholders with a diagram
Defenders deciding which gaps to fix first

Install attack-tree-construction

Claude Code

Copy this prompt.

Install the attack-tree-construction skill in Claude Code. Run this command:

npx skills add https://github.com/wshobson/agents --skill attack-tree-construction

Then check that it loaded and tell me how to use it.

2
Paste it into Claude Code. It shows the change and asks before running it.

Requires Node.js.

From its listing on skills.sh. Source.

What's in the skill

When it loads

Build comprehensive attack trees to visualize threat paths. Use when mapping attack scenarios, identifying defense gaps, or communicating security risks to stakeholders.

Sections in SKILL.md

When to Use This Skill
Core Concepts
1. Attack Tree Structure
2. Node Types
3. Attack Attributes
Templates and detailed worked examples
Best Practices
Do's
Don'ts

Key facts

Author: wshobson
Repo: wshobson/agents, folder plugins/security-scanning/skills/attack-tree-construction
Installs on skills.sh: 18,281 as of 2026-11-02
GitHub stars: 42,081 for the whole wshobson/agents repo
License: MIT (as detected by GitHub)
Last repo commit: 2026-10-30
What is inside: 2 files including SKILL.md; 1 reference file with 4 Python templates
skills.sh audits: Gen Agent Trust Hub: pass; Socket: warn; Snyk: pass

What it includes

Root goal, OR and AND nodes, leaves
A tree from a root goal down to atomic attack steps. OR nodes need any child, AND nodes need all children.
Read · Attack tree structure
Cost, time, skill, detection
Each attack is rated on cost ($ to $$$), time (hours to weeks), skill (low to high) and detection likelihood.
Read · Attack attributes
Python classes for nodes, attributes, trees
Defines node types, difficulty, cost and detection enums, attack nodes and a tree with easiest, cheapest and stealthiest path finders, plus JSON export.
Write · Template 1: data model
Fluent builder and an account takeover example
A builder with goal, OR, AND and attack steps, and a worked account takeover tree.
Write · Template 2: builder
Mermaid and PlantUML output
Turns a tree into Mermaid or PlantUML text so you can draw it.
Write · Template 3: diagram exporters
Paths, critical nodes, coverage, priorities
Lists all attack paths, finds critical nodes, checks coverage by mitigations and ranks which mitigations to do first.
Write · Template 4: path analysis
Five dos and five don'ts
Start with a clear goal, be exhaustive, attribute each attack, update regularly and validate with experts. Do not oversimplify, ignore dependencies, forget insiders, skip mitigations or leave the tree static.
Read · Best practices

From the official docs

Questions

What does attack-tree-construction do?

It helps your agent build attack trees, which are diagrams of how an attacker could reach a goal. You get a structure, scoring attributes and Python templates for analysis and diagrams.

How do I install it?

Use the install box at the top of this page for this one skill. The wshobson/agents README also describes plugin routes that install a larger set with agents and commands.

Does it need an API key?

No. SKILL.md names no API key or service. The templates are plain Python that you run yourself if you want to.

Can it draw the diagram?

It gives templates that output Mermaid and PlantUML text. You render that text in a tool of your choice.

Is it for attackers?

It is framed for defense. SKILL.md lists identifying defense gaps, communicating risk and planning defensive investment, and also penetration test planning.

Is it safe?

It bundles no scripts to run. The templates are Python code the agent may write into your project, so review it like any generated code.

Information

updated Nov 2, 2026

Repository: wshobson/agents
Folder: plugins/security-scanning/skills/attack-tree-construction

wshobson/agents skills.sh

Sources

Docs, issue trackers and discussions this page is built from.

Show all 4

attack-tree-construction SKILL.md · github.com
attack-tree-construction details.md · github.com
attack-tree-construction on skills.sh · skills.sh
wshobson/agents · github.com