skills.rest
SanketAdlak
SanketAdlakCOMMUNITY
Explore all skills by this author →
Website𝕏@devsanket14GitHub

attack-tree-construction

Build attack trees modeling threat paths with AND/OR logic, attributes, and diagram exports.

Updated Apr 23, 2026
Search Tags:#mermaid#python#threat modeling#security analysis#risk assessment#mitigation#attack tree
One-click install
npx skills add https://github.com/SanketAdlak/PDMProjectDesign --skill attack-tree-construction-sanketadlak
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: attack-tree-construction
Source: https://github.com/SanketAdlak/PDMProjectDesign/tree/main/.agents/skills/attack-tree-construction
Command: npx skills add https://github.com/SanketAdlak/PDMProjectDesign --skill attack-tree-construction-sanketadlak

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Security teams struggle to systematically visualize how attackers could reach a goal, making it hard to identify defense gaps, prioritize mitigations, and communicate risks to stakeholders. ## Core Features & Use Cases - Structured Attack Tree Modeling: Define root goals, OR/AND sub-goals, and leaf attacks with attributes like difficulty, cost, detection risk, and time using a Python data model and fluent builder. - Path Analysis & Mitigation Prioritization: Find the easiest, cheapest, or stealthiest attack paths, run coverage analysis against mitigations, and rank mitigations by impact. - Diagram Export: Generate Mermaid flowcharts and PlantUML mindmaps for stakeholder communication. - Use Case: During a security architecture review, model an account takeover scenario with phishing, credential stuffing, and session hijacking branches, then identify which mitigations block the most attack paths. ## Quick Start Build an attack tree for account takeover showing credential theft and authentication bypass paths, then export it as a Mermaid diagram.

Frequently Asked Questions about attack-tree-construction

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I build an attack tree in Python?▼

Use the AttackTreeBuilder fluent API: define a root goal, add OR or AND sub-goals with or_node and and_node, attach leaf attacks with attributes like difficulty and cost, then call build(). The result is an AttackTree you can analyze or export.

What is the difference between AND and OR nodes in attack trees?▼

OR nodes mean any single child achieves the goal, so path analysis picks the easiest child. AND nodes require all children to succeed, so costs are summed and difficulty takes the maximum across children.

How do I prioritize security mitigations using attack trees?▼

Use the AttackPathAnalyzer prioritize_mitigations method, which counts how many attack paths each leaf node appears in and ranks mitigations by coverage impact. The coverage_analysis method shows the percentage of paths blocked by a given mitigation set.

Can I export attack trees to Mermaid or PlantUML diagrams?▼

Yes, the MermaidExporter generates flowchart syntax with node shapes by type and colors by difficulty, while PlantUMLExporter produces mindmap diagrams. Both traverse the tree recursively from the root node.

What are the limitations of attack tree analysis?▼

Attack trees depend on manual completeness, so missing attack vectors skew results. Attribute values like difficulty and cost are subjective estimates, and trees require regular updates as the threat landscape evolves.

Related Skills

Explore More Software Engineering Skills→
dajneem23dajneem23

security-threat-model

Generate repository-grounded threat models with trust boundaries, assets, and mitigations.

Community
Advanced
Sumeet138Sumeet138
1

threat-mitigation-mapping

Map threats to security controls and compute coverage and defense-in-depth metrics.

Community
Advanced
EngineerWithAIEngineerWithAI
4

attack-tree-construction

Construct and analyze attack trees with OR and AND nodes.

Official
Advanced
Jayarr03Jayarr03

attack-path-simulator

Simulate attacker paths and generate kill chain reports from security reviews.

Community
Advanced