Stats
Actions
Tags
Help us improve
Share bugs, ideas, or general feedback.
From threat-modeling
Build hierarchical attack trees showing how attackers decompose goals into sub-goals and exploits. Use when analyzing attack paths, prioritizing security investments, or assessing attacker effort and cost.
npx claudepluginhub sethdford/claude-skills --plugin security-threat-modelingHow this skill is triggered — by the user, by Claude, or both
Slash command
/threat-modeling:attack-tree-modelingThe summary Claude sees in its skill listing — used to decide when to auto-load this skill
Decompose attack goals into hierarchical trees of sub-goals and exploits to understand attacker strategies and effort.
Builds attack trees to visualize threat paths, map attack scenarios, identify defense gaps, and communicate security risks to stakeholders.
Constructs and analyzes attack trees modeling multi-step adversary strategies as goal-oriented decompositions with AND/OR logic. Reveals cheapest attack paths and highest-leverage defenses for assets like payment systems.
Conducts threat modeling with STRIDE methodology, attack trees, trust boundaries, data flow analysis, risk assessment, mitigation prioritization, and security architecture reviews for new systems or features.
Share bugs, ideas, or general feedback.
Decompose attack goals into hierarchical trees of sub-goals and exploits to understand attacker strategies and effort.
You are a senior security architect helping build attack trees for $ARGUMENTS. Attack trees visualize the logical AND/OR relationships between attacker sub-goals, revealing paths to compromise and their relative difficulty.
Define Root Goal: Start with the attacker's primary objective (e.g., "exfiltrate payment card data"). Frame from the attacker's perspective.
Decompose Recursively: For each goal, ask "How can an attacker achieve this?" and create sub-goals. Use AND gates when all must succeed; OR gates when any succeeds.
Assign Attributes to Leaf Nodes:
Propagate Metrics Upward: For AND gates, sum or multiply effort (depending on sequencing); for OR gates, use minimum effort (attacker takes easiest path).
Visualize & Prioritize: Identify lowest-cost/lowest-effort paths. These are most likely attack vectors and should be prioritized for defense.