attack-tree-construction

Systematic visualization and analysis of attack paths with difficulty, cost, and detection metrics.

wshobson/agents|Updated Apr 8, 2026

Works with

Claude CodeCursorClineWindsurfCodexGoose

What it does

Provides Python data models for building attack trees with OR/AND logic, leaf attacks, and attributes (difficulty, cost, detection risk, time required)
Includes fluent builder API for constructing trees programmatically and methods to find easiest, cheapest, and stealthiest attack paths
Exports to Mermaid and PlantUML diagram formats for stakeholder communication and threat visualizati

Repository

wshobson/agents

Last updated

Apr 8, 2026

Installation Guide

Select your AI agent

How to use attack-tree-construction on Cursor

AI-first code editor with Composer

Prerequisites

Before installing skills in Cursor, ensure your development environment meets these requirements:

›Cursor installed and configured on your machine
›Node.js 16+ with npm — verify with node --version
›Active project directory where you want to add attack-tree-construction

Run the install command

Execute the skills CLI command in your project's root directory to begin installation:

$npx skills add https://github.com/wshobson/agents --skill attack-tree-construction

Fetches attack-tree-construction from wshobson/agents and configures it for Cursor.

Select Cursor when prompted

The CLI shows a list of agents. Use arrow keys and space to select Cursor:

◆ Which agents do you want to install to?

│

│ ── Universal (.agents/skills) ────────────────

│ · Cline · Codex · Goose · Windsurf

│ ●Cursor(selected)

│ · Cursor · Aider · Continue

Verify installation

Confirm successful installation by checking the skill directory location:

.cursor/skills/attack-tree-construction

Restart Cursor to activate attack-tree-construction. Access via /attack-tree-construction in your agent's command palette.

⚠

Security Notice

We perform automated surface-level scans (Gen AI Scanner, Socket, Snyk) during installation. These checks detect common vulnerabilities but do not guarantee complete security. Always review skill source code and verify the publisher's reputation before production use.

Skills execute code in your environment. Always review source, verify the publisher, and test in isolation before production.

›View source on GitHub ›Skills CLI docs ›About Cursor ›What are agent skills?

Documentation

List & Monetize Your Skill

Submit your Claude Code skill and start earning

Get started →

Use Cases

User Story & Requirements Generation

Create detailed user stories, acceptance criteria, and feature specs

Example

Generate user stories for 'password reset feature' with acceptance criteria, edge cases, and test scenarios

✓

Reduce spec writing time by 50%, ensure comprehensive coverage

Competitive Analysis

Research competitors, compare features, identify gaps

Example

Analyze 5 competitor products, create feature comparison matrix, suggest differentiation opportunities

✓

Complete competitive research in 2 hours instead of 2 days

Roadmap Prioritization

Evaluate features using frameworks (RICE, ICE, Kano) and create prioritized backlogs

Example

Score 20 feature ideas using RICE framework, generate prioritized roadmap with rationale

Core Concepts

1. Attack Tree Structure

[Root Goal] | ┌────────────┴────────────┐ │ │ [Sub-goal 1] [Sub-goal 2] (OR node) (AND node) │ │ ┌─────┴─────┐ ┌─────┴─────┐ │ │ │ │ [Attack] [Attack] [Attack] [Attack] (leaf) (leaf) (leaf) (leaf)

2. Node Types

Type

Symbol

Description

Oval

Any child achieves goal

AND

Rectangle

All children required

Leaf

Box

Atomic attack step

3. Attack Attributes

Attribute

Description

Values

Cost

Resources needed

$, $$, $$$

Time

Duration to execute

Hours, Days, Weeks

Skill

Expertise required

Low, Medium, High

Detection

Likelihood of detection

Low, Medium, High

Templates

Template 1: Attack Tree Data Model

from dataclasses import dataclass, field from enum import Enum from typing import List, Dict, Optional, Union import json class NodeType(Enum): OR = "or" AND = "and" LEAF = "leaf" class Difficulty(Enum): TRIVIAL = 1 LOW = 2 MEDIUM = 3 HIGH = 4 EXPERT = 5 class Cost(Enum): FREE = 0 LOW = 1 MEDIUM = 2 HIGH = 3 VERY_HIGH = 4 class DetectionRisk(Enum): NONE = 0 LOW = 1 MEDIUM = 2 HIGH = 3 CERTAIN = 4 @dataclass class AttackAttributes: difficulty: Difficulty = Difficulty.MEDIUM cost: Cost = Cost.MEDIUM detection_risk: DetectionRisk = DetectionRisk.MEDIUM time_hours: float = 8.0 requires_insider: bool = False requires_physical: bool = False @dataclass class AttackNode: id: str name: str description: str node_type: NodeType attributes: AttackAttributes = field(default_factory=AttackAttributes) children: List['AttackNode'] = field(default_factory=list) mitigations: List[str] = field(default_factory=list) cve_refs: List[str] = field(default_factory=list) def add_child(self, child: 'AttackNode') -> None: self.children.append(child) def calculate_path_difficulty(self) -> float: """Calculate aggregate difficulty for this path.""" if self.node_type == NodeType.LEAF: return self.attributes.difficulty.value if not self.children: return 0 child_difficulties = [c.calculate_path_difficulty() for c in self.children] if self.node_type == NodeType.OR: return min(child_difficulties) else: # AND return max(child_difficulties) def calculate_path_cost(self) -> float: """Calculate aggregate cost for this path.""" if self.node_type == NodeType.LEAF: return self.attributes.cost.value if not self.children: return 0 child_costs = [c.calculate_path_cost() for c in self.children] if self.node_type == NodeType.OR: return min(child_costs) else: # AND return sum(child_costs) def to_dict(self) -> Dict: """Convert to dictionary for serialization.""" return { "id": self.id, "name": self.name, "description": self.description, "type": self.node_type.value, "attributes": { "difficulty": self.attributes.difficulty.name, "cost": self.attributes.cost.name, "detection_risk": self.attributes.detection_risk.name, "time_hours": self.attributes.time_hours, }, "mitigations": self.mitigations, "children": [c.to_dict() for c in self.children] } @dataclass class AttackTree: name: str description: str root: AttackNode version: str = "1.0" def find_easiest_path(self) -> List[AttackNode]: """Find the path with lowest difficulty.""" return self._find_path(self.root, minimize="difficulty") def find_cheapest_path(self) -> List[AttackNode]: """Find the path with lowest cost.""" return self._find_path(self.root, minimize="cost") def find_stealthiest_path(self) -> List[AttackNode]: """Find the path with lowest detection risk.""" return self._find_path✓ Make data-driven prioritization decisions faster Stakeholder Communication Draft PRDs, status updates, and stakeholder presentations Example Create executive summary of Q3 roadmap, monthly progress report, feature launch announcement ✓Save 3-5 hours/week on communication overhead Implementation Guide Prerequisites ›Claude Desktop or compatible AI client ›Access to product documentation and roadmap tools (Jira, Notion, etc.) ›Understanding of product management frameworks (RICE, Jobs-to-be-Done, etc.) ›Stakeholder contact information and communication channels Time Estimate 30-60 minutes to see productivity improvements Steps 1Install product management skill 2Start with user story generation for known feature 3Progress to competitive analysis: research 2-3 competitors 4Use for roadmap prioritization: apply RICE/ICE scoring 5Draft stakeholder communications and refine based on feedback 6Build template library for recurring PM tasks 7Share effective prompts with product team Common Pitfalls ⚠Not validating competitive research—verify facts before sharing ⚠Accepting user stories without involving engineering team ⚠Over-relying on frameworks without qualitative judgment ⚠Not customizing outputs to company culture and communication style ⚠Skipping stakeholder validation of generated requirements Best Practices ✓ Do +Validate research and competitive analysis with real data +Collaborate with engineering when generating technical requirements +Customize frameworks and templates to your company context +Use skill for first drafts, refine with stakeholder input +Document successful prompt patterns for PM tasks +Combine AI efficiency with human judgment and intuition ✗ Don't −Don't publish competitive analysis without fact-checking −Don't finalize user stories without engineering review −Don't make prioritization decisions solely on AI scoring −Don't skip customer validation of generated requirements −Don't ignore company-specific context and culture 💡 Pro Tips ★Provide context: company goals, constraints, customer feedback ★Ask for alternatives: 'Show 3 ways to prioritize this roadmap' ★Request stakeholder-specific formatting: 'Executive summary vs. engineering spec' ★Use skill for 70% generation + 30% customization to company needs When to Use This ✓ Use when Use for user story writing, competitive research, roadmap prioritization, stakeholder communication, and PRD drafting. Best for reducing repetitive documentation and research work. ✗ Avoid when Avoid for strategic product vision (requires deep customer empathy), pricing decisions (needs market and financial expertise), or when face-to-face customer discovery is more valuable than speed. Learning Path 1Basic: user stories, feature specs, status updates 2Intermediate: competitive analysis, prioritization frameworks, PRDs 3Advanced: product strategy, go-to-market planning, OKR setting 4Expert: product vision, market positioning, business model innovation Related Skills grill-me 391 mattpocock/skills Productivitysame categorypremortem 197 parcadei/continuous-claude-v3 Productivitysame categorydeslop 119 cursor/plugins Productivitysame categoryframer-motion 99 pproenca/dot-skills Productivitysame categorywrite-a-prd 94 mattpocock/skills Productivitysame categorytravel-planner 92 ailabs-393/ai-labs-claude-skills Productivitysame category Reviews 4.7★★★★★58 reviews G Ganesh Mohane★★★★★Dec 24, 2024 Registry listing for attack-tree-construction matched our evaluation — installs cleanly and behaves as described in the markdown. I Isabella Yang★★★★★Dec 8, 2024 I recommend attack-tree-construction for anyone iterating fast on agent tooling; clear intent and a small, reviewable surface area. A Alexander Tandon★★★★★Dec 4, 2024 Solid pick for teams standardizing on skills: attack-tree-construction is focused, and the summary matches what you get after install. L Lucas Kim★★★★★Nov 27, 2024 Useful defaults in attack-tree-construction — fewer surprises than typical one-off scripts, and it plays nicely with `npx skills` flows. A Alexander Srinivasan★★★★★Nov 27, 2024 attack-tree-construction has been reliable in day-to-day use. Documentation quality is above average for community skills. L Lucas Zhang★★★★★Nov 23, 2024 Registry listing for attack-tree-construction matched our evaluation — installs cleanly and behaves as described in the markdown. R Rahul Santra★★★★★Nov 15, 2024 Solid pick for teams standardizing on skills: attack-tree-construction is focused, and the summary matches what you get after install. L Li Patel★★★★★Nov 3, 2024 We added attack-tree-construction from the explainx registry; install was straightforward and the SKILL.md answered most questions upfront. A Amelia Desai★★★★★Nov 3, 2024 attack-tree-construction fits our agent workflows well — practical, well scoped, and easy to wire into existing repos. M Mei Khanna★★★★★Oct 22, 2024 Keeps context tight: attack-tree-construction is the kind of skill you can hand to a new teammate without a long onboarding doc. showing 1-10 of 58 1 / 6 Discussion Comments — not star reviews No comments yet — start the thread.

attack-tree-construction

What it does

Category

Repository

Last updated

Installation Guide

How to use attack-tree-construction on Cursor

Prerequisites

Run the install command

Select Cursor when prompted

Verify installation

Security Notice

Documentation

List & Monetize Your Skill

Use Cases

User Story & Requirements Generation

Competitive Analysis

Roadmap Prioritization

Install Skill

Attack Tree Construction

When to Use This Skill

Core Concepts

1. Attack Tree Structure

2. Node Types

3. Attack Attributes

Templates

Template 1: Attack Tree Data Model

Stakeholder Communication

Implementation Guide

Best Practices

When to Use This

Learning Path

Related Skills

grill-me

premortem

deslop

framer-motion

write-a-prd

travel-planner

Reviews

Discussion