What is an attack tree?

An attack tree is a structured diagram representing various ways a system can be attacked, with the root representing the attacker's goal and branches representing sub-goals or specific methods.

Can I export the attack trees created by this skill?

Yes, the skill provides Python templates to generate and export attack trees in structured JSON format for use in documentation or external security tools.

How does this skill help with security audits?

It provides a systematic framework to visualize entry points and attack paths, making it easier to identify where mitigations are missing or where defense-in-depth is required.

What is the difference between AND and OR nodes?

OR nodes indicate that any one of the child steps can achieve the goal (redundant paths), while AND nodes indicate that all child steps are required for a successful attack (sequential or simultaneous dependencies).

Security Attack Tree Construction

Name: Security Attack Tree Construction
Author: pur3v4d3r

bypur3v4d3r

•

Security & Testing

Constructs systematic attack path visualizations to identify security vulnerabilities and prioritize defensive gaps.

This skill enables Claude to build comprehensive attack trees for threat modeling and security analysis. By mapping potential attack vectors using logical AND/OR nodes and quantifying them with attributes like cost, difficulty, and detection risk, it helps developers and security professionals visualize complex threats. It is particularly useful for planning defensive investments, conducting security architecture reviews, and communicating technical risks to stakeholders through structured data models.

Key Features

01Identifies unmitigated security vulnerabilities and defense gaps

02Visualizes complex multi-step attack scenarios using logical trees

03Generates structured Python and JSON-based attack models

041 GitHub stars

05Calculates path difficulty, cost, and detection risk metrics

06Supports hierarchical AND/OR logic for atomic attack steps

Use Cases

01Security architecture reviews for new software systems

02Scoping and planning penetration testing scenarios

03Developing risk-based defense investment strategies for stakeholders

What are Skills?·How to Install

Install with 🐟 Skill.Fish

npx skillfish add pur3v4d3r/pur3-pkb-codebase attack-tree-construction

For use in Claude.ai and ChatGPT

Download Skill